The account
A key generated in your browser, with explicit protection and recovery choices.
Most products in this category start with "connect your wallet". strk20.run does not have that step, because it does not have that dependency.
What happens during setup
The first screen offers a new account or an import. A new key is generated only after the person chooses a label, whether to claim it publicly, and how to protect the key. That key signs, decrypts pool notes and recovers the channel keys mail memos are sealed with.
The account contract is then deployed on-chain, because a key cannot sign anything until the account it belongs to exists. Registration follows, and registration is the consequential step — see the auditor.
Protection is a choice
With a password, the account record is sealed under an encrypted vault. A passkey wraps the same vault key and can restore the sealed account record on a compatible device. Both can protect the same account. The exact WebAuthn, vault-key and cross-browser boundaries are mapped in how Passkey works.
If neither option is selected, the key remains in browser storage in plaintext. A script running on the origin or a person holding the unlocked device can read it.
The Recovery File and Recovery Code are issued separately from password or passkey protection. They are verified before registration because the pool records the key once and it cannot be rotated later.
What follows from the unprotected choice: it is suitable only for an amount someone is willing to keep in that browser. It is not a cold-storage design.
One key, two jobs
The same key reads the notes and spends them. There is no reduced-permission key that reveals the balance without also granting spending authority. The refused claims page records the language the product avoids around that limitation.
Registration is sponsored
The onboarding ladder can use the live faucet and current relayer sponsorship allowance. Neither is assumed available forever: when it cannot cover the setup, the screen shows the public address to fund directly. A sponsored registration already recorded on mainnet is in the evidence.