A Monero user faces a practical security problem: they want to check their balance and monitor incoming transactions on a shared computer, at work, or on a public network, but they cannot accept the risk of exposing their private spend key. Creating a separate, read-only login would require sacrificing the ability to send funds from that device—an acceptable trade-off if the mechanism is genuine and the boundaries are clear. XMRWallet addresses this requirement through view-key-only access, a configuration that separates the cryptographic function that displays account activity from the function that authorizes spending.
The distinction matters because Monero’s privacy model depends on two separate keys: the private view key, which allows scanning the blockchain to identify incoming transactions and calculate balances, and the private spend key, which authorizes fund transfers. These keys are mathematically independent. A user who possesses only the view key can see everything about their wallet—every input, output, and historical transaction—without being able to move a single unit of funds. This creates a legitimate use case for monitoring access that remains genuinely non-custodial and does not expose spending authority to a device or network that may be compromised or untrusted.
How Monero’s dual-key system enables read-only access
Monero differs fundamentally from Bitcoin and Ethereum in its handling of account cryptography. Rather than storing all account information under a single private key, Monero uses a dual-key model where the view key and the spend key govern different operations. The private view key allows a user to decrypt their transaction data from the blockchain and identify funds belonging to their account. The private spend key, combined with transaction data, is what actually signs outgoing transactions and authorizes transfers.
This separation is not optional or theoretical; it is embedded in Monero’s protocol. When a transaction is sent to a Monero wallet, the sender uses the recipient’s public view key (derived from the private view key) to create an encrypted output that only the recipient can view. The recipient can scan the blockchain with their private view key, find encrypted outputs associated with their account, and decrypt them to see their balance. However, decrypting the transaction data does not grant the ability to spend those funds. That authority comes exclusively from the private spend key, which is never involved in the scanning process.
From a practical perspective, this means that a user can extract their private view key from their full wallet and use it alone to monitor activity without exposing the spend key. The view key is substantially less sensitive than the spend key, though it is not worthless—an attacker with the view key can observe all transactions and infer the wallet’s total balance, transaction patterns, and timing. For monitoring on a shared or public device, this represents an acceptable security reduction because the account cannot be emptied if the device is compromised. The funds remain secure as long as the private spend key, which authorizes actual transfers, is never entered into the monitoring device.
Creating and using a view-key-only login on XMRWallet
XMRWallet’s approach to view-key-only access begins with the user’s seed or existing wallet. When a user creates a new wallet through the official XMRWallet, they receive a 25-word recovery seed (mnemonic phrase) and are shown their public address, view key, and spend key. To set up read-only monitoring, the user manually extracts the private view key and their Monero address from their full wallet. They should never share or export the spend key.
The login process on a second device for monitoring then uses only the view key and address rather than the full seed or spend key. XMRWallet reconstructs the necessary cryptographic material locally: the view key, combined with the wallet’s public address, allows the application to scan the blockchain and calculate balances without any involvement of the spend key. After authentication through the encrypted wallet file or seed restoration, the application synchronizes with the Monero network, queries the blockchain for outputs associated with the provided address, and displays the resulting transactions and balance.
Importantly, this login does not require a traditional account or password that could be reset or recovered through a centralized service. Instead, authentication is cryptographic: the view key and address must be correct for the application to produce valid results. If either is wrong or corrupted, the scan will reveal no funds, and no login will have occurred. The user remains the sole custodian of their keys, and the verification happens silently during the blockchain synchronization process.
A user monitoring their wallet on a work computer or public network using view-key-only access can check their balance, review transaction history, and confirm that expected payments have arrived. They cannot initiate sends, change addresses, or modify settings that affect the spend function. Any attempt to create a transaction would fail or be impossible because the application has no access to the spend key. This boundary is absolute and is enforced by the protocol itself, not merely by the application’s interface.
The security distinction between monitoring and spending access
The purpose of read-only wallet access is to reduce the surface area of compromise. A compromised device, network sniffer, or malicious application on a shared computer can observe what a view-key-only wallet reveals: the account balance, transaction history, and public address. This information is already on the public Monero blockchain and can be inferred by anyone with the public address. An attacker cannot use a compromised view key to create outgoing transactions or move funds.
