# The crypto wallet problem – why we created Family accounts Source: https://family.co/blog/why-family-accounts ## Summary Family has introduced Family Accounts, a non-custodial wallet approach that replaces seed phrases with email or phone login plus a password or passkey, after what the article describes as extensive audits. Login requires two-factor verification by email or SMS, and decryption happens on the client side, with keys held only in memory while the user is online. Recovery works from any device the user has previously logged into, and Family also generates recovery codes that can be stored separately. The article states that if all recovery options are lost, not even Family can restore access. ## Article The Problem with Traditional Wallets Traditional wallets rely on seed phrases and private keys, but this approach has fundamental flaws. Losing access to your bank account because you misplaced a single piece of information would be unthinkable—yet in crypto, this remains a common reality. Most users struggle with managing seed phrases and private keys, often resorting to insecure storage methods like screenshots or digital notes. Even those who carefully write down their seed phrase risk losing it. A single mistake shouldn't mean losing access to your assets forever. Some argue that this is the cost of self-ownership, but at Family, we disagree. With the right design, security and ease of use can go hand in hand. Embedded wallets have simplified onboarding, but they often compromise self-custody. We set out to build something that is truly self-custodial—not just in theory, but in every practical scenario. The industry has explored multiple approaches: HSMs with AWS permissions that can technically be revoked but remain a central point of control multi-party computation solutions that distributes private key shares but introduce dependencies on external parties PIN codes and weak encryption layers that create new security risks Introducing Family Accounts After extensive audits, we’re introducing Family Accounts—a completely non-custodial approach to wallet management. Family Accounts use industry-standard encryption to validate only you can access your wallet, using information that only you control. This preserves the security principles of crypto while eliminating the friction and complexity of traditional wallet management. Seamless Authentication With Family Accounts, users log in using an email or phone number, combined with a password or passkey. No more seed phrases, no unnecessary security hurdles. Every account is secured with two-factor authentication via email or SMS, ensuring that even if a password or passkey is compromised, encrypted data remains inaccessible without proof of device ownership. True Self-Custody Decryption happens entirely on the client side, making Family Accounts 100% self-custodial. Your private key exists only in memory while you’re online. On the web, we use iframes and secure communication protocols to protect decrypted keys from exposure. On iOS, your key never leaves your device. Built-In Recovery Options Recovery is integrated directly into your devices. If you forget your password or lose your passkey, you can recover your account as long as you've previously logged in on that device before. For added security, we provide account recovery codes that can be stored separately. Transaction Safety Through Simulation Every transaction is simulated and displayed in a clear approval modal, allowing you to see exactly what’s happening before confirming. This protects users while ensuring a seamless dApp experience. Developer-Friendly Integration Family accounts integrate effortlessly with ConnectKit, requiring no code modifications. It serves as a drop-in replacement for any wallet and is fully compliant with EIP-1193, making it compatible with SDKs like viem and wagmi. With one upgrade, developers can now offer their users the ability to sign up with familiar options, while simultaneously gaining all the functionality Family has to offer. In addition to ConnectKit, Family Accounts can also optionally be integrated as a standalone authentication option outside of ConnectKit via npm i family Read the docs to learn more. Account Creation Process Identity Verification The process begins when users enter an email or phone number and verify ownership via a one-time code. This step ensures that users can prove ownership before encrypted keys are shared. Privacy Protection: While verification codes are sent through our servers, raw email and phone number data are never stored. Instead, they are hashed in our database, preserving privacy while supporting secure key generation. Authentication Setup When accessing Family Accounts via the web, users must set a password. For iOS users, there is an option to use passkey-only authentication instead. However, since passkeys work only within Apple’s ecosystem and web credentials may be lost if you switch browsers or devices, a strong fallback password is still required for web access. Recovery Assurance: Even if both the password and passkey are lost, device-based recovery provides a secure path to account restoration. Once authentication is established, users can create a cryptographic passkey pair for passwordless authentication. The public key is registered with our server, while the private key remains securely stored within the device’s TPM or Secure Enclave. Wallet Security Implementation After authentication, we generate a seed phrase in memory. This seed undergoes a multi-step encryption process using only information the user or their device controls: Password components Passkey elements Email/SMS verification data Added entropy This ensures that only the rightful user can decrypt their wallet. Additionally, we hash the email or SMS as a unique identifier for secure authentication. Security Note: Passkey and password authentication produce distinct encrypted blobs. Encrypted wallet data stored on Family servers can only be decrypted when: The correct email or SMS is provided The corresponding password or passkey is used Since neither component is stored in its entirety, unauthorized access is virtually impossible. Account Creation Authentication & Session Management Secure Key Management Decrypted keys exist only in memory within Family’s iframe (or Secure Enclave on iOS). This ensures that keys are only decrypted while you are online, leaving no digital footprint behind. Multi-Factor Device Authentication Logging in from a new device requires verification of email or phone ownership before encrypted information is released. Even if an attacker knows your email, they cannot gain access without: Physical access to your email or SMS Knowledge of your password or passkey This layered security approach ensures that both the client and the server contribute to account protection. Cryptographic Session Management Sessions use a challenge-response authentication protocol: The Family server issues a cryptographic challenge Your device signs this challenge using its stored private key The server verifies the signature before securely delivering your encrypted wallet and session token This ensures that only authorized devices maintain active wallet sessions. Authentication Process Account Recovery: Because Everyone Forgets Most self-custodial wallets simplify onboarding but lack robust recovery options. At Family, we recognize that people forget passwords and lose devices, so we’ve built multiple recovery mechanisms into the system. Device-Based Recovery When logging into a device, critical recovery information is securely stored. If you lose access, recovery is possible as long as you can verify ownership of your email or phone number. By leveraging device storage encryption, every previously authenticated device becomes a recovery tool. Device-Based Recovery Account Recovery Codes Family generates secure recovery codes, similar to backup codes used by platforms like Instagram. These codes can be stored separately, ensuring users can regain access even if they lose everything else. Recovery Process Protection with Limits Family Accounts are truly self-custodial, meaning that if all recovery options are lost, not even Family can restore access. For complete account loss to occur, you would need to simultaneously lose access to all registered devices and forget your password or passkey—an extremely rare scenario given the built-in, multi-layered recovery options. Cross-Chain Compatibility Family’s architecture enables secure asset management across multiple EVM-compatible blockchains, all unified under a single passkey-based authentication and encryption system. User Responsibilities As a self-custodial system, Family Accounts put you in full control of your assets. Securing your devices, passkeys, and recovery credentials is essential. Maintaining access to your registered email or phone number is critical for ensuring smooth account recovery. With Family Accounts, our goal is to make self-custody feel effortless—providing complete control without the usual complexity. If you’re looking for more technical details or need integration support, check out our developer docs or reach out to our team.