Docs · Private balance
Hold a token without showing how much.
Some tokens on Solana — the tokenized stocks among them — ship with an extension that lets a balance be held encrypted on chain. SwapsPro can use it. Your balance and the amounts you send become unreadable to everyone but you; moving in and out stays visible, and this page is exact about which is which.
What it actually is#
A normal token balance is a number anyone can read. Token-2022's confidential-transfer extension replaces that number with a ciphertext only the account's owner can decrypt, and lets one account send to another with the amount proved correct but never revealed. It is part of Solana itself, not something SwapsPro added — and on every tokenized stock we have read it was already switched on and almost unused.
What is hidden and what is not#
Private is not anonymous. Entering and leaving the private balance is public, the way cash going into a bank is public. What happens in between is not.
| What an outsider can see | Normally | With a private balance |
|---|---|---|
| How many units you hold | Visible | Hidden |
| How much you send someone | Visible | Hidden |
| How much you move in or out | Visible | Visible, at that moment |
| That your wallet holds this token at all | Visible | Visible |
| Who sent to whom | Visible | Visible |
| The issuer's view | Everything | They approve each private account, and may hold an auditor key that reads amounts. Whether one exists is shown on the page, per token. |
Using it#
Open the private balance page, or reach it from any token that supports it — the token page carries a way in, and a holding in your portfolio is marked CAN BE PRIVATE when its mint allows it. That mark is read from the mint itself on every page load, not from a list we keep, so it cannot promise something an issuer has since changed.
- Turn on the private balance. Your wallet signs a fixed message and the encryption keys are derived from that signature. Nothing is stored, by us or in your browser.
- Hide. Moves units from your public balance into the encrypted one. The amount is visible in this transaction.
- Send privately. The only step that hides an amount. It generates three proofs, each in its own account, so it is several transactions and several wallet prompts.
- Reveal. Moves units back into the open, which is what selling needs. Visible again.
Where the keys come from#
One signature over the constant solana-conf-bal/v1 produces both keys. This is the ecosystem's derivation, not ours: the Rust SDK, the Solana CLI and solana-go derive byte-identical keys from the same signature, so a balance created here can be read by any standard client. It is not locked to SwapsPro, and that is deliberate.
Why the first click asks for two signatures
Limits worth knowing before you start#
- The issuer approves each account. Every tokenized-stock mint we have read sets
autoApproveNewAccounts: false, which means the token's issuer decides who may hold it privately. Until they approve yours, deposits are refused by the program and the page says so rather than failing part way through. - Other wallets will show zero. Phantom and Solflare do not display confidential balances. Only an app holding your key can, which is a consequence of the design, not a bug in theirs.
- It costs more transactions. A private send is several transactions rather than one, because each proof is written to its own account before it is used.
- An auditor key, if the issuer sets one, reads every amount. None of the mints we have read has one today. The page shows the answer for the token in front of you.
What it costs#
SwapsPro takes nothing for any of this — there is no swap here, only your own tokens moving between your own balances. You pay Solana's network fees and the rent for the proof accounts, which is returned when they are closed. Swap fees are unchanged and listed in the fee table.