Loading Lightning in a Jar…

Lightning·in·a·Jar

Write down your seed

These twelve words are your wallet. Anyone with them controls your Bitcoin. Anyone without them cannot access it — not Plotzwerks, not anyone.

Write them on paper. Store the paper somewhere safe. Consider a stainless steel backup — fire and water proof. Stay offline, don't screenshot, don't email, don't type them into anything but a new wallet, Lightning or onchain, if you ever need to recover.

I've written down my seed phrase and stored it safely.

Lightning·in·a·Jar

Keep a cloud copy?

Your Lightning channels change with every payment. LiJ can keep an encrypted copy of their state in the cloud — locked with your key; we can’t read it. With it, a new phone restores your channels as they were. Without it, a new phone can only close your channels — unless you keep a backup file yourself (Safety → Save backup to device) and load it on the new phone.

Change it any time in Privacy → Cloud. Off means off — the copy is deleted.

Lightning·in·a·Jar

Set a wallet passphrase

This locks your wallet on this device. You'll need it each time you open the wallet.

This is not your seed phrase and not a 13th word. It's a local password — separate from your Bitcoin keys. If you forget it, you can reset it by re-entering your 12 words.

Passphrase

Confirm passphrase

Lightning·in·a·Jar

Unlock wallet

Enter your passphrase to continue.

Forgot passphrase

SIMPLE

YOURS

LIGHTNING

Welcome to Bitcoin.

No accounts. No permission needed.
Lightning in a Jar — the place for your bitcoin.
Only you have the keys. Just you.
Add money, send money, anytime you like.

Lightning·in·a·Jar

OFFLINE

You’re offline. Your bitcoin isn’t.

No network is needed to hold your keys. Everything below lives on this device.

LAST KNOWN

On-chain—

Lightning

Total owned—

Recovering on-chain sats elsewhere: these 12 words in any BIP84 wallet (BlueWallet, Sparrow, Electrum) at m/84’/0’/0’ recover every on-chain sat. Set its gap limit to at least 350 to see every address.

Silent payments: coins received at your sp1 address are NOT reachable from these 12 words in an ordinary bitcoin wallet. A Lightning in a Jar-wallet restore finds them again through your provider. Any other standard wallet needs the Black start kit’s sweep, or a wallet that reads silent payments — Sparrow wallet or Cake wallet. Coins received after the last Black start kit push are not included until the next push.

Lightning funds: they live in channels tied to these same keys. Once any LiJ instance is back online, channel funds settle or sweep back to the keys above — worst case is the words plus patience. Nothing here can be spent by anyone without the words.

Sending and Lightning enabled when you’re back online.

Lightning·in·a·Jar

OFFLINE · WALLET MODE

No network.
Still your wallet.

Everything below lives on this device. Sending, fresh receive detection, and prices return when the network does.

WATCH-ONLY EXPORT · account zpub

Build a watch-only coordinator (Sparrow, BlueWallet, Electrum) without ever typing the 12 words: reveal, then scan or copy. A zpub can see balances and build unsigned transactions — it can never spend.

BLACK START KIT · if the LSP disappears

Exit lightning and collect your onchain and lightning balances. Two pieces of text per channel, already signed, no secrets: THE CLOSE ends the channel on the Bitcoin network; THE COLLECT moves your share to your own address after the shown wait. One piece per silent-payment coin, THE SWEEP, moves that coin to your own address with no wait. Paste each artifact from the CLOSING and OPEN cards in turn on any online explorer’s broadcast page — settled channels have nothing left to collect — and never return to this wallet.

Lightning·in·a·Jar

Reset passphrase

Enter your twelve seed words to prove you own this wallet. We'll verify them against your stored wallet, then let you set a new passphrase.

Lightning·in·a·Jar

These words don't quite match

These twelve words don't match the wallet stored on this device.

A few possibilities:

One of your words is misspelled as another valid word
The words are in the wrong order
You're entering the seed for a different wallet

Lightning·in·a·Jar

Load an existing seed phrase

Enter the twelve words for the wallet you want to load. Any existing wallet on this device will be erased and replaced with this one.

Run this wallet on one device at a time. A second copy running at the same time can lose every sat in your channels.

