Everything the board does happens in your browser, and every step can be checked.
Every bitcoin sits at an address, and every address is unlocked by a secret number called a private key. Pick any whole number from 1 up to about 1.16 × 1077 and you have a valid key. Whoever knows the number can spend what its addresses hold. There is no password reset and no bank to call.
Go ahead, that is what this site does. There are 2256 numbers to pick from, and each key becomes an address through two one-way hashes, leaving 2160 possible addresses. The richest million are a speck in that space. Guessing is allowed. It never works, and that is the whole of Bitcoin's security.
Your browser runs one worker for each processor core (several on this device). Each worker
draws a 256-bit number from crypto.getRandomValues, discards the vanishingly rare draw that is not a
valid key, and computes its public key on the secp256k1 curve. Every key becomes four addresses: legacy compressed
(1...), legacy uncompressed (1...), native SegWit (bc1q...) and wrapped SegWit (3...). Each one is compared with the
funded addresses of its own kind, from a list of every funded address taken on 14 October 2026.
The 1,000,000 richest of the first three kinds are checked: 84.69% of all bitcoin, down to 0.94 BTC. Taproot, script and non-standard outputs cannot be reached from a single key cheaply, so they are not.
| Kind | Addresses checked | Not checked | BTC checked | BTC not checked |
|---|
Your keys never do. The site may talk to three places, and its security policy blocks everything else. blockstream.info receives an address, never a key, when you press Check or when a possible match needs confirming. This site's counter receives one number every 15 seconds: how many keys your browser has tried. And the site's page-view counter records which page was opened, the site it came from and the kind of device, with no identifier, no address and no key.
The address list is squeezed into a 4.3 MB filter that very occasionally says maybe when the answer is no, about once in 4.5 billion lookups. Every maybe is checked live with blockstream.info before the site says anything. False alarms ruled out this session: 0. A real match would show its address and balance on whichever page you are reading. It would not show the key, and there is no button to move coins. There never will be.
Once you press Start, the guessing carries on as you move around the site; the count in the header shows it is still running. Close the tab and it stops. Nothing runs in the background after that.