Loch
Join the waitlist

Your wallet is public. The Loch is not.

Loch is a privacy layer for Solana. It adds a shielded balance to the wallet you already use, whether that is Phantom, Solflare or Backpack, with no new seed phrase. Pay from it, and the payment doesn’t bring your history along.

Scan a wallet address Join the waitlist

v0.1, devnet only, unaudited. Nothing here is ready for real funds. Read the cautions.

Take a sounding of your own wallet.

Paste any Solana address. The leak scanner reads its public history, the same history anyone else can read, and tells you what it gives away: who funded it, who it pays, when its owner sleeps and how much it holds. You get a privacy score out of 100.

The scan runs in your browser and reads public chain data from rpc.lochlayer.com. That endpoint learns which address you looked up. Nothing asks you to connect a wallet, sign anything or type a seed phrase.

This page is being shown inside another page, so the live scan is switched off. Open it in a tab of its own.

More takes longer. How long depends on the endpoint: one that allows about one request a second takes about two minutes for 100 and about twenty for 1000.

Use your own RPCDefault: rpc.lochlayer.com

Point the scan at a node or a provider you trust. Its address is kept in this browser only, in localStorage, and is sent to nobody.

The page reloads so that its security policy allows this endpoint and no other. Use https, or http for a node on this machine.

Example report

This wallet is invented. The findings and their wording are the scanner’s own. Scan an address and its report takes this one’s place.

Privacy score

49of 100

Shallow water. Most of this wallet’s story can be read from the surface.

Leak report for Fh3q…Tz8K. 300 transactions scanned, 412 transfers.

Privacy score 49 of 100, drawn as a stepped bedPrivacy score 49 of 100 for Fh3q…Tz8K. A wallet with no leaks starts at 100. Funding source is public: less 10, leaves 90. Recurring counterparties: less 16, leaves 74. Your time zone is guessable: less 10, leaves 64. Exact amounts passed straight through: less 10, leaves 54. Balance is visible to everyone: less 5, leaves 49.No leaks100startFunding90−10Payees74−16Hours64−10Amounts54−10Balance49−5Privacy score 49 of 100, drawn as a stepped bedPrivacy score 49 of 100 for Fh3q…Tz8K. A wallet with no leaks starts at 100. Funding source is public: less 10, leaves 90. Recurring counterparties: less 16, leaves 74. Your time zone is guessable: less 10, leaves 64. Exact amounts passed straight through: less 10, leaves 54. Balance is visible to everyone: less 5, leaves 49.No leaks100startFunding90−10Payees74−16Hours64−10Amounts54−10Balance49−5Privacy score 49 of 100, drawn as a stepped bedPrivacy score 49 of 100 for Fh3q…Tz8K. A wallet with no leaks starts at 100. Funding source is public: less 10, leaves 90. Recurring counterparties: less 16, leaves 74. Your time zone is guessable: less 10, leaves 64. Exact amounts passed straight through: less 10, leaves 54. Balance is visible to everyone: less 5, leaves 49.No leaks100startFunding90−10Payees74−16Hours64−10Amounts54−10Balance49−5Privacy score 49 of 100, drawn as a stepped bedPrivacy score 49 of 100 for Fh3q…Tz8K. A wallet with no leaks starts at 100. Funding source is public: less 10, leaves 90. Recurring counterparties: less 16, leaves 74. Your time zone is guessable: less 10, leaves 64. Exact amounts passed straight through: less 10, leaves 54. Balance is visible to everyone: less 5, leaves 49.No leaks100startFunding90−10Payees74−16Hours64−10Amounts54−10Balance49−5Privacy score 49 of 100, drawn as a stepped bedPrivacy score 49 of 100 for Fh3q…Tz8K. A wallet with no leaks starts at 100. Funding source is public: less 10, leaves 90. Recurring counterparties: less 16, leaves 74. Your time zone is guessable: less 10, leaves 64. Exact amounts passed straight through: less 10, leaves 54. Balance is visible to everyone: less 5, leaves 49.No leaks100startFunding90−10Payees74−16Hours64−10Amounts54−10Balance49−5Privacy score 49 of 100, drawn as a stepped bedPrivacy score 49 of 100 for Fh3q…Tz8K. A wallet with no leaks starts at 100. Funding source is public: less 10, leaves 90. Recurring counterparties: less 16, leaves 74. Your time zone is guessable: less 10, leaves 64. Exact amounts passed straight through: less 10, leaves 54. Balance is visible to everyone: less 5, leaves 49.No leaks100startFunding90−10Payees74−16Hours64−10Amounts54−10Balance49−5Privacy score 49 of 100, drawn as a stepped bedPrivacy score 49 of 100 for Fh3q…Tz8K. A wallet with no leaks starts at 100. Funding source is public: less 10, leaves 90. Recurring counterparties: less 16, leaves 74. Your time zone is guessable: less 10, leaves 64. Exact amounts passed straight through: less 10, leaves 54. Balance is visible to everyone: less 5, leaves 49.No leaks100startFunding90−10Payees74−16Hours64−10Amounts54−10Balance49−5
A wallet with no leaks sits 100 deep, out of sight. Each finding takes depth away, and the hatching is what it cost. Where the bed ends up is the score.

