Umbra at a glance

Umbra gives you a private balance on Solana. You can hold tokens in it and pay other people from it, and nobody watching the chain can see who paid whom, how much, or in which token.

Why it existsCopy Anchor Link

Solana is a public ledger. Every balance, every payment and every counterparty can be read by anyone, and stays readable for good. That openness is what lets anyone check the chain, and it is also what makes ordinary financial life awkward to put on it.

A company that pays salaries from one wallet publishes what each person earns. A shop's receiving address shows its revenue and lists its customers. Once a single address is tied to a name, the addresses it pays and is paid by are easy to follow.

Umbra takes the details of a payment off the public record and leaves the rest of Solana as it is. You still settle on Solana, with Solana tokens, and the rules that protect your balance are checked by a Solana program like any other.

How it worksCopy Anchor Link

Using Umbra comes down to four steps. Two of them touch the public record, and two do not.

Deposit. You move tokens from your Solana wallet into Umbra. This is public: anyone can see that your wallet put that amount of that token in.

Hold. From then on the tokens are your private balance. The public record shows how many tokens the Umbra program holds in total, not which of them are yours.

Private Send. You pay someone else who uses Umbra, from your private balance to theirs. The public record shows that a payment happened and when. It does not show who sent it, who received it, how much moved or in which token.

Withdraw. You take tokens out to any Solana address. The address, the token and the amount appear on chain. Who withdrew does not: a relayer sends the withdrawal to Solana, so no wallet of yours signs it, and nothing on chain says which private balance paid for it. That holds as long as the destination is not an address already tied to you in public.

We're not going to pretend nobody saw you walk in. What they can't do is follow you out.

The privacy work happens on your own device. Before anything is sent, your device builds a proof that the payment follows the rules (you own what you spend, and nothing is created out of thin air) without revealing its details, and the Solana program checks that proof. Your keys stay on your device for this. The browser tab has to stay open until it finishes, because the work is running there.

What stays private, and what does notCopy Anchor Link

Who paid whom, how much each payment was, which token moved and which private balance a withdrawal came from all stay private. What is on the public record is that a wallet deposited, with the token and the amount; that tokens were withdrawn to an address, with the token and the amount; that a private payment happened, and when; and which relayer submitted it.

Matching a deposit to a later withdrawal can still be done by guesswork, from amounts and timing. Withdrawing exactly what you deposited, soon after, makes it easy. Privacy practices covers how to avoid that, and how privacy is lost covers the other ways.

Your money stays yoursCopy Anchor Link

Umbra never holds your money. Deposited tokens sit in accounts controlled by the Umbra program on Solana, and no person has a key to them, Umbra included. Only you can spend your balance, because spending needs keys that are made on your device from a signature by your own wallet.

The protocol does have administrators. They can change settings such as which tokens are accepted and what fees are charged, and they can pause parts of the system. Every such change is announced on chain and waits out a delay before it can take effect. The code only requires that delay to be at least one Solana slot, under a second, so how much warning you get depends on the delays the administrators have set. None of those powers can move anyone's balance. The operators of the services every payment needs can also stop payments at once, for example by taking their service offline, and that moves nothing either. The program's code can still be upgraded by whoever holds its upgrade key; governance and upgrades sets out every power and who holds it.

Where to startCopy Anchor Link

If you use UmbraCopy Anchor Link

If you build on UmbraCopy Anchor Link

If you review its securityCopy Anchor Link

Every term used elsewhere on this site has an entry in the glossary.