How We Protect Your Private Key

The full lifecycle of a HaoKey private key — secure generation, AES-256-GCM encryption, an on-chain permission check before sale, one-time delivery with deletion, and in-browser verification.

A vanity address is only as safe as the way its key was created and handled. Here is exactly what happens to a key from generation to delivery — and what you can do to make it fully yours.

1. Generation

• Keys are generated offline on our GPU farm, not on the web server.
• Every search starts from a key taken from a cryptographically secure random generator with the full 256 bits of entropy. We never derive keys from short seeds — the flaw behind the 2022 Profanity incident (details).

2. Storage until sale

• When a key arrives, the server recomputes the address from the key and checks it against the mask. Mismatches are rejected.
• The key is encrypted with AES-256-GCM. The address is bound to the ciphertext as authenticated data, so an encrypted key cannot be swapped onto another address.
• The encryption key is stored separately from the database as a secret of our hosting platform.

3. Check before sale

Before an address is handed to a buyer, we query the TRON network: if the account's owner or active permissions were ever changed, the key is treated as compromised, the address is withdrawn from sale and you get a different one.

4. One-time delivery

• After the payment is confirmed on-chain, the order page lets you reveal the key once.
• Revealing and erasing happen in one database operation: the encrypted key is deleted at the moment it is shown. A second attempt returns "already issued".
• Order pages are never cached and are excluded from search engines.

5. Verification in your browser

Your browser derives the TRON address from the delivered key and confirms it matches before you save it. You can also import the key into TronLink and compare all 34 characters — see how to import a key.

Make the account fully yours

A seller always sees a key before the sale. For large balances we recommend removing that trust entirely: move the account's owner permission to a key you already control (or a multisig). After that, the original key — whoever might have a copy — can no longer move funds. Step-by-step: is a vanity address safe?

What we never do

• We never ask for your seed phrase or any other private key.
• We never send keys by email or chat. Support will never ask you to "verify" a key.
• We never sell lookalike addresses that imitate someone else's wallet.

Reporting a vulnerability

Found a security issue? Contact us via Telegram (Support button) — the contact is also published in /.well-known/security.txt. Please give us a reasonable time to fix it before disclosing.