The same, as a statement

  1. A wallet with no leaksEvery scan starts here and loses depth for each thing the public history gives away.100
  2. MediumFunding source is publicFirst funds came from 5tzF…uAi9. Anyone can follow this link back.−10
  3. MediumRecurring counterparties4 addresses interact with you 3 or more times (top: 9fRk…2mVd ×14, Bq7T…e1Lw ×9, H2xD…pK4s ×6). Regular payments reveal employers, clients or friends.−16
  4. MediumYour time zone is guessableAlmost no activity between 22:00 and 04:00 UTC. That is likely your sleep window.−10
  5. MediumExact amounts passed straight through2 outgoing transfers matched an incoming amount within 10 minutes. This links the sender to the final recipient.−10
  6. LowBalance is visible to everyone41.207 SOL and 6 token accounts are public. Anyone you pay can look.−5
  7. Privacy scoreWhat helps: a fresh address for each payer, no forwarding of exact amounts, and savings kept in a shielded balance.49of 100

When it is active, and who it deals with

Transfers by hour of day, UTC412 transfers by hour of day, UTC. Busiest hour 16:00, 39 transfers. Almost nothing from 22:00 to 04:00 UTC (3 of 412): that is probably when the owner sleeps, which gives away a time zone.000612182439Quiet 22:00 to 04:00Transfers by hour of day, UTC412 transfers by hour of day, UTC. Busiest hour 16:00, 39 transfers. Almost nothing from 22:00 to 04:00 UTC (3 of 412): that is probably when the owner sleeps, which gives away a time zone.0006121824 UTC39Quiet 22:00 to 04:00Transfers by hour of day, UTC412 transfers by hour of day, UTC. Busiest hour 16:00, 39 transfers. Almost nothing from 22:00 to 04:00 UTC (3 of 412): that is probably when the owner sleeps, which gives away a time zone.0006121824 UTC39Quiet 22:00 to 04:00Transfers by hour of day, UTC412 transfers by hour of day, UTC. Busiest hour 16:00, 39 transfers. Almost nothing from 22:00 to 04:00 UTC (3 of 412): that is probably when the owner sleeps, which gives away a time zone.0006121824 UTC39Quiet 22:00 to 04:00Transfers by hour of day, UTC412 transfers by hour of day, UTC. Busiest hour 16:00, 39 transfers. Almost nothing from 22:00 to 04:00 UTC (3 of 412): that is probably when the owner sleeps, which gives away a time zone.0006121824 UTC39Quiet 22:00 to 04:00
Transfers by hour of day, UTC. Deeper is busier. The hatched shoal, where almost nothing happens, is likely when the owner sleeps.
Who this wallet deals withThis wallet has dealt with 291 addresses in 412 transfers. 9fRk…2mVd: 14 transfers. Bq7T…e1Lw: 9 transfers. H2xD…pK4s: 6 transfers. 5tzF…uAi9: 4 transfers (funded this wallet). 287 other addresses, 379 transfers between them.9fRk…2mVd×14Bq7T…e1Lw×9H2xD…pK4s×65tzF…uAi9×4funded this wallet287 othersWho this wallet deals withThis wallet has dealt with 291 addresses in 412 transfers. 9fRk…2mVd: 14 transfers. Bq7T…e1Lw: 9 transfers. H2xD…pK4s: 6 transfers. 5tzF…uAi9: 4 transfers (funded this wallet). 287 other addresses, 379 transfers between them.9fRk…2mVd×14Bq7T…e1Lw×9H2xD…pK4s×65tzF…uAi9×4funded this wallet287 othersWho this wallet deals withThis wallet has dealt with 291 addresses in 412 transfers. 9fRk…2mVd: 14 transfers. Bq7T…e1Lw: 9 transfers. H2xD…pK4s: 6 transfers. 5tzF…uAi9: 4 transfers (funded this wallet). 287 other addresses, 379 transfers between them.9fRk…2mVd×14Bq7T…e1Lw×9H2xD…pK4s×65tzF…uAi9×4funded this wallet287 othersWho this wallet deals withThis wallet has dealt with 291 addresses in 412 transfers. 9fRk…2mVd: 14 transfers. Bq7T…e1Lw: 9 transfers. H2xD…pK4s: 6 transfers. 5tzF…uAi9: 4 transfers (funded this wallet). 287 other addresses, 379 transfers between them.9fRk…2mVd×14Bq7T…e1Lw×9H2xD…pK4s×65tzF…uAi9×4funded this wallet287 othersWho this wallet deals withThis wallet has dealt with 291 addresses in 412 transfers. 9fRk…2mVd: 14 transfers. Bq7T…e1Lw: 9 transfers. H2xD…pK4s: 6 transfers. 5tzF…uAi9: 4 transfers (funded this wallet). 287 other addresses, 379 transfers between them.9fRk…2mVd×14Bq7T…e1Lw×9H2xD…pK4s×65tzF…uAi9×4funded this wallet287 others
Who this wallet deals with. A heavier line is more transfers.

