FAQ
This FAQ focuses on using the wallet. The Salmon website also answers broader questions about the project, integrations, and open development.
What is Salmon?
Salmon is an open-source, self-custodial wallet. Key generation and signing happen on the user's device; Salmon does not hold the recovery phrase or control the associated funds.
Where can I use Salmon today?
The official website currently links to the Chrome extension and Android application. iOS is not yet generally available. The standalone web wallet has been retired, and the website does not currently publish a Firefox store listing.
Use only the links on salmonwallet.io or the direct listings in the installation guide.
Which networks are supported?
The released wallet reads Solana and Bitcoin mainnet accounts. Developer mode can expose non-production Solana networks and Bitcoin testnet.
Feature support is not identical across chains. Solana sending is available; Bitcoin sending is not currently available end to end. See the feature availability table.
Can Salmon recover a lost wallet?
Salmon cannot recover a missing recovery phrase, retrieve a forgotten password remotely, or reverse a confirmed transaction. A recovery phrase can restore the wallet in a new installation; the password only unlocks the encrypted vault on the device where it was created.
If you still have an unlocked installation, back up the recovery phrase before removing the app, clearing browser data, or changing devices.
Why is my restored address different?
Wallets can derive many accounts from one phrase. An address can differ when another wallet uses a different derivation path or account index. Salmon scans for previously used derived accounts after restoration, but you should still compare the full expected address before moving funds.
Salmon's derivation paths are documented in Create or Restore.
What is a watch-only account?
A watch-only account stores a public Solana address without its signing key. It can show public balances and activity and can receive assets, but it cannot send, burn, sign messages, or approve dApp transactions.
Adding an address as watch-only does not import or recover control of that account.
Can I send Bitcoin?
Not in the current release. Salmon can display Bitcoin balances, activity, and UTXOs, and it can show a receive address. The present transaction path cannot complete every requirement for the wallet's P2PKH addresses, so Bitcoin sending must be treated as unavailable.
Can I swap or stake inside Salmon?
The swap engine and API exist in the codebase, but the swap entry points are not exposed in the current extension or mobile release. Native in-wallet staking is also not currently exposed. Do not rely on unreleased screens or deep links.
Does connecting a dApp expose my keys?
No. Connecting shares the selected public address. A dApp can then request signatures, but Salmon shows an approval screen and the private key remains in the wallet.
A malicious request can still cause loss if approved. Verify the full domain, network, account, recipient, amount, and expected effect before signing. A logo or familiar name is not proof of identity.
What happens when I sign a message?
A message signature proves control of the selected address and can create an authenticated session with a service. It should not move funds by itself, but it can authorize access or accept terms. Sign only when the displayed domain and message match an action you intended.
What data does analytics collect?
Analytics is opt-in. The client offers a choice during onboarding and a toggle in Settings. The backend accepts only allow-listed usage events and removes address-like values, mints, raw numbers, oversized strings, and unknown properties.
Analytics consent does not affect custody or access to the wallet.
Will support ask for my recovery phrase?
No. Salmon support never needs a recovery phrase, private key, password, or signed transaction. Do not send secrets by email, chat, support form, or direct message.
For product or integration enquiries, use the contact channel linked from the official website. Report security vulnerabilities privately through the relevant repository's SECURITY.md, without publishing secrets or exploit details.
Is every visible token or collectible safe?
No. Asset names, images, descriptions, and links can be attacker-controlled. Salmon filters likely spam by default, but no filter is perfect. Enabling unverified assets increases what is shown; it does not make those assets trustworthy.
Do not visit an asset's link or approve a transaction merely because it appeared in the wallet.