Open-source Arqma Wallet — the code

What “open source” actually means here

Arqma Wallet’s source code is published in a public GitHub repository under a free-software license. Anyone can:

• Read every line of code.
• Build the wallet themselves from source.
• Audit, fork, modify, or republish.
• Submit fixes or report issues in the open.

Why this matters for safety

Closed-source wallets ask you to trust their authors. Open source replaces that ask with verifiability:

• If the code did something shady — harvested your seed, called home with your transactions — any one of thousands of viewers could spot and report it.
• Builds are reproducible: the binary you download from the official download page can be matched byte-for-byte against a build made from the public source. That means we can’t silently ship a backdoored binary that doesn’t exist in the public code.
• If we disappeared tomorrow, the code wouldn’t. Someone else could keep it alive.

What you can verify yourself

1. The release on the download page has a SHA-256 checksum. Compute the checksum of the file you downloaded and compare. Mismatched? Don’t install — you have a tampered file.
2. If you want to go further, install a build toolchain, clone the public repo at the release tag, build, and confirm the resulting binary matches.
3. Read the diff between releases on GitHub. Every change is in the commit history.

Who actually audits Arqma Wallet?

• The project maintainers, on every change.
• Independent contributors in the community.
• Anyone with the cryptography or security chops who feels like it.
• Researchers studying the underlying Monero codebase Arqma forked from.

For more on audits and disclosure see security and audits.

The honest part

Open source isn’t a guarantee of safety — it’s a precondition for it. A closed-source wallet cannot be independently verified. An open-source wallet can be. Whether anyone actually does the verification is on the community. We make it as easy as possible.