How to know it is real.

What the real claim never does

• It never starts on a web page. The claim happens only inside OnWallet, on its Claim screen. No page, including this one, asks you to connect a wallet or sign anything.
• It never arrives unasked. No pass or name is sent to an account that did not ask for it in the wallet. An NFT offer you did not request is not from us.
• It never costs more than the ledger's network fee. The wallet accepts one kind of offer: price zero, from the published accounts.
• Nobody sends you XRP, and nobody asks you to send XRP to them in order to claim. OpenApps gives no XRP to anyone.
• Nobody sends direct messages. Not on X, Telegram or Discord. A direct message about your claim is a scam.
• The only emails are ones you caused. A reservation can send five: the verification link, a reminder if the address already has a reservation, the confirmation with your code, and two notices about your hold. OnWallet ID writes when you become a member and when your claim is prepared or its account changes. None of them asks for money, a key or a password.
• Nobody asks for your recovery kit, your 24 words, a key share or a sign-in code. Not for a claim, a level or support.

The official accounts

Every Genesis pass and every .on name is issued from accounts published here. An NFT from any other issuer is not a Genesis pass and not a .on name, whatever it is called or looks like.

Network

XRP Ledger Mainnet

Genesis pass issuer

Not published yet

Names issuer

Not published yet

Minter accounts

Not published yet

Issuer domain

Not published yet

The same addresses will be published in four places, so that changing one of them is not enough to fool you:

1. on this page;
2. inside OnWallet, where they are fixed in the build and cannot be changed by a server;
3. in the registrar's public status answer, at /v1/status;
4. on the ledger itself: each issuer account's Domain field points to a site that lists the account in its xrp-ledger.toml file.

The signed file

A signed file at a fixed web address will list the official accounts with every minter, current and retired, the web origins of the registrar and the resolver, and the store IDs of the real OnWallet extension, so a copy of the wallet can be told from the original. It carries a serial number and the dates it is valid between.

File

Not published yet

Signature

Not published yet

Signed by

Not published yet. The file is signed with the issuer account's own key, or by the accounts on its signer list.

The file does not say who must have signed it, and neither does this page: a website that handed you both a file and the list of its signers would be vouching for itself. Take the signers from somewhere this website does not control: OnWallet, where they are fixed in the build, or a public explorer, which shows the issuer account and its signer list.

The file is plain JSON in one fixed form, and each signature is an ordinary XRP Ledger account signature over its bytes. The ledger's reference key library and OpenSSL both verify one; the exact commands are in the project's documentation of the issuer tool. You do not need this page to check it.

Verify the signed file in your browser

Check a pass or a name yourself

Any public XRP Ledger explorer shows what an account holds, for example livenet.xrpl.org, xrpscan.com or bithomp.com. None of them is run by us, and that is the point.

1. Open an explorer and look up your own account address.
2. Open its NFTs. Each one shows an NFTokenID, an issuer, a taxon, flags and a URI.
3. Compare the issuer with the address published above, character by character.
4. Check the table below.

A name is matched whole. An NFT whose URI says openwallet-name:malice.on is the name malice.on; it is not alice.on, although it ends the same way.

If the same name was ever minted twice, the NFT with the lowest mint sequence is the name, and a later copy never is. A name still sitting in the issuer's or a minter's account has been minted but not claimed, and points to nobody.

Decode an NFT in your browser

How .on differs from other name services

Several services put names on the XRP Ledger. Each has its own issuer, its own suffix and its own rules, and a name from one does not exist in another. A .xrp name and a .on name are unrelated, even when the word before the dot is the same.

• One issuer. Only NFTs from the names issuer published above are .on names.
• The URI is the name. It is plain text on the ledger, not a web address, so nothing has to be fetched to read it and no website has to stay online.
• One alphabet. Only a to z, 0 to 9 and the hyphen. There are no accented or look-alike letters from other scripts to confuse two names.
• Look-alikes are refused. Before a new name is compared with the names the rule protects, the things people misread are evened out: digits that read as letters (0 and o, 1 and l, 5 and s), i and l, u and v, rn and m, vv and w, cl and d, doubled letters and hyphens. The rule is cautious on purpose, so now and then it refuses a name chosen innocently.
• Not for sale at launch. A .on name cannot be transferred or sold today.
• Read by OnWallet first. Today other wallets and explorers do not resolve .on names. Sending to a name from OnWallet follows in a later release.

What is trustless, and what is not

A stolen minter key could mint duplicates, burn a name and mint it again to another account. It could not change a name in place, take an NFT out of your account without burning it, or touch your funds. The draft name policy describes the waits and the public log that make such a move visible.

Report something

Report a security problem privately to security@onwallet.si. For a fake site, a fake extension or a message that claims to be from OnWallet, write to the support address: not published yet.