Safety in Chainmail

Last updated 28 October 2026. What the app does today to keep you safe, and what it can't do.

Your wallet is your identity

• No email, phone number or password. You sign in by connecting a wallet. The first time on each device, your wallet signs one free message (not a transaction) that links that device's messaging keys to you.
• We will never ask for your recovery phrase. Not in the app, not in a message, not on social media. Anyone who has it can take everything in your wallet. If you've shared it, move your funds to a new wallet straight away.
• We will never ask you to sign anything outside the app. Chainmail only asks for signatures inside the Chainmail app itself. A website, email or message asking you to "sign to verify" your Chainmail account is a scam.
• Our only official accounts are @chainmailxyz on X and @chainmailapp on Instagram. We won't DM you first asking you to sign, pay or share anything.

Strangers and message requests

• Strangers land in Requests. A chat from someone new doesn't appear among your chats. It waits behind a "message requests" row until you Accept or Block. They don't get read receipts until you accept.
• Links stay plain text. In a chat you haven't accepted, links can't be clicked and get no preview.
• No paying strangers' requests. A payment request from someone you haven't accepted can't be paid.
• Quiet by default. Requests don't notify you unless you turn that on in Settings. Even then, the notification only says someone new sent you a message, never what it says.
• Block all. One button blocks every request at once, after you confirm.
• "Possible spam" label. If a requester's wallet has never sent a transaction on Base or Ethereum and has no ENS name, Chainmail marks it "Possible spam" and never notifies you about it. Wallets you've paid or share a group with are never marked. This check runs from your device.

Phishing and scams

• Known phishing sites are blocked. Chainmail checks links against MetaMask's open phishing list on your device. Your links are never sent anywhere to be checked. A bad link is struck through, can't be clicked and gets a red warning, even in chats you've accepted.
• Lookalike sites. Fakes of big names (MetaMask, Coinbase, Uniswap, OpenSea and others), swapped letters from other alphabets, small typos, and links that hide their real address are caught the same way.
• Lookalike wallets. Scammers make addresses that start and end like one you know. Chainmail compares new addresses with the people you already chat with and pay, and shows a red "Possible scam" warning before you pay a lookalike.
• Scam wording. Messages like "send your recovery phrase", "verify your wallet", free airdrops, fake support or "sign this" get an amber warning above them.

Your devices

• New device alert. If a new device is added to your account, Chainmail shows a red banner. If it wasn't you, someone may have tricked you into signing for them.
• Devices list. Settings > Devices lists every browser that has your keys. Remove any you don't recognise, or one you've lost, so it can't read new messages.
• Remove this browser. On a shared or borrowed computer, this removes the browser from your account and wipes your chats, keys, contacts and settings from it.

Payments

• On Base. Payments in ETH or USDC go on the Base network. Right now they use Base Sepolia, a test network with free test money, and cards say "Test network".
• You confirm in your own wallet. Chainmail never holds your money or your keys. Your wallet shows the exact amount and fee before you approve.
• "Confirmed" means confirmed on chain. A payment card only says Confirmed (or Paid, for a request) once the payment is found on the blockchain. A fake card in a message can't fake that.
• Check the address. The first time you pay any wallet, Chainmail shows its full address for you to check. Blockchain payments can't be reversed by anyone, including us.

Deleting messages

You can delete a message, or clear a whole chat, for yourself. This only changes this browser. Everyone else in the chat keeps their copy, and so do your other devices.

You can also delete your own messages for everyone. Chainmail and most XMTP apps then show "Message deleted" instead. In a one to one chat, Clear chat for both deletes all your messages for both of you. Copies someone already saved or screenshotted can't be removed.

What we can't protect you from

• Chat history on your device isn't encrypted on disk. Messages are encrypted in transit, but once they reach your browser they're stored without a lock. Anyone who can use your computer can read them. Use Chainmail on a device you trust, and use Remove this browser on shared ones.
• Link previews pass through our server. When a preview loads, our server fetches the page so the site never sees your IP address. That means the link passes through our server and our host's request logs. You can turn previews off in Settings.
• People can screenshot. Anyone in a chat can copy or screenshot what you send, including disappearing messages.
• Some things are public. XMTP network nodes can see which addresses talk to each other and when, though not what is said. Payments are public on the blockchain, like any transaction. Read more on our privacy page.

If something looks wrong

• Stop. Don't pay, sign, approve or click anything a stranger asked for. Real people can wait.
• Block the chat. In Requests, you can block every request at once.
• Check your devices in Settings > Devices and remove anything you don't recognise.
• If you shared your recovery phrase or signed something you didn't understand, move your funds to a new wallet straight away and revoke any token approvals you didn't mean to give.
• Report fake accounts pretending to be us with X's or Instagram's own report tools, and tell us by messaging @chainmailxyz.

Quick answers