Safety
Is a vanity address safe?
Yes. A vanity address is as safe as any other Solana address, because it is one: a random key that happens to start with your word. The risk is the tool that makes it. Here's how to judge any generator, and how to spot the lookalike trick that targets every address.
The address is safe. The tool is the risk.
Nobody can choose an address and work back to its key. A vanity generator makes random keys, one after another, and keeps the first one whose address starts or ends the way you asked. A five-letter word like Abcde takes about 192 million tries, and every key it throws away is as random as the one it keeps.
So the address is never the weak point. A vanity key loses funds for the same two reasons any key does: someone else can work it out, or someone else has a copy. Both come down to the generator.
Three ways a generator makes it unsafe
1. Weak randomness: the Profanity bug
Profanity was a popular vanity address generator for Ethereum. It made 256-bit keys from a seed of only 32 bits, so there were only about 4.3 billion possible starting points. In September 2022, 1inch's contributors showed they could recover the private key of any Profanity address that had signed a transaction, and attackers drained about $3.3 million from those wallets that month. The address was fine. The key behind it was guessable.
The lesson for any tool: the key must come from a full-strength random source, and the code that makes it should be public so anyone can check.
2. A site that keeps a copy
A website that makes your key on its server and shows it to you in plain text has seen it. Maybe it forgets it. You can't tell. If it keeps the key, it can empty the address whenever it likes, months later.
3. A key sent in the clear
A key that arrives in an email, a chat or a download link passes through other people's systems on the way. Each one is a place a copy can leak. A good tool encrypts the key so only your device can open it.
How to judge any generator
Ask every tool the same questions. A tool that runs on your own computer, like solana-keygen grind, answers most of them by design, and it's the right pick for a short word. A service that grinds for you has to answer them in writing.
| Ask | Look for | notrandom.fun |
|---|---|---|
| Where is the key made? | Your own device, or a service that says plainly what it handles. | Our service makes it, and briefly handles the unencrypted key while finding your address. |
| Who can read it after? | Only you. | Only your browser can open the stored copy. Without your browser's key, nobody, us included, can decrypt it. |
| How does it reach you? | Encrypted for your device, never in plain text over email or chat. | Encrypted to a key your browser made before you paid, which never leaves your device. |
| Can you check it? | Proof the key really makes the address. | Your browser re-derives the address from the key and checks it starts and ends the way you ordered. |
| Is the code public? | Key-handling code anyone can read. | Yes: our engine's key-handling code is public. |
| How long is it kept? | A short, stated limit. | We delete encrypted results 7 days after delivery. |
| What does it ask of you? | Nothing but payment. Never a seed phrase. | One SOL transfer, which your browser checks before your wallet sees it. We never ask for your seed phrase. |
The full story, including what we can and can't see: how we handle your keys. When you're happy with the answers, get a wallet address with your word.
Address poisoning: the lookalike trick
Address poisoning targets every address, vanity or not. An attacker watches who you send to, grinds an address that starts and ends like it, and sends you a tiny transfer from the fake, so it sits in your wallet history right beside the real one. Wallets shorten addresses to their first and last few characters. Copy the wrong one from your history, and your next transfer goes to the attacker.
They can't copy the real address. Every address has its own key, and nobody can make a second key for it. They can only match the ends, and each character they match costs them about 58 times more keys. Paste any address to see what a fake costs:
Average keys to find a match with exact capitalization, from the same math as our quotes. The fake's middle is made up in your browser.
| The fake matches | Example | Keys on average |
|---|---|---|
| First 4 | 7xKX… | 3.3 million |
| First 3 and last 3 | 7xK…AsU | 11.1 billion |
| First 4 and last 4 | 7xKX…gAsU | 37.4 trillion |
| First 5 and last 5 | 7xKXt…sgAsU | 126 quadrillion |
| First 6 and last 6 | 7xKXtg…osgAsU | 423 quintillion |
A bot that poisons in bulk checks every key it makes against thousands of targets at once, so it spreads that cost across all of them. That's why short matches are everywhere, and why each extra character you check does so much work.
Our own burn wallet has a lookalike
Our burn wallet is CkFJ…burn. Since October 9, 2026, lookalikes have sent the $NTRNDM wallet dozens of 0.0001 USDC transfers, hoping we'd copy one back out of its history. One of them is CkFJ61EG…1urn. It matches the first four characters and the last three: about 645 billion keys. The b would have cost 58 times more, so the attacker stopped short. Read the whole word, and the fake gives itself away.
Why a word helps you catch it
Four random characters are hard to remember, so most people check two or three. A word you chose is easy to check in full, and a fake has to match all of it. A random address's first and last four characters cost an attacker about 37 trillion keys. NTRN…WyV6, the short view of $NTRNDM's CA, costs about 2.2 quadrillion, because few addresses start with an N. Match the whole word, NTRNDM…WyV6, and it's about 7.4 quintillion: around 200,000 times the random address's four and four.
A word raises the price of a fake. It doesn't make one impossible. Copy addresses from your contacts or the source, never from your history, and read the whole word every time. pump.fun coins face the same trick with names and tickers: here's how a word in your CA stops vamps.
Solana's alphabet helps too
Solana writes addresses in base58, which leaves out 0 (zero), O (capital o), I (capital i) and l (lowercase L). An attacker can't swap an O for a zero or an l for an I, because those characters never appear. Every lookalike has to match the real characters, and pay for each one. More on how Solana addresses work.
Questions
Is a vanity address safe?
Yes, when the tool that makes it uses strong randomness and doesn't keep or leak the key. The address itself is as safe as any other Solana address. The risk is always the generator.
Can someone copy my vanity address?
Not the whole thing. Every address has its own private key, and nobody can make a second key for the same address. An attacker can only grind a lookalike that shares your first and last few characters, and each extra character they match costs them about 58 times more work.
What is address poisoning?
An attacker makes an address that starts and ends like one you use, then sends you a tiny transfer from it so it sits in your wallet history. If you later copy an address from that history, you send your funds to the attacker. Always copy addresses from a contact list or the source, and check every character you can.
Are online vanity address generators safe?
Some are and some aren't. Ask where the key is made, who can read it, and how it reaches you. A site that shows you a plain key it made on its server could have kept a copy. Look for a key encrypted for your device alone, and a browser that checks the key matches the address before you use it.
Is a vanity address traceable?
As traceable as any Solana address. Every transfer is public on the chain, whatever the address says. A word makes an address easier to recognize, so use a vanity address for the things you want people to find, like a coin or a public wallet.
