The Vision

For thousands of years, humans used bearer instruments for commerce. These were tangible objects like coins, bills and gold that change hands without intermediaries. The holder possesses the value. No bank approves the transaction. No ledger records the transfer. just two people agreeing a trade happened and walking away.

Digital currency was supposed to bring that back. value you could just hand off without asking permission. And blockchain got us closer than anything before it. Privacy coins like Zcash took it further. Shielded amounts, shielded addresses, real cryptographic privacy.

But even then, every transaction still writes to a public ledger. the contents might be encrypted, but the metadata's there. timestamps, transaction graphs, patterns to analyze. it's better, way better... but it's not the same as handing someone a coin and walking away.

So the "digital bearer" idea never really worked.

Until now. This is my attempt.

How It Works

A capsule is a funded Zcash shielded address packaged as a transferable bearer instrument, like a digital $20 bill.

The Capsule Lifecycle

Transfer Method Privacy

Not all transfer methods are equal. Zipher will initially support two ways to send capsules and they exist on a privacy spectrum.

The Privacy Hierarchy

Why Bluetooth Is the Privacy Ceiling

When you transfer a capsule via Bluetooth, value moves between two people with zero third-party involvement.

The capsule travels directly from chip to chip through the air. Encrypted. Ephemeral. The only evidence it happened exists on the two devices involved.

Comparison to Other "Private" Transfers

What Each Method Exposes

Bluetooth (MultipeerConnectivity)

iMessage Extension

The Bottom Line

Zcash shielded transactions protect what happened on-chain.

Bluetooth protects that something happened at all.

There's no record. No log. No server. No blockchain entry until the recipient decides to settle. The capsule exists only on two devices, transferred through air, encrypted, ephemeral.

This is Zipher's core privacy advantage: capsules can move without the network knowing they moved.

Privacy Analysis

Zcash provides world-class cryptographic privacy through ZKPs. Amounts and addresses are completely hidden. But even with perfect cryptographic hiding, metadata remains visible:

This enables sophisticated chain analysis.

How Chain Analysis Works

Chain analysis firms exploit timing correlations. When Alice pays Bob, who pays Carol, who pays Dave, each on-chain transaction creates a timestamp. And analysts use Bayesian inference to link them:

Using pattern analysis across thousands of txs, firms assign 30-50% confidence that this is a single payment chain.

Zipher Eliminates Timing Correlation

Technical Architecture

This section explains why some of the design choices exist. Particularly the ones that might seem restrictive at first glance. Understanding the cryptographic foundation helps the rest of the system make sense.

ZIP32 Derivation Path

Zipher uses ZIP32 hierarchical key derivation at a non-standard path:

m/32'/133'/0'/99'/capsuleIndex'

Properties:

Recovery Phrase Derivation

12-word phrase
    ↓
HKDF-SHA256
    ├── Salt: "com.zipher.wallet.seed.v1"
    └── Info: "zcash.hd.wallet"
    ↓
32-byte wallet seed

Why Phrases Can't Work in Other Wallets

This is the part that might feel like vendor lock-in. That is not the goal. It's the core security model.

If recovery phrases worked in standard Zcash wallets like Zashi or ZecWallet:

The custom salt makes this impossible. Same 12 words, but different derivation = different addresses. Zashi can't see the capsules, can't sweep them, can't double-spend.

Salt Recovery Guarantee

The closed ecosystem raises an important question: what happens to your capsules if Zipher ceases to exist?

I'm committed to ensuring users are never locked out of their funds. The custom derivation salt will be escrowed using a deadman's switch mechanism that automatically releases it if Zipher becomes inactive for an extended period.

Possible mechanisms (to be finalized):

The complete derivation specification, including salt string, HKDF parameters, and ZIP32 path structure will be published to IPFS and GitHub regardless of Zipher's operational status. This ensures any developer can build a recovery tool if needed.

Capsule File Format (.zpr)

The .zpr format is designed for security and portability. The unencrypted header allows recipients to verify basic properties (amount, timestamp) before decryption, while the encrypted payload ensures only the intended recipient can access the spending key.

iOS Security Integration

Secure Enclave Protection

Technical Note: The Secure Enclave only supports P256 curve operations natively. Zcash uses the Jubjub curve for Sapling keys, so Zcash key derivation happens in software from the SE-protected seed. This is pretty standard - SE protects your entropy, and derived keys exist in memory only as long as needed.

Keychain Storage

Security Model

With the technical foundation covered, here's how Zipher actually prevents double-spending. Four layers of defense:

Attack Prevention Example

Trust Model

Now that the tech and security foundations are clear, here's how it actually feels to use Zipher day-to-day.

Like physical cash, capsules require recipient verification. You check a $100 bill before accepting it; Zipher automatically verifies capsules are unspent.

How Verification Works

When you receive a capsule:

Trust Levels

Real-World Scenarios

Craigslist Laptop Sale ($500)

Splitting Dinner with Friends ($30 each)

Backup & Recovery

This is where it gets tricky. Off-chain bearer transfers create a double-spend problem that doesn't exist in normal crypto. The sender still has their 12 words after sending a capsule, so what stops them from restoring and sweeping it themselves?

There are different ways to approach this. Here's what I landed on for now.

The Current Approach

Standard 12-word recovery phrase - familiar to anyone who's used a crypto wallet. Write it down on paper, keep it safe. Same phrase always regenerates the same wallet in Zipher.

7-day time-lock on restore - this is the key tradeoff. When you restore a wallet from your 12 words, you can see everything immediately, but you can't do anything for 7 days. No sweeping, no sending, no creating capsules.

This gives recipients a full week to sweep any capsules you sent them before you could possibly access them again.

Creating Your Wallet

The 7-Day Time-Lock

Why This Approach?

It's not perfect. A 7-day wait after a legitimate phone loss is annoying. But the alternatives have their own tradeoffs, (i.e more complexity, more infrastructure or weaker security guarantees.)

This felt like the right balance for a mobile-first, self-custodial wallet: simple backup that people already understand, with a time-lock that makes fraud impractical without adding servers or trusted third parties.

That said, this isn't set in stone. The 7-day parameter could be adjusted based on community feedback and real-world usage patterns.

Use Cases

Known Limitations

Development Roadmap

Zipher is designed to grow beyond Apple's ecosystem. Here's the path forward:

Why This Matters

A Public Good

Conclusion

Zipher demonstrates that Zcash's exceptional cryptographic privacy foundation can be extended with true bearer instrument properties while maintaining complete self-custody.

Zipher: Digital cash for your pocket.