₿ Monolith

Monolith performs zero network I/O. All cryptography runs locally in your browser. Not a substitute for an audited hardware wallet — verify before use.

1. Wallet — Seed Phrase & Derivation

Generate a 24-word BIP39 mnemonic, optionally protect it with a passphrase, and derive the BIP352 scan and spend keys using the standard derivation paths: m/352'/0'/0'/1'/0 for the scan key and m/352'/0'/0'/0'/0 for the spend key. Write down your mnemonic. Anyone with the words can spend your funds.

Network Account

BIP39 passphrase (optional, "25th word")

Leave this empty for a standard seed. If you set one, you must enter it every time you restore — BIP39 has no checksum on the passphrase, so a single wrong character silently produces a different, empty wallet.

Use a BIP39 passphrase

Seed currently derived without a passphrase.

Scan key (`b_scan`)

—

Scan public key (B_scan)

—

Spend key (`b_spend`)

—

Spend public key (B_spend)

—

2. Silent Payment Address (reusable)

The address encodes B_scan ‖ B_spend with bech32m under the human-readable part sp, witness version 0 (so every valid address begins sp1q…). Post it anywhere — every payment lands at a fresh on-chain P2TR output that only your wallet can detect.

Checksum: — Version byte: —

Silent payment address

—

Decode an address

—

QR rendered locally as inline SVG.

Labeled addresses (BIP352 labels)

Labels let you tell payment sources apart with one scan key: B_m = B_spend + hash(b_scan‖m)·G. Label 0 is reserved for change; do not give it out. Hand out m ≥ 1 only.

m	B_m (33-byte key)	Address
Generate a wallet first.

3. Sender Simulation

List each transaction input (txid, vout, script type, input private key). Per BIP352 only P2TR key-path, P2WPKH, P2SH-P2WPKH and P2PKH inputs are summed (taproot keys with odd Y are negated; NUMS-key inputs and other types are skipped). The app computes input_hash, the ECDH shared secret against your B_scan and derives one P2TR output per requested index (K ≤ 2323). An optional label m ≥ 1 targets a labeled address; m = 0 is reserved for change.

Outputs Recipient label m

4. Receiver Detection

Paste the summed input public key A, the smallest outpoint (outpoint_L) and the candidate output x-only keys. The app runs the BIP352 scan loop (k increments after each match, stops at the first miss, K ≤ 2323), including labels.

Summed input public key A (33-byte compressed hex)

Smallest outpoint txid (display order)

Outpoint vout

Labels to scan (integers, space/comma separated; m=0 change is always scanned) Candidate output x-only keys (one 64-hex per line)

5. Backup & App Compatibility

This wallet uses standard BIP39 mnemonic + BIP32 derivation. Any wallet that supports BIP352 silent payments and the derivation path below can restore your funds.

Backup type: 24-word BIP39 mnemonic (+ optional passphrase)
Scan path: m/352'/coin_type'/account'/1'/0
Spend path: m/352'/coin_type'/account'/0'/0
Address format: bech32m, hrp "sp", version byte 0 (sp1q…)
Compatible wallets: Cake Wallet, BitBox02, Blue Wallet (SP builds), Silentium, Shroud

How to restore in another app

Install a wallet that supports BIP352 silent payments (e.g. Cake Wallet).
Choose "Restore from seed" and enter your 24 words.
If you used a passphrase, enter it exactly.
Select the account index (default 0) to match this derivation.
The wallet will scan for payments to your sp1… address.

Important caveats

Silent payments require the receiving wallet to scan the chain. This takes time and battery.
Not all wallets support silent payments yet. Verify before relying on a backup.
Only version byte 0 (sp1q…) is interoperable with current wallets.

6. Derivation Trace

—

7. Conformance Tests

Vectors marked spec are taken from the BIP/RFC/NIST texts (several from the specs you attached). Vectors marked ref are expected values produced by an independent implementation (Python/OpenSSL) and are not official test vectors.

Not run yet.

#	Test and vector source	Status	Detail

8. Wallet Recovery Kit

Recover a Silent Payments wallet produced by this tool or by another BIP352-capable wallet (Cake, Sparrow, Silentium, BitBox02, …). Optionally match against a known sp1… address to confirm the correct derivation.

Target (optional) Expected silent payment address

Network Account from to

Recovery method BIP39 mnemonic (use ? for one missing word) Extended private key (xprv / yprv / zprv / tprv / uprv / vprv) WIF private keys (scan + spend) Raw hex private keys (scan + spend)

Mnemonic (12/15/18/21/24 words; ? = one unknown) BIP39 passphrase (optional)

Up to 1 missing word (brute-force is slow).

9. Paper Wallet — PDF Generator (offline, zero-tracker)

Renders a vector PDF paper wallet entirely in your browser. No fonts, images, or analytics are fetched — the PDF is generated byte-for-byte on this page and delivered as a Blob download. A4 and US Letter are supported; the public side carries your sp1q… address and B_scan / B_spend, the private side carries your 24-word mnemonic and derivation paths.

Options

Page size Copies

Never print to a network printer. Never leave a printed paper wallet in view of a camera. Store the private side in a safe, offline place; the public side is safe to share.

Generate a wallet first.

Event Log

—

10. Power Tools

Offline helpers built on the same verified primitives. Nothing leaves the page.

