Your USB.
Your offline vault.

Check what you need

Your USB. Your vault. Your approval.

1. Have a compatible USB and a Windows PC able to boot an x86-64 Linux image. Support varies by drive, computer and firmware; this image is not a universal Mac or ARM installer.
2. Make sure you can save your work and restart this PC. Booting and signing take a separate offline session.
3. Choose a unique vault passphrase and a separate safe location for an encrypted backup. Do not use a password from a chat.
4. If this USB already holds a vault, follow the upgrade path below. Do not flash it before verifying a separate encrypted backup.

Download and verify

A real bootable image. Everything needed for offline signing is bundled.

1. Download the bootable ISO below from any PC. The public file download needs no Vercel account or running local server.
2. This is experimental v5 r5 with the character logo, Solana shortcuts and menu 9 for UTC clock checks/correction. The image was tested in a disconnected VM; physical USB and mainnet acceptance remain separate. Updating the website does not update an already flashed USB.
3. Open PowerShell in the folder containing your download. Copy and run the checksum command below.
4. Compare all 64 hexadecimal characters with the published SHA256. A match confirms the downloaded bytes match this release; it does not establish a security audit or trusted firmware.

Get-FileHash -LiteralPath '.\drivekey-offline-amd64-v5-experimental-r5.iso' -Algorithm SHA256

Prepare the USB

Use Rufus to write the image—not a normal file copy.

Flashing erases the selected USB. Never overwrite the only copy of a vault. For upgrades, prefer another empty USB and verify a separate encrypted backup first.

1. Connect the intended empty USB. In Rufus, identify its device name and capacity; disconnect unrelated removable drives if that helps avoid mistakes.
2. Choose SELECT and select the verified DriveKey ISO.
3. Recheck the exact target before START. When Rufus offers ISO or DD mode, choose DD image mode.
4. Read every erasure confirmation. Proceed only when you recognize the intended empty target and accept erasing it.
5. Wait for completion. If Windows asks to initialize or format an unfamiliar partition afterward, cancel. Do not format the Linux boot partition.

Rufus official website ↗

Boot DriveKey offline

A separate Linux session, started from your USB.

1. Save your Windows work and disconnect Ethernet and Wi-Fi. Leave the USB connected and shut down.
2. Power on and open your PC’s one-time boot menu using the manufacturer’s instructions. Select the USB boot entry.
3. Look for the character DriveKey logo and numbered terminal menu. Use arrow keys and Enter, or a menu number. Escape cancels.
4. Choose 9 — Check / correct UTC clock. Compare UTC with an independent clock. If genuinely wrong, enter the actual current UTC as YYYY-MM-DD HH:MM:SS (seconds optional) or an ISO timestamp ending Z, review the correction and type SET UTC. This changes only the live Linux session, not Windows or the hardware clock. Never use the request deadline to set the time.
5. If Windows opens instead, shut down and check the selected boot entry and image-writing result. Consult your manufacturer for compatibility. Do not blindly disable Secure Boot or change BitLocker/firmware protections.
6. A virtual machine is suitable for unfunded functional demonstrations, not protecting real keys from a compromised host.

Create and check your vault

Your keys stay out of the website.

1. For a new wallet, choose “Create a vault.” Read where the encrypted file will be saved and the recovery information.
2. Enter a unique passphrase locally, then repeat it. Hidden input is normal: letters may not appear. If confirmation differs, retry from the menu.
3. Record the full public address shown after creation. Never share the passphrase or private vault file.
4. Choose “Check vault / password” and verify the passphrase before leaving Linux.
5. For an existing wallet upgrade, do NOT create a different wallet. Place your verified encrypted backup as vault-backup.json in the new USB’s DriveKey folder while shut down, then boot and choose “Backup / verify backup” → “Restore onto empty USB.” Verify the recovered address matches your original.

Back up and verify

A backup only helps if you can restore it.

A copy on the same USB does not protect against losing that USB. Recovery requires a separate encrypted copy AND its passphrase. Reconnecting cannot reset a forgotten passphrase.

1. Choose “Backup / verify backup” → “Create encrypted backup.” This saves vault-backup.json without replacing an existing backup.
2. Choose “Verify encrypted backup” and enter the passphrase locally. Check the public address.
3. Use “Safely shut down.” Only after the PC is fully off, return to Windows and copy the encrypted backup to a separate safe location.
4. Test recovery on an empty configured target: place vault-backup.json in its DriveKey folder while shut down, boot offline, restore and verify the original address.
5. Never upload vault-encrypted.json or vault-backup.json to this website. Keep the passphrase separate from its backup.

Return to Windows

Bring back the public file—not your private key.

1. Choose “Export public wallet file” if wallet-public.json needs to be restored, then choose “Safely shut down.”
2. Keep the USB connected until the PC is fully off. Start Windows using the normal Windows boot entry.
3. Find the DRIVEKEY data partition and its DriveKey folder. The drive letter may differ between PCs.
4. Open Offline transfer and select only wallet-public.json. The page shows your full public address and Robinhood Chain / 4663; compare them with the offline screen.
5. This public metadata identifies your wallet but cannot sign transactions. There is no vault passphrase field on the website.

Make your first transfer

Prepare online. Approve offline. Verify before sending.

1. Load wallet-public.json in Offline transfer. Enter the full recipient and native ETH amount.
2. Prepare and review the network, recipient, amount, maximum fee and total debit. Explicitly confirm the review.
3. Download unsigned-request.json into the USB’s DriveKey folder with that exact filename. Keep this original website URL and browser session.
4. Shut down and boot the USB offline. Choose “Review and sign a transaction.”
5. Verify every field independently: full sender/recipient, network, amount, fees, nonce, UTC expiry and fingerprint. Type SIGN only after review, then enter the passphrase locally.
6. Wait for “Signed response saved. Funds have NOT been sent.” Use “Safely shut down” and return to Windows.
7. Upload signed-response.json into the original website session. The site verifies it against the saved request.
8. When submission is enabled, explicitly authorize the exact payment. Current network checks happen before submission. Do not treat verification as sending.
9. Check the receipt. Signed means approved offline; submitted means handed to the network; confirmed means successfully included. An uncertain result must be checked before another attempt.
10. Check UTC and time remaining before rebooting. If genuinely expired, prepare a fresh request and approve it offline. Never change a clock or edit a request to bypass expiry. Application expiry cannot revoke signed transaction bytes.