Is Keplr safe?
Keplr is low risk. On first install, Keplr generates a random 40-char ID and saves it. It's attached to every analytics event, including wallet creation, sent to analytics.keplr.app. Testing confirmed 4 requests sharing this ID seconds after install.
Who publishes itKPLR Pte Ltd - no other listings under this identity, 13 shared hostnames
KPLR Pte Ltd - no other listings under this identity, 13 shared hostnames
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 13 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Keplr assigns a persistent ID that tracks all your in-wallet actions
On first install, Keplr generates a random 40-char ID and saves it.
It's attached to every analytics event, including wallet creation, sent to analytics.keplr.app.
Testing confirmed 4 requests sharing this ID seconds after install.
- Severity
- Low unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You install the Keplr extension.
No wallet creation or further interaction is required.
Keplr generates a permanent random identifier and begins tagging every analytics event with it.
The 40-char hex ID is written to extension storage and included in all subsequent requests to analytics.keplr.app for the lifetime of the extension installation.
HTTP 200. Confirmed in dynamic analysis (4 identical-ID requests, network captures observed during dynamic analysis).
- Authorization
- D7THUjkEo3f_u!3eBfi
The analytics payload is base64-encoded before being appended as a URL query parameter, obscuring its contents in transit logs.
{ "event": "installed", "analyticsId": "c7e41221722e2cff041f927ba9ee90a7bf2df466", "v2": true, "platform": "extension", "version": "0.13.23"}- Tracking identifierc7e41221722e2cff041f927ba9ee90a7bf2df466
A random 40-character ID unique to your extension installation. It ties every analytics event back to the same browser across all sessions.
- Event nameinstalled
The action that triggered this report, e.g. 'installed', 'side_panel', 'user_properties', 'tx_signed'.
- Extension version0.13.23
Which version of Keplr you are running.
- Platform / mobile OSextension
Whether you are on a desktop browser or a mobile environment.
Written on first run, reloaded each browser start. Disabling analytics stops transmissions but doesn't delete the stored ID.
- Location
- chrome.storage.local, key: background.analytics/analyticsId
{ "analyticsId": "c7e41221722e2cff041f927ba9ee90a7bf2df466", "analyticsDisabled": false}ID generation and event dispatch (background.bundle.js)
ID generation on first run (readable)
background.bundle.js:51724// On first install, generate and persist a tracking IDconst existingId = await this.kvStore.get('analyticsId');if (existingId) { this.analyticsId = existingId; return;}const bytes = new Uint8Array(20);crypto.getRandomValues(bytes);const id = Array.from(bytes) .map(b => b.toString(16).padStart(2, '0')) .join('');this.analyticsId = id;await this.kvStore.set('analyticsId', id);ID injected into every logEvent call (readable)
background.bundle.js:51744// Every analytics event includes the persistent tracking IDconst payload = JSON.stringify({ ...eventParams, event: eventName, analyticsId: this.analyticsId, // <-- permanent cross-session ID v2: true, platform: this.analyticsOptions.platform, mobileOS: this.analyticsOptions.mobileOS, webdriver: typeof navigator !== 'undefined' && !!navigator.webdriver,});const encoded = Buffer.from(payload).toString('base64');await simpleFetch( 'https://analytics.keplr.app', `/log?msg=${encodeURIComponent(encoded)}`, { headers: { Authorization: KEPLR_EXT_ANALYTICS_API_AUTH_TOKEN } });- analytics.keplr.app
Keplr's own analytics endpoint. Receives every in-wallet event tagged with the persistent installation ID. Operated by Chainapsis, the company behind Keplr.