Touch the sensor on this device and thirty-two bytes come into existence in your browser. They become four addresses — Sui, Ethereum, Solana and Bitcoin. The secret behind them stays on the machine you are reading this on. ONE never receives it, so ONE can never hand it over, lose it, or freeze it.
1
A passkey on this device evaluates a function only that device can compute — the WebAuthn PRF extension. If you would rather have paper, your browser's own generator produces thirty-two random bytes instead. Either way the secret is born on your machine.
2
Each chain gets its own HKDF info string — wallet-address-v1 for Sui, wallet:eth, wallet:sol, wallet:btc. Different info strings produce cryptographically independent keys, so one chain tells you nothing about the other three. The screen prints the exact string that produced each address.
3
The derivation is deterministic. The same passkey on the same device gives the same four addresses today, tomorrow and in a year. There is no list on a server to lose.
The passkey is the root. There is nothing to write down and nothing to store, because the key is derived again from your fingerprint whenever it is needed. Lose the device and you lose that root — which is why there is a second one.
The same thirty-two bytes, written as twenty-four words you can copy onto paper. Type them at one.ie/w/restore and ONE derives the same four addresses. Paper survives a dead laptop.
They are BIP-39 words, and they are not a seed phrase another wallet can open. A standard wallet takes the phrase through PBKDF2 and BIP-32; ONE takes the entropy those words encode straight into HKDF. Same words, different key. Typed into other software they will produce an address that looks perfectly valid and is not yours. Restore them at one.ie.
The key is never written to this browser’s storage and there is no row for it in any database. A key made from words lives in this tab and dies with it — the words are the only way back, and only if you wrote them down. The page is an ordinary web page in every other respect: it remembers the theme you pick, the way the rest of one.ie does.
Deriving a key makes no request of its own. The secret is computed in this tab by your browser’s own crypto, and no code on this page sends it anywhere. The page loads the way any page does — scripts, styles, one analytics beacon — and none of that carries the key.
This page derives addresses and shows them. It moves no funds and signs no transaction. To keep a key on this device and seal it under your fingerprint, the wallet at one.ie/w/keys is where that happens.