Every Solana developer has one: an id.json written by solana-keygen, sitting in ~/.config, holding an unencrypted 64-byte secret. Solana's own docs call it the least secure wallet option. Coldstar is what that file should have been: encrypted, offline, and still scriptable.
Keep the keypair file for devnet. Move mainnet keys to Coldstar.
| Coldstar | a Solana keypair file | |
|---|---|---|
| Upfront cost | ~$10 — any USB drive. The software is free and MIT-licensed. | Free. |
| Where the key lives | AES-256-GCM encrypted keyfile on a drive you own. Plaintext exists only in memory-locked RAM for the ~100 µs it takes to sign, then is zeroized. | Unencrypted JSON on disk. Anza docs: the password applies to the seed phrase, not the file; anyone with the file has all the tokens. |
| How a transaction reaches the key | Build online → QR (or file) to an offline machine → sign → QR back → broadcast. Fully air-gapped; the drive is storage, not a signer. | Any process on the machine can read the file and sign. The paper-wallet docs suggest deriving on an air-gapped computer, but there is no built-in offline transaction transport. |
| Source code | Open source (MIT) — every line that touches the key is readable on GitHub. | Apache-2.0, part of the Agave client. |
| What you trust | Code you can read, plus your own offline machine. No vendor silicon, firmware, cloud, or account. | Every process, user, backup, and sync tool that can read the file. |
| Recovery | Passphrase + encrypted keyfile. The drive is disposable: lose it and the file is useless without the passphrase; re-flash a new one. | BIP39 seed phrase. |
| Automation & policy | CLI-first, scriptable, headless. Policy-gated agent signing: limits, allowlists, rate caps, escalation to air-gapped approval. | Fully scriptable with no policy layer: whatever can read the file can sign anything. |
| Solana wallets | Coldstar CLI and Seeker app. | Solana CLI and every SDK. |
| Maturity | Beta — independent audit planned before the production release. | Reference implementation. |
This is not a knock on the Solana tooling; a keypair file is the right primitive for development. It is the wrong place for mainnet funds, and Solana's documentation says so.
A keypair file has no trust model; it has an access-control list, and it is the one your operating system gives to every process running as you. Backups copy it. Sync clients upload it. A malicious npm postinstall reads it. Solana's docs are explicit that this is the least secure option and steer real funds to hardware.
Coldstar keeps the same CLI ergonomics and removes the plaintext. The file on the drive is ciphertext; the passphrase never touches disk; decryption happens in memory-locked RAM on an offline machine for about a hundred microseconds. For scripts and agents, a policy decides what may be signed, so a compromised host proposing transactions can only do what the policy allows.
Coldstar is beta and pre-audit. It is still a large step up from an unencrypted secret on a laptop.
Coldstar was built for people who already live in the terminal. Keep solana-keygen for devnet and use Coldstar for any key that would hurt to lose.
Only while the machine is off. When you are logged in, every process you run can read it, and so can anything that backs up or syncs your home directory.
Coldstar is a CLI signer: build the transaction online with your usual tools, sign it offline with Coldstar, broadcast. It also builds common transactions itself, including Jupiter swaps.
The Solana CLI supports Ledger over usb://ledger, which is a good option if you own one. Coldstar gives you an offline signer without buying hardware and adds a policy layer for automation.
Open source, MIT. macOS, Linux, Windows — and on the Solana Seeker dApp Store.
pip install coldstar
Third-party facts were checked against the vendor's own pages on the date above. Pricing and feature sets change; if something here is out of date, tell us and we will fix it.