Understand Phantom KMS
Phantom's Key Management System (KMS) stores wallet keys in secure enclaves instead of on your device. A secure enclave is a protected environment where keys can be used to sign transactions.
KMS powers features such as your Cash account and Phantom Terminal trading account. New wallets created with Google or Apple also use KMS.
What is KMS? #
KMS generates, stores, and uses wallet keys inside secure enclaves. When you make a transaction, your Phantom app or browser extension requests a signature from KMS.
Phantom can manage accounts in two ways:
- KMS account: Wallet keys are stored in a secure enclave. Phantom keeps a reference to the account so you can access it.
- Local account: Wallet keys are stored on your device, where Phantom uses them to sign transactions.
Back up your recovery phrase #
For your Google or Apple wallet, you can view and export your Secret Recovery Phrase to keep an offline backup. Go to Settings > Security & Privacy > Show Recovery Phrase.
Recovery-phrase export and private-key export are different options:
- Recovery phrase: Restores the accounts derived from that phrase. Use this to back up your Google or Apple wallet.
- Private key: Gives access to one address on a specific network. The Show Private Key option is currently not available for KMS accounts in Phantom.
A missing Show Private Key option does not mean your recovery phrase is unavailable. Follow View your recovery phrase or private keys in Phantom for backup instructions.
If you imported additional recovery phrases or private keys, back up each one separately. Your main wallet's recovery phrase does not restore accounts imported with separate credentials.
Warning: Never share your Secret Recovery Phrase or private key with anyone. Anyone with access to either has full control of your wallet. Phantom Support will never ask for your recovery phrase or private key.
How signing works #
With a local account, Phantom signs transactions on your device. With a KMS account, signing happens inside a secure enclave:
- Your app or browser extension sends a signing request to KMS.
- KMS verifies the request and checks the account's permissions and policies.
- If the request is allowed, the signer enclave creates a signature.
- KMS returns the signature to Phantom, which submits the signed transaction to the network.
Routine signing does not require Phantom to send the wallet's private keys to your device. Exporting a recovery phrase is a separate action you take to back up your wallet.
The authenticator #
An authenticator lets your device prove that it is authorized to request signatures from KMS. It is separate from the wallet keys that control your blockchain addresses.
Your device signs its requests using the authenticator. KMS verifies those requests before allowing the wallet keys to sign a transaction.
How KMS accounts sync between devices #
Phantom keeps a reference to your KMS-managed accounts. When you sign in on another device, Phantom can discover those accounts and use an authenticator on that device to request signatures.
If you previously connected a third-party app to a KMS account, Phantom can recognize that account when you sign in on another device.
Phantom can discover an existing KMS account and add it to your account list. When you create a new KMS account, Phantom saves a reference so it can appear on your other devices.
Your Phantom wallet can contain several account types, including KMS accounts, local recovery-phrase accounts, separately imported private-key accounts, and connected hardware wallets.