XELIS Wallet security best practices

Your password encrypts the wallet file on this device. Pick a passphrase of at least 12 characters with mixed case, numbers, and symbols — or a four-word random passphrase from a memorable system like Diceware.

Store the password in a real password manager (1Password, Bitwarden, KeePassXC). Do not store your seed phrase there.

Detailed guidance lives in the backup guide. The short version:

• Two copies, two locations, paper or metal.
• Never digital — no photos, no clouds, no notes apps.
• Never share it with anyone, ever, for any reason.

XELIS Wallet is only as safe as the device running it. Reduce attack surface:

• Run a maintained OS — patched Windows 11, current macOS, current Linux distro.
• Don't install random "wallet helper" tools or browser extensions on the same machine.
• Avoid pirated software. A surprising amount of it bundles clipboard hijackers that swap crypto addresses on copy.
• Use a separate browser profile for crypto-related activity.

Only download XELIS Wallet from this site or the official GitHub releases. If a download looks suspicious or came from anywhere else, delete it and re-download from the official source. Phishing sites that copy the look of legitimate wallet sites are common.

The most successful attacks on crypto users don't break the cryptography — they trick the user.

• Bookmark this site and use the bookmark; never click links from DMs or unsolicited emails.
• No legitimate XELIS team member will DM you offering "support". Block and report imposters.
• If a wallet on social media offers an "airdrop" that asks for your seed phrase, it's stealing your funds.

If you die or are incapacitated, no-one can access your XELIS without your seed. Document where the seed is stored (not what it is) in a will or sealed letter with a trusted lawyer or family member. Several services exist specifically for crypto inheritance planning.

Generic advice helps, but security only sticks once you've thought concretely about who might come for your funds and how. Walk through three questions on paper before tuning anything:

• Who is plausibly motivated? Opportunistic malware operators are after every wallet on every machine. Targeted attackers (an ex, a competitor, a scammer who scraped a leak) need to know you hold XEL. The two categories deserve different defences.
• What's the worst day look like? Laptop stolen at a café. Phone lost with the wallet app installed. Spouse opens an "invoice" PDF on the household machine. Each scenario forces a concrete control — full-disk encryption, screen-lock timeout, separate user accounts.
• What is recovery actually going to require? If your house burns down tonight, can you still reach the seed phrase tomorrow? If not, your backup strategy needs a second geography, not just a second copy.

This exercise takes fifteen minutes and is the single highest-leverage thing you can do for your XELIS Wallet security posture. Re-do it once a year, or any time your life circumstances change.

For balances you'd be devastated to lose, separate the wallet from the rest of your digital life. A cheap second-hand laptop, wiped and reimaged with a fresh OS, is enough. It runs XELIS Wallet, a password manager, and nothing else — no email, no browser logins, no random downloads.

Disable auto-connect on every Wi-Fi network except your own. Turn off Bluetooth when not actively pairing. Use full-disk encryption (BitLocker on Windows, FileVault on macOS, LUKS on Linux). Boot the machine only when you need to transact.

The point isn't paranoia — it's reducing the number of programs and network sessions that could be exploited to reach your seed. A machine that does one thing is dramatically harder to compromise than one that does fifty.

Clipboard hijackers are the single most common way crypto users lose funds without realising why. The malware sits silently in the background, watches the clipboard, and when it sees something that looks like a wallet address it swaps it for the attacker's address. You paste; you send; the coins land in the wrong wallet.

Three habits defeat this attack class entirely:

• Always check the first six and last six characters of the destination address in the Send dialog — not the address you copied, the one the wallet shows you. If they don't match, abort.
• Send a tiny test transaction first for any new recipient. A few cents of XEL confirms the route is clean before you move the real amount.
• Prefer QR codes over copy-paste when sending between your own devices. Clipboard malware can't tamper with what the camera sees.

Security drifts. New apps get installed, browser extensions accumulate, password rotations get postponed, the backup you made in 2023 might no longer exist in 2026. A short quarterly review keeps the posture you set up actually intact.

• Confirm both seed-phrase backups are still where they should be and still legible.
• Update XELIS Wallet to the latest signed release; review the changelog.
• Patch your OS and remove software you no longer use.
• Test a recovery into a throwaway wallet from your written seed — proves the seed still works without exposing your real balance.
• Rotate the wallet password if you've shared the machine with anyone for any reason since the last review.

Put a recurring calendar reminder in. The hardest part of security hygiene is remembering to do it.