AlgoVanity generates custom Algorand addresses in-browser, keys never hit a server

The address that spells MONEY

MONEYMBRSMUAM2NGL6PCEQEDVHFWAQB6DU47NUS6P5DJM4OJFN7E7DSVBA¹² is a real Algorand account: funded the same day its tool's domain was registered, in May 2021, holding roughly 10.4 ALGO today, with its last on-chain activity in March 2025. It is also an address that spells MONEY, and that is not luck — the account on Allo¹ is the public example on algovanity.com³, a free browser-based generator that manufactures custom Algorand addresses on demand. You type a keyword, choose where it should appear, and the page runs a lottery until a matching address turns up — then hands you its recovery passphrase.

Why a vanity address is a lottery

An Algorand address is not chosen; it is derived. Every account starts as a randomly generated Ed25519 key pair, and the 58⁴-character address is a base32 encoding of a hash of the public key — the 32-symbol alphabet of uppercase A–Z plus digits 2–7⁵. That alphabet is why no properly formed Algorand address contains 0, 1, 8 or 9, a quirk community members noticed⁶ while toying with vanity generators. Because the address is a one-way commitment to the key, the only route to a keyword is brute force: generate a key pair, check the derived address, repeat. Each attempt costs a full key generation, so expected time grows exponentially with keyword length — roughly 32^length for a match at a fixed position — which is why the site recommends keywords under five characters and warns of waits ranging from seconds to several hours.

Forum records from the era quantify the grind: the PureStake Python utility managed around 10,000⁷ tries per second per core in 2021, typically landing a four-letter word in 10–20 seconds, while a five-letter search for SCHOL ran 15.7 million attempts over more than seven minutes before hitting (Generating Vanity Addresses⁸). AlgoVanity's answer is parallelism: it spawns one web worker per CPU core (falling back to three), each looping on the official Algorand SDK's generateAccount function, while a dashboard counts addresses generated, the search rate, matches found and elapsed time. The input restriction mirrors the alphabet itself — keywords may only contain uppercase letters and digits 2–7⁹, since nothing else could ever appear in an address anyway.

When a match lands, the tool highlights the keyword inside the address, offers copy buttons, and a 'Reveal key' option that displays the account's 25¹⁰-word recovery passphrase for import into a wallet such as Pera (recovery instructions¹¹). Each result links to the Allo block explorer. The three match methods set how long the search will run:

Source: 12 github.com

Built to stay out of the network path

AlgoVanity's core design choice is that key material never travels. Observing which hosts the running page actually talks to shows requests going only to the site's own host — no Algorand node, no indexer, no analytics. The FAQ states the claim directly: 'your address and passphrase are never transmitted over the network, and the address generation is performed locally using the official Algorand SDK.' The creator said the same at launch in the r/AlgorandOfficial announcement¹³: 'The site runs entirely client-side, you can run it offline if you prefer to be extra safe.' The architecture backs it up: the whole app is static files built with Svelte and served from AWS CloudFront, so there is no backend that could hold or forward keys, and the source code¹⁴ is MIT-licensed for anyone to inspect.

The security tradeoff, stated plainly

The FAQ's answer to 'Is this safe?' opens with 'Yes and no.' — and the no deserves equal weight. A recovery passphrase that has existed inside a webpage's memory is one that a compromised browser, a malicious extension, or a tampered copy of the tool could in principle have read. The site concedes as much: 'it's never entirely safe to use online tools for generating addresses or managing private keys.' The airtight check is to run the open-source code yourself — the README documents cloning the repository and starting a local dev server — rather than trusting that the bundle a CDN serves today matches the audited source.

For anyone who does generate in the browser, the recommended hardening is rekeying: an Algorand feature that lets an account delegate its signing authority to a different key without changing the address or moving its assets. Concretely, that means generating the vanity address, noting its passphrase, then immediately rekeying so a key you already control — ideally one held on a hardware wallet — becomes the only signer. From that point the passphrase that just existed in browser memory can no longer authorize transactions, so a leak is no longer a loss. The site links to Pera's walkthrough¹⁵, which frames the operation as 'changing the locks on your house. Same house, same address, new key.' The Algorand developer portal has taught the same vanity-then-rekey pattern since 2021 (tutorial¹⁶). The tradeoff Pera flags: some dApps do not fully support rekeyed accounts, so a small test transaction is prudent before committing larger amounts.

Five years old, still maintained, no longer alone

AlgoVanity is a survivor of the ecosystem's early tooling boom. The domain was registered on 2 May 2021 — the same day the first Wayback snapshot¹⁷ was captured — and the repository is still receiving commits, including a UI redesign in June 2026 and a July 2026 cleanup, with the footer dated 2026 and 17¹⁸ GitHub stars. It has circulated through the community: a January 2023 forum thread¹⁹ collecting interesting Algorand projects featured the tool and its repo, and a Bluesky discovery account²⁰ spotlighted it as an in-browser generator.

The vanity-address category itself has since moved toward dedicated hardware. The community's xGov grant program approved a GPU-accelerated generator proposal²¹ in its third voting period, requesting 47,474²² ALGO; its author, Marcin Zawiejski, maintains the actively developed rsagg²³, a Rust/OpenCL generator whose README carries its own candid warning — 'The utility hasn't been audited so please make sure to rekey any accounts for the addresses generated with it.' It is the same advice AlgoVanity has given since day one: the address is the vanity, the key is the security, and rekeying is the bridge between the two.