Dive in, send privately, surface.

Three steps, in this order, inside the wallet you already have. Loch derives its keys from one message signed by that wallet, so there is no new seed phrase to write down.

  1. 1Dive in

    Deposit SOL from your public wallet into the Loch. A screening authority checks where the funds came from and co-signs the deposit. Without that signature it does not go through.

    An observer sees your address, the amount, the time, and that it went into the Loch.

    From
    Fh3q…Tz8K
    To
    The Loch
    Amount
    5.000devnet SOL
    Time
    14:02 UTC

  2. 2Send privately

    Pay any other Loch balance. A zero-knowledge proof shows the payment is valid without showing who paid, who was paid or how much. A relayer submits it and takes its fee from the shielded amount, so your public wallet does not appear.

    An observer sees a proof, two nullifiers, two new commitments and the relayer’s fee. No sender, no recipient, no amount.

    From
    To
    Amount
    Relayer’s fee
    0.0025devnet SOL

  3. 3Surface

    Withdraw to any Solana address, yours or someone else’s. The proof shows the funds are in the Loch and yours to move, and ties the withdrawal to no particular deposit.

    An observer sees an address receive an amount from the Loch, and when. Not which deposit it came from.

    From
    The Loch
    To
    9fRk…2mVd
    Amount
    2.000devnet SOL
    Which deposit

Each record is an example of what the chain keeps at that step. A bar stands for something the chain is never given.

What the Loch cannot hide

A pool hides you only among the other people using it, and on devnet that is a small crowd. If you surface the exact amount you dived in with, soon afterwards, anyone can pair the two and most of the benefit is gone. Leave time between them, and surface a different amount.

What keeps it private.

Six ideas do the work. Each is said here in plain words, with what anyone can see set beside what only you can. The docs give each one its technical name.

The extension’s popup, drawn here with example figures. The extension is a devnet alpha. It is not in any browser store.

  • Sealed notes

    Your shielded balance is a handful of notes. Each note says how much it holds and whose it is. The chain is given a fingerprint of the note, and never the note.

    In the docs: notes and commitments

    An observer sees one fingerprint for each note. It says nothing about the amount or the owner.

    Only you see what each note holds, and that it is yours.

  • A proof in place of the details

    To pay, your own device works out a zero-knowledge proof. It shows that the notes you spend exist, that they are yours and that the amounts add up. The program on Solana checks the proof and learns nothing more.