The threat model shifts significantly, however, if the private spend key is ever entered on the same device or network. A compromised work computer with the spend key imported, even temporarily, allows an attacker to drain the entire wallet. This is why users should reserve the spend key for the highest-security device they control—typically a personal computer that is not shared, encrypted with a strong password or passphrase, protected by a firewall, and kept offline unless actively using the wallet.
Another important consideration is that view-key-only access does not hide the fact that the wallet is being monitored. A network observer (such as an internet service provider, employer, or hostile network) can see that the user is querying the Monero blockchain and can identify the associated public address by timing or other metadata. Tor or I2P proxy connections reduce this exposure by hiding the user’s IP address, but they do not eliminate the fact that blockchain scanning is occurring. For many users in secure contexts (such as checking a balance from home), this is not a serious concern. For users in hostile or monitored networks, even monitoring activity may need to be isolated.
A view key is also asymmetric in value. Because it reveals the account’s transaction history and balance, it should not be shared, pasted into online forums, or stored in cloud services. The security of view-key-only access depends on keeping the view key treated with the same care as the recovery seed, though with a reduced risk if exposure occurs. A leaked view key is a privacy loss and may enable account monitoring by an adversary, but it does not result in fund theft.
Practical scenarios for read-only wallet monitoring
A software developer works from a shared office and wants to verify that a client payment in Monero has arrived without exposing the ability to transfer funds from that network. They extract their view key at home on their primary computer, store it securely, and later log into XMRWallet on their work laptop using view-key-only mode. They check the balance, see the incoming transaction, and close the session without ever storing the spend key or recovery seed on the work device. If the laptop is later compromised or stolen, the attacker can see the transaction history but cannot access the funds.
A vendor receives multiple Monero payments throughout the day and wants to monitor the account from a point-of-sale terminal or a shared register computer. Using view-key-only access, they can confirm that a customer’s payment has been received and reached the required number of confirmations, all without introducing the private spend keys into the retail environment. The funds remain in cold storage or a high-security device, and the point-of-sale system is restricted to read-only balance confirmation.
A user in a jurisdiction where cryptocurrency activity is sensitive may want to check their balance while traveling or from a friend’s computer. View-key-only access allows this without exposing the spend key to an unfamiliar device or network. The trade-off is privacy: the friend or a network observer could infer the user’s Monero balance and transaction history. But the funds cannot be taken, and the view key can be changed by creating a new full wallet and transferring the balance to a new address (a process that requires the spend key and can only be done on a trusted device).
Limitations and boundary conditions of view-key-only access
View-key-only access is not a substitute for a spending wallet, and its limitations should be understood clearly. The wallet cannot receive transactions initiated from the monitoring session because there is no spend authority and therefore no ability to perform any action that would require cryptographic signing. Some Monero wallets support subaddress generation (creating multiple addresses under the same account), but a view-key-only wallet typically cannot generate new subaddresses without access to the private spend key.
Synchronization speed and node connectivity are also relevant. XMRWallet queries the Monero blockchain through local or remote nodes to scan for transactions. If the node is unavailable, unavailable, slow, or compromised, the wallet may not display current balances, and an attacker with control of the node could potentially monitor or delay the user’s queries. Using a trusted node (such as a user’s own Monero node run on a home server) mitigates this risk, but many users may rely on public nodes, which introduces a network trust boundary. The blockchain data itself is public, so a compromised node cannot cause a view-key-only wallet to display false balances—only delayed or suppressed information.
Privacy-wise, view-key-only access reveals that a specific Monero address is being monitored. Repeated queries from the same IP address or device may allow pattern analysis, even if the blockchain data itself is encrypted. Using a stable network connection from home is safer than monitoring from random public WiFi or work networks. Similarly, the frequency of monitoring activity may itself be observable. A user checking their balance every few minutes might reveal more about their payment expectations than occasional batch checking.
