Private value.
Public settlement.
Confidential balances and transfers on Solana. Send value without broadcasting the amount.
A 64-byte ElGamal ciphertext, which is how a confidential balance is stored on chain.
The same balance, encrypted four times. No two share a byte.
Five steps. You see one.
CIPHER runs the sequence and reports it in plain language. The technical detail is always one click away, never required.
This is several dependent transactions, not one — and CIPHER says so before you sign rather than implying it is atomic.
- 01
Encrypt the amount
Your deviceThe amount is split into two halves and encrypted to you, the recipient, and the mint’s auditor if one is configured.
- 02
Prove it without revealing it
Your deviceThree proofs: that your new balance is consistent, that the ciphertexts are well formed, and that nothing went negative or overflowed.
- 03
Verify onchain
SolanaEach proof is verified by a native Solana program into its own temporary account. Validators check the maths without learning the amount.
- 04
Settle
SolanaToken-2022 reads the verified proofs and moves the encrypted balance. The transfer is public; the amount is not.
- 05
Reclaim rent
SolanaThe temporary proof accounts are closed and their rent returns to you. If this step is interrupted, CIPHER finds them onchain later.
Shield
Move public tokens into an encrypted confidential balance.
Send
Generate proofs locally and send an encrypted amount.
Unshield
Move funds back to the public balance whenever you choose.
Encryption
Twisted ElGamal
Balances and amounts held on chain as ciphertext
Proofs
Bulletproofs + sigma
Equality, ciphertext validity and range, generated on your device
Verification
Native Solana program
ZK ElGamal Proof — no custom contract in the middle
Token standard
Token-2022
Confidential Balances extension, built into Solana
CIPHER implements no cryptography of its own. It is an interface to primitives that already exist in Solana, which is why a balance created here can be read by any other compliant client — the CLI, the Rust SDK, another wallet.
The amount is encrypted. The accounts are not.
Most products are vague about this line. Here it is exactly.
- Balances
- Transfer amounts
- Accounts
- Network participation
Confidential Balances encrypt amounts and balances. They do not anonymise participants: the accounts involved in a transfer, the mint, and the fact that a transfer occurred all remain visible on chain. CIPHER describes this accurately rather than claiming anonymity it does not provide. Read the technology.
The ones worth asking.
Including the ones with answers we'd rather not give.
- What is actually private?
- Your confidential balance and the amounts you transfer confidentially. What stays public: your wallet address, the token accounts involved, the mint, and the fact that a transfer happened. Shield and unshield amounts are also public, because value crossing between a public and a private balance is readable by construction.
- Can CIPHER see my balance?
- No. Your decryption keys are derived in your browser from a single wallet signature and held in memory only. They are never written to storage, never transmitted, and cleared when you lock, disconnect or close the tab. There is no CIPHER backend holding anything.
- Does this hide who I am?
- No, and nothing that says otherwise is telling you the truth about this technology. Confidential Balances provide amount and balance confidentiality, not anonymity. An observer can still see which accounts transacted and when. If you need to hide who is transacting rather than how much, this is the wrong tool.
- What if I clear my browser or switch devices?
- Nothing is lost. The keys are derived deterministically from your wallet, so the same wallet always recovers the same keys — connect, unlock, and your balance is there. There is no seed phrase to back up and no export step.
- Is CIPHER custodial?
- No. CIPHER never holds your funds and never asks for a seed phrase. It builds transactions with Solana's own libraries; your wallet signs them. There is no custom program in the middle and no bridge.
- Which tokens work?
- Any Token-2022 mint with the confidential transfer extension. CIPHER reads each mint's capabilities from chain rather than a list, discovers the Token-2022 assets your wallet already holds, and lets you add any mint by address. Assets that do not support confidential balances are shown as unsupported instead of hidden.
- What does it cost?
- Network fees, plus temporary rent for the accounts a proof is verified into. That rent is returned when the operation finishes. If an operation is interrupted before it can reclaim it, CIPHER finds those accounts on chain and offers to close them.
- Can anyone decrypt my transfers?
- Only if the mint's issuer configured an auditor key, which some regulated tokens do. On such a mint every transfer amount is additionally encrypted to that auditor. CIPHER detects this from the mint, labels the asset differently, and says so before you confirm a transfer — an audited mint is never presented like an unaudited one. An auditor cannot move your funds or read your balance.
- Has it been audited?
- No third-party security audit has been performed. What reduces the risk is that CIPHER implements no cryptography of its own: proof generation, encryption and instruction sequencing all come from Solana's official libraries, and proofs are verified by a native Solana program. The code is open — read it before you move anything you would miss.