Restoring reads your history from the blockchain: about 1 GB and roughly half an hour for each year back, with LiJ open on screen. Use WiFi.

Restoring a seed from another wallet? Add a year if your seed predates the birth of LiJ in 2026 (block 951888) →

Lightning·in·a·Jar

Set up your wallet

Are you starting fresh, or do you already have a recovery phrase to restore?

Your keys live encrypted on this device for transaction signing.

Lightning in a Jar is non-custodial — no one else holds your funds, so always securely back up your keys.

Lightning·in·a·Jar

Erase wallet and start over from this device

You're at the precipice. Once you confirm, every Lightning in a Jar trace on this device is gone — keys, channels, addresses, history, settings. There's no recovery without your seed phrase. If you don't have it written down somewhere safe, or if that's not what you intended, hit Back.

Type ERASE to confirm

Lightning in a Jar

Sovereign bitcoin wallet

Total owned

sats

LIGHTNING ₿

●●●●●●

sats

Sendablei— sats

Receivablei— sats

LSPi—

Quorumi—

Monitorsi—

Scan depthi—

On-chain synci—

SP synci—

Filter serveri—

Kept transactionsi—

Watcheri—

Buildi—

chain

lsp · — ms

quorum

Chain

synced

LSP

— ms

Quorum

—

↑ Send

↓ Receive

RECENT

No activity yet.
Receive your first sats to get started.

Send

Pay an invoice, an address or a pay code.

Invoice or Lightning address

Amount

10K

Max

Receive

Create an invoice or an address for someone to pay you.

Recovery Phrase

Inside the Lightning LIJOX standard…

if you lose or erase your device: your 12 words + your encrypted channel-state backup bring back everything — channels included.

if you have only your 12 words: channels close on device open, and your money returns on-chain within a few confirmations.

if you never open LIJOX again: your LSP closes your channels on its timer, and every sat arrives at your seed on-chain.

if your LSP is gone and your backup with it: your Black start kit closes the channels without the LSP — find it below, and in the offline room.

if this phone is gone too, and only the 12 words are left: Black start. The wallet keeps a sealed copy of your kit with your provider, up to twenty other LIJOX providers and nostr public relays — only your words can open it. On any device, lightninginajar.xyz/recover finds it and closes your channels. Safety → Backups → Black start shows where your copies are.

Outside LIJOX

your on-chain sats sit at standard BIP84 paths. In any other wallet (BlueWallet, Sparrow, Electrum), set its minimum gap limit to 500 first — LiJ spreads addresses farther than default scans typically look.

No one — not even your LSP — can redirect a single sat.

Your keys...your bitcoin.

⚠️

Your 12 words will appear next. Make sure no one else can see your screen. The words will be cleared when you leave this screen or switch apps.

Enter your passphrase to view your recovery phrase

Recovery Phrase

⚠️

Write these 12 words down in order and store them somewhere safe. Never share them with anyone. These words are the only way to recover your wallet.

Delegate payment

Someone else spends up to your cap — signed by your key, honored by your LSP, cancelable any time.

Amount they can spend

Options ›

Sats move to your LSP now; whatever isn’t spent by the errand-runner comes back when the run ends or you cancel the run. This is a trusted arrangement with your LSP — not a cryptographic lock (yet).

node-key signed · registered with your LSP · hold for diag

Delegate payment to someone

Have them scan this

waiting

Delegate payment

Automatic takes each new build the next time you open the wallet online. Ask me keeps the build you have running until you tap Update on a card that shows the new versions and the engine’s hashes. Neither can stop a hostile update from the site itself — the browser replaces the wallet from its origin, so a malicious build could ignore this setting. What Ask me gives you: no silent replacement, and a chance to check the engine hashes against the published build before it runs.

A running balance under every row in RECENT and ONCHAIN RECENT, added up from the rows themselves, oldest first — nothing is read back from the balance card. The newest total must equal the card. When it doesn’t, a line at the foot of the list says by how many sats — that is a fault in the wallet’s books, and worth reporting. Off changes nothing on the screen. The figure under each Lightning row is your Sendable balance — what was clear to send after that row, at today’s reserve and fee hold — or, with the second switch off, the channel balance itself. A row the wallet cannot place in a channel ends the Sendable walk; the rows below it show no Sendable total, and a line at the foot says so.

