AlgoVanity generates custom Algorand addresses in-browser, keys never hit a server

2026-08-18

vanity-address · tools · open-source · security · wallets · discovery · web · updated

The address that spells MONEY

MONEYMBRSMUAM2NGL6PCEQEDVHFWAQB6DU47NUS6P5DJM4OJFN7E7DSVBA is a real Algorand account: funded the same day its tool's domain was registered, in May 2021, holding roughly 10.4 ALGO today, with its last on-chain activity in March 2025. It is also an address that spells MONEY, and that is not luck — the account on Allo is the public example on algovanity.com, a free browser-based generator that manufactures custom Algorand addresses on demand. You type a keyword, choose where it should appear, and the page runs a lottery until a matching address turns up — then hands you its recovery passphrase.

Why a vanity address is a lottery

An Algorand address is not chosen; it is derived. Every account starts as a randomly generated Ed25519 key pair, and the 58-character address is a base32 encoding of a hash of the public key — the 32-symbol alphabet of uppercase A–Z plus digits 2–7. That alphabet is why no properly formed Algorand address contains 0, 1, 8 or 9, a quirk community members noticed while toying with vanity generators. Because the address is a one-way commitment to the key, the only route to a keyword is brute force: generate a key pair, check the derived address, repeat. Each attempt costs a full key generation, so expected time grows exponentially with keyword length — roughly 32^length for a match at a fixed position — which is why the site recommends keywords under five characters and warns of waits ranging from seconds to several hours.

Forum records from the era quantify the grind: the PureStake Python utility managed around 10,000 tries per second per core in 2021, typically landing a four-letter word in 10–20 seconds, while a five-letter search for SCHOL ran 15.7 million attempts over more than seven minutes before hitting (Generating Vanity Addresses). AlgoVanity's answer is parallelism: it spawns one web worker per CPU core (falling back to three), each looping on the official Algorand SDK's generateAccount function, while a dashboard counts addresses generated, the search rate, matches found and elapsed time. The input restriction mirrors the alphabet itself — keywords may only contain uppercase letters and digits 2–7, since nothing else could ever appear in an address anyway.

When a match lands, the tool highlights the keyword inside the address, offers copy buttons, and a 'Reveal key' option that displays the account's 25-word recovery passphrase for import into a wallet such as Pera (recovery instructions). Each result links to the Allo block explorer. The three match methods set how long the search will run:

Match method	What it checks	Real-world implication
Starts	The keyword must open the address	Best for a handle that reads naturally, at the steepest price: only the first of the 58 character positions qualifies, so the wait is the longest of the three (see the odds above)
Anywhere	The keyword may sit in any position	The default and fastest mode; right when the word merely needs to appear somewhere in the string
Ends	The keyword must close the address	As rare as Starts; suits a memorable suffix that reads like a tag after the random middle section

Built to stay out of the network path

AlgoVanity's core design choice is that key material never travels. Observing which hosts the running page actually talks to shows requests going only to the site's own host — no Algorand node, no indexer, no analytics. The FAQ states the claim directly: 'your address and passphrase are never transmitted over the network, and the address generation is performed locally using the official Algorand SDK.' The creator said the same at launch in the r/AlgorandOfficial announcement: 'The site runs entirely client-side, you can run it offline if you prefer to be extra safe.' The architecture backs it up: the whole app is static files built with Svelte and served from AWS CloudFront, so there is no backend that could hold or forward keys, and the source code is MIT-licensed for anyone to inspect.

The security tradeoff, stated plainly

The FAQ's answer to 'Is this safe?' opens with 'Yes and no.' — and the no deserves equal weight. A recovery passphrase that has existed inside a webpage's memory is one that a compromised browser, a malicious extension, or a tampered copy of the tool could in principle have read. The site concedes as much: 'it's never entirely safe to use online tools for generating addresses or managing private keys.' The airtight check is to run the open-source code yourself — the README documents cloning the repository and starting a local dev server — rather than trusting that the bundle a CDN serves today matches the audited source.

For anyone who does generate in the browser, the recommended hardening is rekeying: an Algorand feature that lets an account delegate its signing authority to a different key without changing the address or moving its assets. Concretely, that means generating the vanity address, noting its passphrase, then immediately rekeying so a key you already control — ideally one held on a hardware wallet — becomes the only signer. From that point the passphrase that just existed in browser memory can no longer authorize transactions, so a leak is no longer a loss. The site links to Pera's walkthrough, which frames the operation as 'changing the locks on your house. Same house, same address, new key.' The Algorand developer portal has taught the same vanity-then-rekey pattern since 2021 (tutorial). The tradeoff Pera flags: some dApps do not fully support rekeyed accounts, so a small test transaction is prudent before committing larger amounts.

Five years old, still maintained, no longer alone

AlgoVanity is a survivor of the ecosystem's early tooling boom. The domain was registered on 2 May 2021 — the same day the first Wayback snapshot was captured — and the repository is still receiving commits, including a UI redesign in June 2026 and a July 2026 cleanup, with the footer dated 2026 and 17 GitHub stars. It has circulated through the community: a January 2023 forum thread collecting interesting Algorand projects featured the tool and its repo, and a Bluesky discovery account spotlighted it as an in-browser generator.

The vanity-address category itself has since moved toward dedicated hardware. The community's xGov grant program approved a GPU-accelerated generator proposal in its third voting period, requesting 47,474 ALGO; its author, Marcin Zawiejski, maintains the actively developed rsagg, a Rust/OpenCL generator whose README carries its own candid warning — 'The utility hasn't been audited so please make sure to rekey any accounts for the addresses generated with it.' It is the same advice AlgoVanity has given since day one: the address is the vanity, the key is the security, and rekeying is the bridge between the two.

Source

Source: https://algovanity.com/