    In the docs: the proof

    An observer sees a proof, 256 bytes long, and that the program accepted it.

    Only you see which notes you spent, who you paid and how much.

  • A tag for every spent note

    Spending a note publishes a tag made from it. The program refuses a tag it has seen before, so no note is spent twice. Nobody can match a tag to the fingerprint of its note.

    In the docs: nullifiers

    An observer sees two tags with every payment.

    Only you see which of your notes each tag cancels.

  • Sealed for the recipient

    A new note travels with the payment, encrypted so that only the person it is for can open it. Their wallet reads the Loch and finds it. The note tells them the amount, and not who sent it.

    In the docs: encrypted notes

    An observer sees 87 bytes they cannot read, beside each new fingerprint.

    Only the recipient sees the amount they were sent.

  • Carried by a relayer

    A relayer puts the payment on Solana and pays the network fee. It takes its own fee out of the shielded amount, so your public wallet is not on the transaction. It cannot change who is paid or how much. It does see your IP address and the moment you sent.

    In the docs: the relayer

    An observer sees the relayer’s address and its fee.

    Only you see which wallet is behind the payment.

  • Keys from the wallet you have

    Your wallet signs one message, and Loch makes your shielded keys from that signature. There is no new seed phrase. The same wallet makes the same keys again, so sign that message nowhere but in Loch.

    In the docs: keys

    An observer sees nothing. Signing a message is not a transaction.

    Only you see the keys, and with them your shielded balance.

The docs say how each of these is built: the hash, the proof system, the cipher and the sizes. They also list everything this version does not protect.

Read the technical docs

Read the cautions before you dive.

A chart prints its warnings in magenta, where the navigator cannot miss them. These are ours, followed by what we have committed to.

Cautions

Devnet only
Loch v0.1 runs on Solana devnet, with test SOL. There is no mainnet deployment and nowhere to send real funds.
Unaudited
Neither the circuit nor the program has had an external audit. Mainnet waits for both.
A one-person setup
The proving key comes from a development setup with a single contributor. Whoever ran it could forge proofs and drain the pool. A public ceremony with many contributors has to replace it before mainnet.
Deposits are screened
A screening authority must co-sign every deposit and can refuse one. It sees the address you deposit from. If you want a pool with nobody at the door, this is not it.
One signature holds your keys
Your shielded keys come from your wallet’s signature on one message, “Loch key derivation v1”. Anyone who gets you to sign that message gets the same keys, and with them your shielded balance. Sign it nowhere but in Loch.
Diving in and surfacing are public
Every deposit and every withdrawal is an ordinary public transaction: the address, the amount and the time. Only what happens between them is shielded.

Commitments

Withdrawals can never be paused
The program’s pause switch stops new deposits and nothing else. It has no instruction that stops you surfacing. While Loch is on devnet the program itself can still be upgraded by its admin key.
Open source
The circuit, the program, the scanner, the extension and this site will be published as open source, in one repository, before any mainnet release. Until you can read them, there is nothing here to trust yet.
No analytics
This site sets no cookies and loads nothing from anyone else’s server: no trackers, no scripts, no fonts. The only requests that leave it are the ones you start: a scan, or joining the waitlist. The extension sends no telemetry.
No token
There is no Loch token and none is for sale. Anything offered under that name is not ours.
Product before token
The work in front of us is a wallet that keeps a balance private, then two audits. That comes first.

Be told when the devnet alpha is ready to try.

One message when the extension’s devnet alpha is ready for you to install, and one more when the audited release is. Nothing else.

Your address is stored with the day you joined and used for those two messages only. No newsletter, no sharing, no tracking pixels, no tracked links. To be removed, reply to either message. The address is then deleted. What this site keeps.

Joined the waitlist

You will get one message when the devnet alpha is ready to try, and one when the audited release is. If the address was already on the list, nothing changed.

That address was not accepted

Nothing was stored. Check the address for typing mistakes and join again. The waitlist takes plain addresses like name@example.com.

The waitlist did not take your address

The waitlist could not store your address just now, or too many attempts came from your network. Nothing was stored. Wait ten minutes and join again.