Safety series · Part 1

Wallets without a seed phrase: what you actually own

By Sui Harbor · Facts checked Oct 22, 2026 · Education only, not financial advice

Short version: On Sui you can open a wallet by signing in with Google or Apple, or with a passkey (Face ID, a fingerprint or your phone’s PIN). There’s no 12-word phrase to write down. You still own what’s in the wallet, and no company can move it for you. But the thing you have to protect changes. Your Google or Apple account, or your phone, is now the key to your wallet.

Read this first. No real wallet, app or support person will ever ask you to type your Google password anywhere except Google’s own sign-in page. Nobody legit needs your recovery phrase either. Sui Harbor will never ask for either one.

1. Sign in with Google, Apple and others (zkLogin). zkLogin is built into Sui itself, not into one app. When you sign in, Sui works out a wallet address from your login. Sui’s docs list Google, Apple, Facebook and Twitch as working on the main network today. The Slush wallet calls this “social login” and recommends it for people new to wallets.

2. Passkeys. A passkey is the same thing many banks and websites now use instead of a password. It unlocks with Face ID, a fingerprint, your device PIN or a hardware key like a YubiKey. On Sui, a passkey can sign transactions directly. The secret part stays locked inside your device or your Apple or Google password manager, and it can’t be copied out.

So what actually holds your stuff?

Same as any Sui wallet: your coins and items live on the Sui network, at your address. The wallet app is a window, not a vault. (That’s the same idea as our Phantom to Slush guide.)

What’s different is what unlocks the address:

zkLogin: two things together. Your login (Google, Apple and so on) plus a hidden number called a salt. Sui’s docs describe this as a “2-of-2” setup. Someone who only gets into your Google account still can’t move your funds without the salt. Neither Google nor the wallet company holds both pieces. Google also never finds out your wallet address.
Passkey: the passkey on your device, or synced through iCloud Keychain or Google Password Manager.

Is it custodial? No. Sui’s docs say plainly that a zkLogin wallet is non-custodial: the login provider can’t make transactions for you.

Recovery: the part nobody explains

This is where seed-phrase-free wallets are different, and where you should slow down.

If you lose your Google or Apple account, you lose that wallet. Sui’s own docs say it directly: you need a working login to use a zkLogin address. There’s no “forgot my seed phrase” backup to fall back on. Protect that account like it’s your bank:

Turn on two-step verification with an authenticator app or a passkey, not text messages.
Keep that account’s recovery email and phone number up to date.
Save its backup codes somewhere offline, like a password manager or paper in a safe place.

Each app can give you a different address. Your zkLogin address depends on the app you signed in through, not just your Google account. The same Google login in two different apps usually means two separate wallets. Signing in with Apple instead of Google also gives you a different wallet. Pick one login and stick with it.

The salt is the app’s job, and it matters. If the salt is lost, nobody can get back into that address, even with the right Google login. Most people never see their salt because the wallet stores it for them. That’s why it’s worth using a well-known wallet rather than a brand-new app you found in an ad.

If you lose your phone (passkey): if your passkey is synced through iCloud Keychain or Google Password Manager, signing in to a new phone brings it back. If it lived only on that one device or one hardware key, it’s gone with the device. Check which kind you have before you keep anything meaningful there.

The belt-and-suspenders option: Sui supports multisig, where a wallet can be unlocked by more than one key. For example, either your Google login or your Apple login could work, so losing one doesn’t lock you out. Not every wallet app offers this yet. If yours does, it’s the closest thing to a backup.

Once wallets look like normal sign-ins, scammers copy normal sign-in pages. Watch for these:

A sign-in window you can’t move or that has no real address bar. Some fake pages draw a pretend Google pop-up inside the website. A real one is a real browser window, and the address bar reads accounts.google.com (or appleid.apple.com for Apple).
A sign-in link that came in a DM, an email or an ad saying your wallet is “locked,” “being migrated” or “eligible for an airdrop.” Close it. Open the wallet yourself.
Anyone asking for a six-digit code from your authenticator app or a text message. Real support never needs it.
Lookalike wallet sites. Type slush.app yourself or start from sui.io/get-started.

Passkeys help here. Sui’s docs note that passkeys are tied to the website that created them, so a fake site with a different address simply can’t use yours. That’s a real advantage over passwords.

What an app can and can’t do once you’re signed in

“Gas-free” or sponsored transactions. Sui lets an app pay the network fee (called gas) for you. That’s why some apps feel free. It’s a convenience, not a permission slip. Per Sui’s docs, the sponsor pays the fee but doesn’t write what the transaction does. Both you and the sponsor have to sign it.

What an app can’t do: move your coins without your approval. Every transaction from your address needs your signature, whether that’s a tap, a Face ID check or a sign-in.

What an app can do: ask you to approve something that’s bad for you. A free fee doesn’t mean a safe transaction. Before you approve, read what the wallet says will leave your account. If it shows more going out than you expected, or you don’t understand it, decline.

Sessions expire on purpose. A zkLogin sign-in only lasts a limited time, and then you sign in again. That’s normal, not a sign that something is wrong.

Quick checklist

I know which login (Google, Apple, passkey) opens my wallet, and I use the same one every time.
That account has app-based two-step verification and offline backup codes.
I use a well-known wallet, opened from its real address.
I check the address bar on every sign-in pop-up.
I read what’s leaving my wallet before I approve, free fee or not.
If my wallet offers a backup key (multisig), I’ve thought about turning it on.

Coming next in this series

Part 2: Passkeys up close: synced vs. device-only, and what happens when you switch phones.
Part 3: Your Google account is now your wallet’s front door: a 15-minute lockdown.
Part 4: Approving transactions without getting drained: how to read what you’re signing.

Disclosures

Sui Harbor is an independent education site. We are not affiliated with, endorsed by or sponsored by the Sui Foundation, Mysten Labs, Slush, Google or Apple. This guide is for education only and is not financial advice. The author holds SUI. Wallet features change, so check the official sources below before you act.