1 · Payment receipt PDF Detected payment JSON

—

2 · BIP85 child mnemonic

Real BIP85 (HMAC "bip-entropy-from-k", SHAKE256 DRNG), path m/83696968'/39'/0'/words'/index'.

Words Index

—

3 · codex32 share printer (BIP93)

Splits the BIP32 master seed into k-of-n codex32 shares.

Threshold k (2–9) Shares n (k–31) Identifier (4 chars)

—

4 · Change label (m = 0)

The reserved change label key and address (always scanned by this wallet).

—

5 · Input analysis (common-input ownership) Raw transaction hex

—

6 · Encrypted notes / contacts

scrypt (N=32768) + ChaCha20-Poly1305, authenticated header. Passphrase ≥ 8 characters.

Passphrase Text

—

7 · Missing-word recovery

One ? in a 12/15/18/21/24-word phrase; lists every checksum-valid word.

Mnemonic with ?

—

8 · Wallet fingerprint + QR

SHA-256 over the public address data, for verifying a restore.

—

9 · Fee and dust estimator Input type Inputs P2TR outputs Fee rate (sat/vB)

—

10 · Cross-check an output

Does this P2TR key belong to your wallet for that transaction? (k and labels 0–50 scanned.)

Output x-only key Summed input key A Smallest outpoint (txid:vout)

—

11. Toolbox: decoders, key tools, shares, backup

Raw transaction decoder Network Transaction hex (legacy or segwit)

—

Block header verifier 80-byte headers, one 160-hex line each, in chain order

Network

Height of first header (enables difficulty-rule and median-time checks)

Trusted hash of first header (optional anchor)

Trusted hash of last header (optional anchor)

—

Retarget calculator

Old bits (hex)

First block time (unix)

Last block time (unix)

—

Inspect any encoding

Segwit addresses (bech32/bech32m), silent payment addresses, Base58Check, WIF, xpub/xprv, or a scriptPubKey hex. Pasting private keys here is your choice; they stay in this page.

String

—

BIP32 path explorer (shows private keys) Use the loaded wallet's master key …or an extended private key Path

—

SLIP-39 split / recombine Groups (member threshold "of" members), e.g. 2of3 1of1 Groups required Passphrase (printable ASCII) Iteration exponent Extendable backup flag

—

Shares to combine (one per line) Passphrase

—

codex32 (BIP93) split / recover

Threshold k

Shares n

Identifier

—

Shares to recover from (whitespace separated)

—

Encrypted backup file (.mnlt)

scrypt N=32768, r=8, p=1 → ChaCha20-Poly1305; the header is authenticated. Wrong password and file tampering are indistinguishable by design.

Passphrase (8+ characters) Confirm (for export)

—

Backup kit

—

About & Provenance

Monolith implements Silent Payments (BIP352) — a scheme where a sender derives a fresh P2TR output for a recipient without prior interaction. The recipient publishes one static sp1q… address and scans for outputs using their scan private key.

Inlined algorithms

SHA-256 / SHA-512 / HMAC / PBKDF2 — FIPS + RFC (original JS).
RIPEMD-160 — ISO/IEC 10118-3 (original JS).
secp256k1 — SEC 2 v2 §2.4.1, BigInt Jacobian (original JS).
bech32 / bech32m — BIP173 / BIP350 (original JS).
Base58Check — original JS (WIF + xprv/xpub).
BIP32 / BIP39 — derivation and mnemonics (original JS).
QR encoder — byte mode, EC level L, inline SVG (original JS).
PDF writer — uncompressed, vector-only, standard fonts (original JS).

Threat model

Review tool, not a signing device. No network access.
Seed, mnemonic and passphrase are held only in memory. JavaScript strings and BigInts cannot be reliably zeroed, so locking drops references and clears the page, but a memory-forensic attacker on a compromised machine is out of scope.
Reveal and copy actions require explicit user confirmation.
Session auto-lock zeroes secrets after inactivity (default 10 minutes).

1. Wallet — Seed Phrase & Derivation

Recovery phrase (24 words)

Scan key (`b_scan`)

Spend key (`b_spend`)

2. Silent Payment Address (reusable)

Labeled addresses (BIP352 labels)

3. Sender Simulation

Derived outputs

4. Receiver Detection

5. Backup & App Compatibility

How to restore in another app

Important caveats

6. Derivation Trace

7. Conformance Tests

8. Wallet Recovery Kit

9. Paper Wallet — PDF Generator (offline, zero-tracker)

Event Log

10. Power Tools

11. Toolbox: decoders, key tools, shares, backup

Retarget calculator

About & Provenance

Inlined algorithms

Threat model

Confirm

Keyboard shortcuts

Monolith — Paper Backup

Recovery phrase

1. Wallet — Seed Phrase & Derivation

Recovery phrase (24 words)

Scan key (b_scan)

Spend key (b_spend)

2. Silent Payment Address (reusable)

Labeled addresses (BIP352 labels)

3. Sender Simulation

Derived outputs

4. Receiver Detection

5. Backup & App Compatibility

How to restore in another app

Important caveats

6. Derivation Trace

7. Conformance Tests

8. Wallet Recovery Kit

9. Paper Wallet — PDF Generator (offline, zero-tracker)

Event Log

10. Power Tools

11. Toolbox: decoders, key tools, shares, backup

Retarget calculator

About & Provenance

Inlined algorithms

Threat model

Scan key (`b_scan`)

Spend key (`b_spend`)