Show running totals

Sendable balance · off shows the channel balance

Mix joins a pool of people with coins of the same size; each gets the same amount back at a fresh address, and no one can tell which is whose. With this on, your seats in a pool are updated while the app is open. Your coin is held from Join until the pool settles or you leave. Off: the Mix tile in Apps says it is not on in this wallet. Turning this off while you hold a seat keeps the seat — leave it in Mix first. Public pools: while the app is open, a seat of yours also watches a public Joinstr relay and joins a pool of its size opened there by anyone with a Joinstr wallet — the card says “Public pool”. Off: only your provider’s pools.

Mix

Public pools

Sats MAX leaves unfilled in case the network fee moves between the quote and your tap. Zero is exact \u2014 and if a zero-margin MAX ever bounces, the wallet quietly steps down and retries to the sat.

A cooperative close can sit unconfirmed when fees rise after it was signed. Speeding it up spends its output back to you with a small extra fee that pulls it into a block (a child-pays-for-parent transaction). Off: you decide each time, from the on-chain row’s Speed up button, which shows the fee first. Automatic: the wallet does it by itself once the close has waited three blocks and the network rate is well above what the close pays.

What your LSP counterparty must reserve before you accept payments from their side — yours to set. Lower amounts lets you access receive room sooner — but weakens your take-back protection vs. the LSP while your phone is off. New channels only — channels you already have keep the reserve they opened with.

A South African shop code (Pick n Pay, Checkers, Shoprite, Zapper, SnapScan, Scan to Pay, Yoyo, Ecentric) is paid through MoneyBadger: the wallet shows you what the code says; at Review it sends the code to cryptoqr.net, which answers with a Lightning invoice. Some shops ask for a refund address — a Lightning address a refund would be paid to. With this on, your own Lightning address (the static address under Privacy → LSP) is given, and only when the shop asks for one; a chit you make while it is on carries it too. The shop and MoneyBadger then learn which provider you use. Off: a shop that asks for one can’t be paid from this wallet.

Give my Lightning address when a shop asks

What you must share to get routing at all: your invoices, amounts, timing, channel balances, and IP — the LSP is your channel counterparty and sees the traffic it carries. What it never holds: your keys or your funds.

The LSP can hold an incoming payment while you’re away — a longer window means more it observes; Off means offline payments fail fast instead. Your choice is sent to the LSP and clamped to its ceiling. This dial governs regular bolt11 invoices (amount receives) — LNURL address receives ride their own network-fixed window instead.

When a Lightning payment is waiting and LiJ is closed, your LSP sends a silent nudge so your phone shows a “payment waiting” notification. Tap it to reopen LiJ and the payment lands — no amount or detail travels with it, just a wake.

Wake this phone

Session logs live in memory only — the last 400 lines — and vanish when the wallet closes. Close-tapes rest on this device in plain storage, newest three kept, older pruned automatically. Off means nothing ever leaves this device; on ships both to the LSP when the wallet hides — and the LSP stops expecting on its own when you go quiet.

Ship device logs

An open wallet polls the LSP continuously — it knows when you’re here. Quiet checks in about every ten seconds instead: payments still work, they land a beat slower, and your presence pattern blurs.

Quiet

On: with no amount entered, Receive shows your static address — reusable, no expiry, held non-custodially by your LSP until you return. Off: every receive is a one-time bolt11 invoice and the address stays paused; claims already registered with your LSP remain payable until they run out. A permanent public code: every payer is visible to the LSP, and reuse links your receipts together as the LSP. Rotate severs that link — payers of the old code lose the thread. Old QR may keep receiving at the LSP until the already-submitted pre-signed invoices run out; full server-side removal TBA.

Receive via LNURL

What the LSP keeps, and for how long — every LIJOX provider will declare it. Shown here when manifests go live.

Independent operators cross-check the chain so no single one can lie to you. What you share to get this: each sees the addresses and transactions you ask about, and your IP. What they can’t know: your keys, your other addresses, or each other’s answers. The LSP declares the default set; you can add operators of your own on top — never fewer. Left blank, the LSP defaults stand. One healthy endpoint is enough to function; the count colors green when all answer, amber when some do.

