Securing your Arqma Wallet .keys file

What the .keys file is

When you create a wallet, Arqma Wallet writes a .keys file. It contains your spend and view keys, encrypted with the password you set. Combined with that password, the file can unlock and spend everything in the wallet — without ever touching the seed phrase.

That means the practical attack surface is: the file + the password. Protect both.

How attackers typically get it

• Malware on the device — reads the file off disk, captures the password from keystrokes.
• Unencrypted cloud sync — the wallets folder gets backed up to Dropbox/iCloud/OneDrive in plaintext.
• Shared/old computers — you reinstall the OS, sell the laptop, the file’s still on the disk.
• Weak passwords — the file alone, with a guessable password, is enough.

The password matters as much as the file

Storing the file safely

• Default location is fine if your device is encrypted (FileVault on macOS, BitLocker on Windows, LUKS on Linux). If it’s not, enable disk encryption first.
• Don’t put the raw .keys file on a cloud drive. If you must, encrypt it first into a container (VeraCrypt, age, or 7-Zip with AES-256 and a strong passphrase).
• For an offline backup, copy the .keys file to a USB stick, encrypted, kept somewhere physically secure.

Backing it up

A .keys backup is convenient because it skips the slow rescan. But it’s not the gold-standard backup — the seed phrase is. Use this hierarchy:

1. Seed phrase on paper, in two locations. (Required.)
2. Optional encrypted .keys backup on a USB. (Convenience.)
3. Never an unencrypted .keys file in cloud or email.

Disposing of an old device

• Securely wipe the disk (full-disk reset, not just “delete files”). On SSDs, use the manufacturer’s secure erase or full-disk encryption + reset.
• If selling a USB or external drive that held a wallet backup, destroy it physically. They’re cheap; your funds aren’t.

If the file leaks

1. Assume the password is also potentially exposed.
2. Create a brand-new wallet (new seed) on a clean device.
3. Send all funds from the compromised wallet to the new wallet’s address.
4. Stop using the compromised wallet entirely.