How Homing keeps your crypto safe

Plain-language overview, updated October 8, 2026

Homing needs a Kraken API key that can withdraw funds. That's a powerful thing to hand over, so the whole design starts from one rule: even if someone broke into Homing completely, they shouldn't be able to take your crypto. Here's how each layer works.

1. The key itself is limited

When you connect Kraken, Homing asks Kraken which permissions your key has, and our server checks Kraken's answer itself. It refuses any key that has more than Query funds and Withdraw funds. That means a Homing key can never place trades (how a 2022 leak at another service drained accounts) and can never add a new withdrawal address. Kraken itself only lets a key withdraw to addresses you saved and approved in your Kraken account by email.

2. We can't read your key

Your key is encrypted in your browser before it's saved, using AES-256-GCM. The encryption key is unlocked by your passkey (through a WebAuthn feature called PRF), by a passphrase if your passkey doesn't support PRF, or by your printed recovery key. None of those ever reach our servers, so what we store is a locked box we can't open. Every encrypted item is tied to your account, so it can't be swapped with anyone else's.

3. Requests are signed on your device

Kraken doesn't accept requests straight from web browsers, so Homing's server passes them along. Each request is signed on your device first. The signature covers the amount and destination, so our server can't change them. It can only pass the request on or drop it. We don't log or store the requests.

4. Every transfer needs you, right then

There are no automatic transfers. Each one needs a fresh passkey approval (your face, fingerprint or security key). Our server independently refuses any withdrawal that wasn't approved in the last three minutes, that doesn't name its destination and a fee cap, that uses a different Kraken key than the one you connected, or that goes to an address you haven't confirmed in Homing. Kraken then checks the address against your saved address again.

5. Passkeys instead of passwords

You sign in with a passkey, which can't be phished or reused on another site. Sessions end after 30 idle minutes, and the app locks itself after 15 minutes without use, or after 1 or 4 hours if you choose a longer auto-lock in Settings. So that closing the app doesn't lock it sooner than that, Homing keeps a copy of your unlock on your session, sealed with a key that never leaves your device: neither half opens anything alone, the copy stops working when your auto-lock time runs out, and locking throws your device's half away. Every send asks for your passkey, however long the app stays unlocked. Connecting a Kraken key, confirming a wallet address, adding or removing a passkey, changing your recovery key and deleting your account all ask for your passkey again. Disconnecting Kraken doesn't, on purpose: cutting off access should always be one tap. Using your recovery key signs out every other device.

6. The website is locked down

• A strict Content Security Policy only lets the site run its own code, with no third-party scripts, ads or trackers.
• The site can't be embedded in other sites, which blocks clickjacking.
• Cookies are secure, HTTP-only and same-site only. Every change request must come from Homing itself.
• Sign-in, recovery and Kraken requests are rate-limited.

7. What you can do

• Use a dedicated Kraken key just for Homing, and delete it at Kraken if you stop using Homing.
• Check each wallet address against your wallet app character by character before confirming it.
• Send a small test the first time you use an address (Homing suggests this automatically).
• Keep your recovery key offline, somewhere safe.

Limits we're open about

• Kraken's IP-address restriction for API keys can't be used yet, because our servers don't have fixed addresses. This is planned.
• Like any website, Homing depends on the code we serve being honest. We keep dependencies minimal and changes reviewed.
• If your device itself is compromised, an attacker could act while you're signed in, but still only toward addresses saved in your Kraken account.

Report a problem

Found a security issue? Email support@gethoming.app with "Security" in the subject. We'll respond quickly and credit you if you'd like.