Setting up view-key-only access: practical steps
The process begins with a full wallet that contains both the view key and spend key. On the primary device (which should be secure and trusted), the user opens XMRWallet or their current Monero wallet and locates the private view key and the public address. This information is usually displayed in the wallet settings or wallet details section. The user should note or copy only the private view key and the address—never the spend key or the full seed.
On the secondary device where monitoring will occur (such as a work computer or shared device), the user opens XMRWallet and selects the option to log in. Rather than entering the full seed or a new wallet, they select the view-key-only mode if the interface offers it explicitly. They then enter the private view key and the corresponding Monero address. XMRWallet will reconstruct the necessary cryptographic data and begin scanning the blockchain.
Testing is important. The user should verify that the balance displayed on the view-key-only session matches what they see on their primary wallet (after accounting for any new transactions that may have arrived in between). They should also confirm that no send function is available—attempting to click a send button should either show an error or offer no functionality at all. Only after this verification should the view-key-only session be considered safe for regular monitoring.
If the primary wallet is ever compromised or the user suspects unauthorized access, the view key should be treated as exposed. While it does not directly risk the funds, a compromised view key allows ongoing surveillance of the account. The appropriate response is to create a new wallet (using a new seed) and transfer the balance to that new wallet using the spend key on a trusted device. This invalidates the old view key and forces any attacker to rebuild monitoring access. The original wallet can then be retired or the old view key discarded.
Comparing view-key-only access to other non-custodial monitoring tools
Other Monero wallets and tools offer similar capabilities. Monero CLI and GUI wallets both support viewing-only accounts created from a view key. The difference with XMRWallet is that it is browser-based, web-accessed, and does not require downloading or maintaining wallet software. This makes view-key-only monitoring more accessible to users on shared or temporary devices, though it introduces a separate set of considerations around the security of the web application itself and the device’s browser security.
Block explorers and chain analysis services also allow users to view transactions associated with a Monero address, but they do not require the view key and do not offer privacy relative to the observer of the search. Using a block explorer to check a balance does not prevent the explorer operator from seeing which address was queried and when. A view-key-only wallet keeps the monitoring relationship private from the device or network used, as long as Tor or a proxy is not employed.
Hardware wallets with viewing-only companion apps (such as Ledger with Monero support) separate the hardware device, which holds the spend key, from a companion application that displays balances. This is a similar model to XMRWallet’s view-key-only mode, with the additional security of hardware-backed key storage. The trade-off is convenience: hardware wallets are more secure but less portable and slower to check from multiple devices.
Future development and user responsibility
As Monero wallets and tools evolve, view-key-only access remains a fundamental feature rather than an advanced edge case. Improving the user experience around this workflow—clearer labeling, explicit warnings when a device has only viewing access, and seamless transitions between monitoring and spending wallets—can encourage adoption without introducing new security risks.
The responsibility for security remains entirely with the user. XMRWallet provides the mechanism, but the user must decide whether to use it, where to use it, and how to protect the view key. There is no password recovery, no account recovery, and no customer support team that can restore lost keys or override compromised access. The irreversibility of key management is the cost and the guarantee of non-custodial cryptocurrency: no one can take the funds away, but no one can save them if the keys are lost or mismanaged.
Frequently asked questions
Can someone with only my view key steal my Monero?
No. The view key allows scanning the blockchain and calculating balances, but it does not authorize transactions. Only the private spend key can sign transfers and move funds. An attacker with the view key can observe your transaction history and balance, which is a privacy loss, but cannot drain your account. Keep your spend key secure; the view key can be monitored from less trusted devices.
What if I lose or forget my view key?
You can always regenerate your view key from your recovery seed (mnemonic phrase) on a trusted device. The view key is derived from your seed, so as long as you have the seed, you can re-extract it. Store your seed securely offline, and treat it with the same care as your spend key. There is no password recovery or backup mechanism; key management is your sole responsibility.
Can I use view-key-only mode to receive transactions?
You cannot initiate receiving transactions from a view-key-only session, but you can display your public address and provide it to others. Others can send Monero to your address regardless of which device or mode you use to monitor it. The public address is not sensitive. The view-key-only wallet will detect and display incoming transactions, but you must use a full wallet with the spend key to spend those funds.