EN
Start free
Trust, with clear boundaries

Your keys.
Clear boundaries.

Know what you are signing, what is checked, and where trust still matters.

Silent Receive is in limited experimental testing. Review the risks before binding a code or accepting payments.

What we will never do

  • We never ask for a seed phrase or private key.
  • We never custody funds.
  • We never ask you to sign a transaction for Silent Receive.
  • We never load third-party scripts, analytics, or CDN code on app pages.

Signed publishing authorization

Publishing asks you to sign a message proving you control the name. It cannot move funds. On the main-domain /create and /publish/* pages, UniSat access is limited to:

  • requestAccounts
  • getAccounts
  • getNetwork
  • getPublicKey
  • signMessage(message, "bip322-simple")
  • sendBitcoin

Payment uses sendBitcoin only for the UniSat order the server has just re-verified, only to its pay address, for its exact amount, capped at 0.01 BTC, and you approve it in UniSat. btc.glass never builds or signs a transaction itself. You can also pay by scanning the QR code from any wallet.

The server binds your public key to your address, freshly checks SAT20 and two ord mirrors, and verifies your BIP-322 signature over the name, holder, exact HTML hash, job ID and UTC issue time. Authorization is accepted once per job within ten minutes of issue; quotes and both orders require it. Your address, public key, message and signature are stored with the job. Supported signatures are key-path Taproot, P2WPKH and P2SH-P2WPKH; legacy P2PKH message signatures are refused. You can also publish by hand: Download HTML needs no wallet, and the docs explain inscribing it yourself on UniSat.

Silent Receive keeps its separate message-signing boundary at /bind. Wildcard name sites are independent, untrusted content. Never sign a publishing authorization on a wildcard site.

What you sign

btc.glass Silent Receive v0
warning: only sign this on https://btc.glass/bind
purpose: bind
domain: btc.glass
network: bitcoin-mainnet
name: alice.btc
sp1: sp1q...
owner: bc1p...
nonce: 0123456789ABCDEFGHJKLM
issued: 2026-10-02T00:00:00Z
expires: 2026-12-31T00:00:00Z
This signature only publishes a receiving code. It cannot move any funds.

Independent verification

  1. Open the verifier or save it offline.
  2. Paste the record JSON from /api/record/alice.btc.
  3. Check that the BIP-322 signature, sp1, expiry, and current holder all pass.
  4. Compare SAT20 and UniSat ownership and name-inscription content.

Threat model

Name websites under *.btc.glass are inscriptions and may be controlled by anyone. Site roots are not sandboxed; each name has a separate origin. Direct /content opens are sandboxed. Name sites do not share official UI with https://btc.glass/bind. A phishing subdomain can still imitate a binding page, so only sign on the exact main-domain URL and re-check your own receive page within 72 hours after binding.

If a browser cannot directly reach SAT20 and UniSat, holder checks rely on the btc.glass server. The page marks which holder-check mode was used. A compromised server cannot forge a holder's signature, but can replay old signed records. Independent signature and holder checks do not prove the latest binding or revocation state.

Visible receive pages recheck every 60 seconds, on return from the background, on window focus, and before copying. Codes are hidden while checking, when checks fail, at signed expiry, or when the binding changes (reload to review a changed binding). Each check times out after 15 seconds. With the server's maximum 120-second holder cache, under normal indexer operation the old code should disappear within about 3 minutes of the transfer confirming and being indexed. This is not a guarantee against a compromised server or delayed indexers. Saved codes and screenshots cannot be recalled.

Phishing subdomains cannot be fully eliminated by technical controls. The remaining defenses are main-domain signing prompts, manual receive-code comparison, and the 72-hour new-binding marker.

Today the app remains on the same registrable domain as wildcard content. The current controls isolate origins and UI, but an independent app domain would further reduce phishing confusion before a broader launch.

Contact

Security contact: security@btc.glass