Add an Esplora endpoint

While you wait for an on-chain payment, LiJ checks your address so the payment shows before it confirms. With no server of your own, the public explorers are asked, one at a time — each sees the address it is asked about. Save your node’s Esplora address and it is asked first; if it doesn’t answer, the public explorers are asked, unless Only my server is on. Saved on this device.Your Esplora server

Only my server

All four: a transaction fans out to every explorer at once — most reliable, and all four operators see it each time. One at a time: it goes to a single explorer (rotating per transaction) and stops at the first acceptance. Bitcoin needs just one honest node to propagate either way.

One at a time

Channel state backs up after every change, sealed under your key before it leaves. What you share to get recovery-without-the-device: Cloudflare (the backup host) sees that an encrypted blob arrived, its size, the timing of your activity, and your IP — never contents, never keys. Off means nothing leaves this device — recovery then depends on this phone surviving. Download saves the same sealed blob to this device as an archival copy; load it back anytime from Safety → Backups → Load backup from device.

Cloud backup

Finding an LSP means asking the registry — a Cloudflare-hosted worker. What you share to get discovery: the registry sees your IP and that this wallet is shopping for a provider. It learns nothing about your funds, keys, or channels.

Delegation chits mint through pageapp.app — a Cloudflare Worker: pageapp and Cloudflare see amounts, timing, and your IP, and the chit’s state lives on Cloudflare’s rails — if those rails go dark, delegation pauses. Keys never leave you: bounded spend authority is what’s delegated, and the payment preimage never touches the server.

Zero. Every script ships inside the app — QR tools, scanners, UR codecs, all vendored. No CDN, no analytics, no font server. Nothing outside this device learns the wallet even opened. It's a beautiful thing.

Your seed and channels are sealed under the vault. In plain storage, readable if the device is: cached balances, recent activity, and diagnostic tapes (close logs, scan logs — device-only, never shipped). Your zpub appears only while revealed and is never stored. Clearing lives under Tools → Transaction tools.

Open the wallet with no network and still reach what’s yours: Lightning balances decoded live from this device’s channel state, fresh receive addresses, your static pay code, your recovery words and account zpub, offline transaction signing by camera or paste, and Erase. Nothing is shared with anyone — no network, no counterparty. Sending, live receive detection, and prices need the network and will say so.

Start without a network

Your seed is always encrypted. This seals the payment ledger, close records, and scan logs on this device under a key derived from your seed: a phone thief, a backup extract, or forensics without your passphrase reads only ciphertext. Nothing here leaves the device either way — this row is about whoever picks up the phone. Balance snapshots stay plaintext for instant boot. Flipping the switch takes effect immediately.

Encrypt history

Receive on-chain has a Silent payment tab: one sp1 address you can show anywhere. Each payment to it lands on a fresh address only a wallet with Silent Payments enabled can find (BIP-352). Your provider serves a per-block list of hints; this wallet’s engine scans them on the phone and never tells the provider an address or a coin. Coins received this way are NOT reachable from your 12 words in an ordinary bitcoin wallet. A Lightning in a Jar-wallet restore finds them again through your provider. Any other standard wallet needs the Black start kit’s sweep, or a wallet that reads silent payments — Sparrow wallet or Cake wallet. Coins received after the last Black start kit push are not included until the next push. Outbound sends to sp1 addresses works either way. Off = no scan and no Silent payment tab; on again resumes where it stopped.

Silent payments

Appearance

Text size

10 themes · tap to apply

Argent

1 · silver

Ginza

2 · 銀座

Smooth Plateau

3 · table

Hinoki

4 · 檜

Vitrine

5 · glass · dusk

Vitrine Crimson

6 · glass · ember

Vault · downlit

7 · spotlight

Vault

8 · V2 dark

Bitcoin Orange

9 · revolutionary

Kura

10 · 蔵

Add image

Choose a provider

Loading providers…

Connections

Loading…

Write down your seed

Keep a cloud copy?

Set a wallet passphrase

Unlock wallet

Welcome to Bitcoin.

You’re offline. Your bitcoin isn’t.

No network.Still your wallet.

Reset passphrase

These words don't quite match

Load an existing seed phrase

Set up your wallet

Erase wallet and start over from this device

Choose a provider

Connections

No network.
Still your wallet.