Our security model

J Tools runs your token operations without ever taking custody of your wallet. Transactions from your wallets are signed on your side, the platform builds and sends them, and server-side guards sit behind all of it.

The short version

#the-short-version

Tip

A connected wallet’s keys stay inside that wallet, the browser is never trusted to set a fee amount, and secrets are kept out of the logs. Admin access is locked behind a second factor, and the audit trail is built so any tampering shows.

Non-custodial by design

#non-custodial-by-design

J Tools never asks for your seed phrase and never holds your funds. When you use a connected wallet, every signature happens inside that wallet through the wallet adapter, and only the signed transaction goes to the network. The wallet’s private key never leaves it.

J Tools page

1You set up an action in J Tools

The transaction comes to your wallet

Your wallet

2Your wallet shows the transaction

3You approve and sign in your own wallet

A connected wallet's keys never leave it

Only the signature goes out, never the key

Solana

4The signed transaction is broadcast to Solana

Some tools can also sign with private keys you paste, because they work across many wallets that no adapter connects: Bundled Trade, Multi Swap, Multi Sender, Batch Collector, the relay tools, Pump.fun Create & Bundle Buy and the claim tools among them. Those keys stay in your browser tab and sign there, and they are not sent to us. A key pasted as a tool’s private-key source is cleared after 15 minutes. Treat these as throwaway hot wallets. Holder Booster is the one tool that gives our servers a key: it creates a fresh distributor wallet for each run, keeps the holder wallet keys in the backup file you download, and sends only the distributor’s key, encrypted, so our worker can finish the run after you close the tab. If a page asks for your recovery phrase, that is not us.

A tamper-evident audit chain

#a-tamper-evident-audit-chain

Admin actions are written to an append-only audit log. Each row carries a prev_hash, a SHA-256 hash of the row before it, so the entries are linked like a chain. Change or delete one row and every hash after it stops matching, which makes the edit obvious. Log entries leave out passwords and session tokens.

RPC whitelist and rate limits

#rpc-whitelist-and-rate-limits

The browser does not talk to a raw Solana node. It goes through a gateway that allows only a fixed list of read methods plus transaction send and simulate, and caps requests per IP. RPC URLs and keys stay server-side, so the browser has nothing to leak. Rate limits apply per endpoint, and the real client IP is read from the rightmost x-forwarded-for value so the limit cannot be spoofed with a forged header.

Fee-theft protection

#fee-theft-protection

When a tool charges a platform fee, the amount recorded for commission comes from our own fee settings or from the SOL that actually reached the platform wallet on-chain, never a number the browser sends. No path trusts a client-supplied fee. You see the full breakdown (total, platform fee, and estimated network fee) on the tool’s fee card before you confirm anything. For the reference values, check the in-app fee summary or the fee schedule.

Caution

About fees. Every action has two costs: the Solana network fee paid to validators, and the J Tools platform fee. The platform fee always shows in the app before you confirm, and nothing is charged until you sign. Fees can change over time, so trust the in-app summary rather than a number you saw once.

Admin access is locked down

#admin-access-is-locked-down

Reaching the admin panel takes a password and a TOTP code, enforced on the server. The flow is built to give nothing away.

Second factor Password storage No information leak Sessions

TOTP is mandatory. Codes are checked server-side, and a run of failed attempts locks sign-in for a cool-down window. The lock reason is never sent back to the client.

Admin passwords are stored only as one-way hashes, configured through environment variables. There is no password-reset screen in the panel or the API; a change means a new env value and a deploy.

A failed login returns the same generic message whether the username, the password or the code is wrong, and an unknown username takes as long to check as a real one. A locked sign-in only says there were too many attempts, never which limit tripped. Login attempts are rate-limited by both IP and username.

Sessions live in a server-side store with httpOnly, Secure, SameSite=Strict cookies and random IDs. They rotate on login to defend against fixation, time out when idle, and are capped per admin.

OPSEC everywhere

#opsec-everywhere

Operational security is a standing rule across every endpoint and page. Secrets, private keys, and full tokens are kept out of the logs. A client error response carries a short message, often with a code, and no stack trace, internal path, or database detail; the full picture stays in server logs. Blog posts drafted by automation stay drafts until an admin publishes them, so nothing reaches readers without a person signing off.