How Cryptograph Works

From request to signature

The iPhone shows your portfolio and prepares each request. It handles networking but does not hold the mnemonic or private spending keys.

Apple Watch decodes each transaction for itself. The approval screen comes from the transaction it will sign, not a summary from the iPhone or a server.

A compromised iPhone can expose public wallet information or prepare a malicious request. You still decide whether to approve what Apple Watch shows you.

Why Apple Watch?

• A separate surface: Apple Watch has no Safari app. Cryptograph keeps signing material on a separate device, outside the iPhone's browser, message, and third-party app surface.
• Already with you: You approve on a device already on your wrist, with no second object to carry or retrieve.
• No purchase record with Cryptograph: The app is sold through Apple's App Store. Cryptograph requires no account and receives no customer name or shipping address.
• A familiar form: An Apple Watch on your wrist says nothing about what you own.
• Physical controls: A watch passcode and wrist detection are required. Time Lock can add delays and location-aware spend limits.

What You Trust

• Apple Secure Enclave: Hardware-isolated chip on the watch that stores the encryption key for your mnemonic. The key cannot be exported.
• Cryptograph's implementation: The wallet software that generates keys, builds transactions, and manages signing. Security-critical code is open source.
• App Store distribution: The app is delivered through Apple's App Store. No sideloading, no direct downloads.

Cryptograph's signing architecture does not depend on a company-held key or custody service. Network access and market data still travel through external infrastructure. You still approve every transfer on the watch, and nothing is signed without that approval.

Recovery

• Backups are encrypted on the watch before any data reaches the phone
• The phone never sees plaintext recovery data. It handles only opaque ciphertext
• Encryption: PBKDF2 (1,000,000 iterations) + ChaCha20-Poly1305, secured with a PIN or passphrase you choose on the watch
• Existing wallets can be imported from 12 or 24 BIP39 words; the advanced 24-word flow also supports a BIP39 passphrase
• BIP39 passphrases are limited to 1–50 printable ASCII characters with no leading, trailing, or repeated spaces. Why Cryptograph uses this stricter profile
• For a Cryptograph-generated wallet, your Recovery Sheet or Photo Backup is the intended way to restore after losing the watch
• Loss of both the watch and every recovery copy is permanent. There is no backdoor, server recovery, or override

Cryptograph requires you to create and verify a backup during initial setup. There is no "skip" button.

Supply Chain Security

• Updatable wallets require trust: A compromised update can misuse legitimate key-access paths during normal use. This is true for any wallet with updatable software or firmware.
• The update mechanism is the security boundary: A hardware wallet is only as trustworthy as its latest firmware update. The security boundary is the update path rather than the device itself.
• Complexity expands the attack surface: A hardware wallet includes firmware, companion apps, update channels, and dependencies. Every layer increases the trusted computing base. Complexity is a security liability.
• Cryptograph keeps the critical path narrow: Keys remain on Apple Watch. Signing happens on the watch. There is no backend custody and no large host application required to manage keys.
• App Store review adds an independent gate: Apple reviews each update before distribution. Cryptograph still trusts its own build pipeline.
• Small, inspectable code surface: Cryptograph is implemented as native code with a deliberately small dependency surface. Security-critical components are open source.

Limits

• Compromised updates: Any updatable wallet must trust its update mechanism. If an attacker compromises the developer's build pipeline, a tampered version of the app can misuse legitimate key-access paths and exfiltrate secrets. Secure Enclave protects keys at rest, not against a compromised version of the app at runtime. Cryptograph reduces this risk by keeping key use narrow and visible, distributing through Apple's App Store (independent friction), and making security-critical code publicly inspectable.
• Apple platform compromise: A fundamental breach of the Secure Enclave or watchOS is out of scope. Cryptograph trusts Apple's hardware security.
• Lost recovery material: If you lose your watch and your Recovery Sheet or Photo Backup, your funds are permanently inaccessible.
• Physical coercion: Time Lock imposes delays and spend limits, but sustained coercion longer than your configured delay can eventually overcome it.

For the full technical analysis, see the Technical Security Overview.