Your keys are
yours, or they aren't.
A self-custody wallet is one where the private keys are generated on your device and encrypted with a password only you know — no account, no custodian, nobody who can freeze or restore it. This page is the mechanical version: what Orbit actually does with your keys, in enough detail that you can check it.
Custodial vs self-custody, without the hand-waving.
Custodial
A company holds the keys and credits you a balance in its own ledger. You get password resets and a support desk. You also get freezes, withdrawal limits, identity checks, and exposure to that company’s solvency.
Self-custody
You hold the keys; the network settles directly against your signature. No freezes, no limits, no counterparty. Also no reset link — the recovery phrase is the only way back in.
Neither is universally correct. Custody is a trade: convenience and a safety net, in exchange for a company standing between you and your money. Self-custody removes the company and hands you the responsibility it was carrying. Orbit is built entirely for the second trade, which is why the rest of this page is about the part you are now responsible for.
What happens when Orbit creates a wallet.
A phrase, then thirteen sets of keys.
Orbit generates a BIP39 recovery phrase in your browser using the platform's own cryptographic randomness. Every chain's keys are then derived from that one phrase along the standard path for that chain:
- Ethereum, Base, Arbitrum and Polygon at
m/44'/60'/0'/0/0— one address across all four - Bitcoin, Litecoin and Dogecoin at coin types 0, 2 and 3, as standard pay-to-public-key-hash addresses
- Solana from the first 32 bytes of the same seed
Because these are the standard paths and not something Orbit invented, the same phrase restores the same addresses in any other wallet that follows the same specification. You are not locked in — which is the difference between holding keys and holding an account.
How the phrase is encrypted before it is stored.
600,000 PBKDF2 iterations
Your password is stretched with PBKDF2-SHA256 over a random 16-byte salt — well above the current OWASP floor, and deliberately slow to brute-force.
AES-GCM-256
The derived key encrypts the vault with authenticated encryption, so a tampered or wrong-password blob fails to decrypt rather than returning garbage.
Stored locally, never sent
The encrypted blob stays in your browser’s local storage. The plaintext phrase is never written to disk and never leaves the device.
The consequence worth sitting with: your password is not a login, it is the encryption key. Orbit has no copy of it and no way to verify it except by trying to decrypt. That is what makes the vault genuinely yours, and it is also why there is no reset.
Backup, re-reveal, and the case with no answer.
Write it down once. Really.
Orbit shows the recovery phrase once at creation and asks you to confirm you have it. If you skipped that, you can re-enter your password later and Orbit will re-derive the key from the stored salt and show the phrase again for a single view — without unlocking a session or writing anything new.
- Phrase you wrote down + no device → restores everything, anywhere
- Device with the vault + password → re-reveals the phrase
- No phrase and no password → nothing can be recovered, by anyone
That third line is not a policy Orbit could soften. There is no server-side copy to fall back on, which is the same property that means no one can seize or freeze it either.
What each build can do — stated plainly.
Orbit ships one codebase to three surfaces, but they are not all at the same stage, and a page about custody is the wrong place to be vague about it.
Web
Create a wallet, back it up, add addresses to track, and receive. Signing and broadcasting an outgoing transaction is not enabled in the browser build — the app says so before you start, not at the final confirm.
Android
The same wallet in an installable app, distributed as a direct APK rather than through a store. Same creation and backup flow, same broadcast limitation as the web build.
Desktop
The build that signs and broadcasts — the one to install if you intend to send. Download it for Windows, or compare the three surfaces first.
So today Orbit is complete as a place to generate and hold keys across thirteen networks, and incomplete as a place to spend from. That gap is real and this page is not going to bury it in a footer.
Straight answers.
What is a self-custody wallet?
A self-custody wallet is one where the private keys that control your coins are generated and stored by you, not by a company. There is no balance held on your behalf and no account to be frozen, because there is no account — the network sees only an address and a valid signature.
The practical test is simple: if a support team can reset your access, it is custodial. If losing your recovery phrase means the funds are gone permanently, it is self-custody. Orbit is the second kind.
Where does Orbit store my recovery phrase?
On your own device, encrypted. Your password is stretched with PBKDF2-SHA256 at 600,000 iterations against a random 16-byte salt, and the resulting key encrypts the vault with AES-GCM-256. The encrypted blob lives in your browser's local storage; the plaintext phrase is never written to disk and never sent to a server.
Orbit's backend never receives it, so there is nothing on the server side to leak or subpoena. The flip side is that a lost password is a lost vault — see the recovery question below.
Can Orbit recover my wallet if I lose my phrase?
No, and no wallet that describes itself as self-custody honestly can. Orbit never holds your recovery phrase, so there is nothing on our side to restore from.
What Orbit can do is show you the phrase again on a device that already has the vault: re-enter your password and it re-derives the key from the stored salt and decrypts the phrase for a one-time view. That only works where the encrypted vault already exists — it is a reminder, not a recovery service.
Is a self-custody wallet safe in a browser?
The phrase is generated in your browser from crypto.getRandomValues and immediately encrypted with your password before anything is stored, so the browser never keeps a readable copy. The app also ships a strict Content-Security-Policy that blocks inline and third-party scripts.
That said, a browser is a shared surface. For a balance you would be upset to lose, use the desktop or Android build, and consider a multisig vault so no single key can move the funds.
Do I need an account, an email or ID?
None of the three. There is no signup step, no email confirmation and no identity check — you open the app, create a wallet and you are holding it. The only thing tied to you is the recovery phrase you wrote down.
Does one wallet cover Ethereum and Bitcoin?
Yes — one recovery phrase derives keys for every network Orbit supports, using each chain's standard path. The full list, and which networks you can create a wallet on versus track an address on, is on the multichain wallet page.
Hold your own keys.
Understand what that means.
No account, no email, no custodian. Create a wallet in your browser.