Is Flow Wallet safe?

Medium risk

Flow Wallet stores Google Drive wallet backups with an encryption key shipped in the extension bundle.

Flow Wallet uploads wallet backup records to Google Drive using a static AES-CBC key and IV included in the extension code. The backed-up record includes usernames, account IDs, timestamps, and encrypted mnemonic blobs, while account recovery also sends the current wallet address to Mixpanel analytics.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.

play-storev3.1.13Chrome Web Store
40Risk
Who publishes it

Flow Digital - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
play-store
Declared legal entity
Flow Digital
Registered address
1209 N Orange St, Wilmington, DE 19801, US
Registered contact
Flow Digital, LLC

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Where it sends data

Destinations our analysis observed Flow Wallet contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.googleapis.comwidely used

    Flow Wallet sends data to www.googleapis.com. A widely used service: 44 other extensions we have analysed send data here.

  • api.mixpanel.comwidely used

    Flow Wallet sends data to api.mixpanel.com. A widely used service: 35 other extensions we have analysed send data here.

Updated 30 September 2026hpclkefagolihohboafpheddmmgdffjm