A funding address and the five identity keys, derived from one phrase — with nothing sent anywhere. Take the page offline first if you mean it.
This page never contacts the network. Key generation runs inside the WASM SDK that is already loaded, so you can pull the plug and it keeps working. The safe way to use it: download the offline copy, open it on a machine that stays offline, write the phrase down on paper, and carry only the address back.
One file of about 10 MB with the whole tool inside. Open it on a machine that stays offline and generate there — that is the point.
Or generate here first to see what it produces. Keys made in an online browser are fine for testnet and for a look around; for real funds, take the copy.
connect-src 'none' in its own content security policy, so the browser refuses any request the page might make.This one phrase is the identity and the funding key. There is no reset, no support desk and no second copy.
An ordinary Dash address. Send DASH here from any wallet, then convert it to Platform credits in onboard. Scan the code instead of typing it.
Same key, other encoding. Both are public, so these two lines are the only thing that needs to travel back to an online machine.
| Key | Role | Path | Private key (WIF) |
|---|
An identity's keys are not fixed at creation. If one of the five is missing — say the CRITICAL authentication key, without which tokens cannot be moved — it can be added later. This is the one transition the MASTER key signs, and it is what that key is for.
This copy has no network, so the three numbers below have to be read off the identity elsewhere — the explorer shows all three. Nothing you type here leaves this machine.
Every change to an identity is signed by its master key, whether you are adding a key or switching one off. This part is needed for both.
An identity's keys need not come from a phrase — that is this page's habit, not a rule. Dash Evo Tool hands you keys one at a time, so a master key on its own is a normal thing to have. Nothing typed here leaves the browser.
A key normally works with every contract. Binding it to one means it
works only there, and some contracts insist on that: DashPay's contact
requests set requiresIdentityEncryptionBoundedKey and
requiresIdentityDecryptionBoundedKey, so the keys that
encrypt a contact request have to be bound to DashPay. A key that
cannot be used anywhere else also cannot be replayed anywhere else,
which is the reason to want it.
Most keys want no bound at all — a DashPay profile needs none, and neither does anything to do with tokens. If you are unsure, leave this closed: a bound key is useless for everything it is not bound to, and it can never be unbound.
The phrase above is what the new key is derived from, so generate or restore it first. The key id is the identity's own numbering — the next free slot — and the derivation path follows it, which means on an identity that does not use the standard layout the path and the role no longer line up. That is bookkeeping, not a problem: what counts on chain is the key id.