<p>It is good to consider the security of a system in which you are relying.</p>

<p>The HTML and Javascript served is not obfuscated so the code is easily verified.</p>

<p>While there have been no formal security audits, at least not that I'm aware of, there  are many people with strong skills in cryptography, programming, math and security that have looked at the code.</p>

<p>The method used to generate an address draws from other open source tools (e.g., Crypto-JS) as well as a subset of Bouncy Castle for the ECSDA ported to Javascript.  In other words, BitAddress isn't doing anything that hasn't already been implemented elsewhere, it just implements them in Javascript.</p>

CC BY-SA 3.0
2013-03-29T17:49:07.243Z
That said, unless you use a browser extension like blockchain's one, you are never really safe https://chrome.google.com/webstore/detail/my-wallet-verifier/kcapglakfcodkajgllmkiddclghogkic
o0'.
CC BY-SA 3.0
2013-04-04T23:08:49.190Z
Related .. how to verify the source is authentic: http://bitcoin.stackexchange.com/a/9115/153
Stephen Gornick
CC BY-SA 3.0
2013-02-26T22:12:49.317Z
2013-02-26T22:12:49.317Z
Stephen Gornick
<p>I wonder if it's safe to use JavaScript generator available at bitaddress.org.
Even if I'll generate it offline, how can I know if the algorithm is not using any pre-computed / pre-planned way of generating the addresses? </p>

<wallet><security>
Is JavaScript wallet generator available at bitaddress.org relatively secure?
Marzenka
# Is JavaScript wallet generator available at bitaddress.org relatively secure?

(Asked by: username_0 on 2013-02-26)

I wonder if it's safe to use JavaScript generator available at bitaddress.org.
Even if I'll generate it offline, how can I know if the algorithm is not using any pre-computed / pre-planned way of generating the addresses?

**Tags:** wallet, security


---

## 1 answers

### Answer by username_1 on 2013-02-26. Score: 4

It is good to consider the security of a system in which you are relying.

The HTML and Javascript served is not obfuscated so the code is easily verified.

While there have been no formal security audits, at least not that I'm aware of, there are many people with strong skills in cryptography, programming, math and security that have looked at the code.

The method used to generate an address draws from other open source tools (e.g., Crypto-JS) as well as a subset of Bouncy Castle for the ECSDA ported to Javascript. In other words, BitAddress isn't doing anything that hasn't already been implemented elsewhere, it just implements them in Javascript.

> **Comments:**
> **username_2**: That said, unless you use a browser extension like blockchain's one, you are never really safe https://chrome.google.com/webstore/detail/my-wallet-verifier/kcapglakfcodkajgllmkiddclghogkic  
> **username_1**: Related .. how to verify the source is authentic: http://bitcoin.stackexchange.com/a/9115/153  

---

