W-CONF

What confidential Multi-Purpose Tokens (MPTs) on the XRP Ledger hide, and what they do not. A research project, shown on one snapshot of the Devnet.

What this site shows

XLS-96, Confidential Transfers, lets a holder of a Multi-Purpose Token (MPT) keep their balance encrypted on the public XRP Ledger: hidden from the public, not from the token’s issuer. This site shows what that hides and what it does not, from one snapshot of the Devnet test network.

A public balance

an ordinary MPT holding

Convert: amount public

Confidential balances

holder ASendholder B

each holder’s balance, unless it is a recognisable zero: a new balance, an inbox just merged, or a position clawed back
the amount of each Send between holders

ConvertBack: amount public

A public balance

an ordinary MPT holding

Public everywhere

Who sends to whom, when and how often; the total held in confidential form.

The issuer reads every confidential balance

So does an auditor, if the token names one. No setting turns this off.

publichidden from the publicthe issuer can read it

Amounts are public where they cross into or out of confidential form, and hidden inside it. Who transacts with whom is public everywhere, and the issuer reads every balance.

New to this? Read how it works

Where to go

How it works: confidential transfers in plain words, and the example this project built.
What anyone sees: what a ledger observer reads of four test accounts, including which balances are visibly zero.
What the issuer sees: the encrypted copy of each balance that the issuer can always read. This site does not publish the figures.
Who can do what: what each kind of key can and cannot do.
Wallets: why the browser wallets examined cannot hold a confidential position.
Custody: where confidentiality and custody approval policies conflict.

About this site

Every value comes from one snapshot of the ledger, taken when this site was built. The site signs nothing and holds no keys. No code of this project runs on a server when you load it, and your browser requests only this site’s own files.

Devnet, a public node

read once, when the site is built

one snapshot

The build

pages built offline, checked by the release gate

static files

Vercel

serves the files; runs none of this project's code

your page load

Your browser

requests only this site's own files

Not part of this site, and not connected to it: wconf-signer, on the holder's own machine

Holds the keys, builds the proofs and signs. A web page cannot reach it.

This site is files built once from a Devnet snapshot. Nothing on it can sign; signing happens only in a separate program on a holder's own machine.

To transact, run it yourself. Signing happens only in wconf-signer, a separate program on the holder’s own machine, never in a web page. The README’s “Run it” explains how to build it and run the local version of this site. It does not yet explain how to create a holder profile and funded Devnet accounts, which a transaction needs.

What it never claims

No key source hides identities. The sender and receiver of every confidential transaction are public. (P-4)
A holder is never private from the issuer. The issuer can always decrypt. (P-9)
No key source supports rotation or recovery. XLS-96 supports neither. (P-10)
No key source hides who transacts, when, or how often. Only amounts are hidden. (P-11)
A newly created confidential balance is publicly identifiable as exactly zero. (F-1)
Retiring a position in tranches publishes each tranche size. (F-24)
None of this is secure, audited, non-custodial or production-ready, and the custody mode is a simulation. (P-5)

Each code in brackets names a row in the project’s claims register, CLAIMS.md.