Monero wallets have an awkward problem that Bitcoin wallets do not: there is no efficient way to ask the network "which coins are mine?"
On a transparent chain, addresses are visible on-chain, so a wallet can query an index and get an answer in milliseconds. Monero deliberately destroys that capability. Every payment goes to a fresh one-time address that appears in no address book and links to no public identity. Privacy comes precisely from the fact that nobody can look up your balance — and nobody includes you.
Everything about light wallets follows from that single constraint. This article explains the mechanism, then makes an honest accounting of what running your keys through a light-wallet server actually exposes.
We have a stake in this: we operate a monero-lws instance behind our browser wallet. We would rather explain the trade-off accurately than let you assume it is better than it is.
Why scanning is expensive
When someone pays you in Monero, the transaction does not contain your address. Instead the sender generates a stealth address — a one-time public key derived from your address plus some randomness only they know.
To find money sent to you, your wallet must do something laborious. For every transaction, it takes the transaction's public key, combines it with your private view key to compute a shared secret, derives what the one-time address would be if that output were yours, and compares it against the output actually present. Match means it is yours. No match means move on.
That is elliptic-curve arithmetic, repeated for every output of every transaction in every block since your wallet was created. There is no shortcut and no index, because building one would destroy the privacy property.
The result is the sync wait everyone complains about. It is not bad engineering — it is the cost of a chain where balances are not publicly queryable.
This is why restore heights exist. If a wallet knows it was created at block 2,800,000, it can skip everything before that. Guessing badly is the most common cause of "my balance is wrong" — see our restore height guide.
What a light wallet server does
A light wallet moves the scanning off your device and onto a server. You hand over your private view key; the server scans continuously and keeps an index of the outputs belonging to you. When you open your wallet, it asks the server "what do I have?" and gets an answer immediately instead of grinding through years of blocks.
This is the architecture MyMonero pioneered and ran for over a decade, and it is what monero-lws — the open-source light wallet server maintained alongside Monero itself — implements today.
Crucially, the split is not "the server does everything". It is a specific division:
What the server can see
This is the part most light wallets are vague about. Being specific:
Your balance. The whole point of the service is that the server knows which outputs are yours, so it necessarily knows what they add up to.
Your incoming transactions, including amounts. Monero encrypts amounts with RingCT, but the view key is what decrypts amounts sent to you. A view key holder sees each incoming payment's value and the block it landed in.
Your address. Implied by holding the view key.
Timing and behaviour. The server sees when you connect, how often, and from which IP unless you take steps to prevent it. Over time that is a behavioural profile — when you check your wallet, from where, on what schedule.
Which transactions you broadcast. Your browser builds and signs transactions locally, but something has to hand the signed transaction to the network. That is the server, so it sees your outgoing transactions at the moment you send them.
Put plainly: a light wallet server operator can build a fairly complete picture of your incoming financial activity. That is not a bug in a particular implementation — it is inherent to the architecture. Any service that gives you instant balances has your view key, and any service with your view key can see this.
What the server cannot do
The limits are just as real, and they are the reason light wallets are a defensible choice rather than a bad one:
It cannot spend your funds. Spending requires the private spend key, which never leaves your browser. A completely compromised server cannot move a single piconero. This is the difference between a light wallet and a custodial exchange, and it is not a small one.
It cannot change where your money goes. Transactions are constructed and signed on your device. A malicious server could refuse to broadcast, or lie about your balance, but it cannot alter a signed transaction's destination — the signature would not verify.
It cannot deanonymise the rest of the network. Your view key reveals your own incoming transactions. It says nothing about anyone else's, and it does not weaken Monero's ring signatures for other users.
It cannot reliably know what you have spent. This one is subtle and genuinely interesting. Detecting that one of your outputs has been spent requires computing its key image, and key images require the private spend key. A pure view-key observer sees money arrive but cannot always tell what has left. In practice light wallet servers learn about your spends because your wallet broadcasts through them — but the view key alone does not confer that ability.
The security boundary that matters: a light wallet server is a privacy risk, not a custody risk. Getting these two confused in either direction leads to bad decisions — treating it as custodial makes you needlessly afraid, and treating it as private makes you needlessly exposed.
Where light wallets sit among the options
| Setup | Who scans | Who sees your balance | Sync time |
|---|---|---|---|
| Own full node | You | Only you | Hours initially, then instant |
| Remote node | Your wallet | Node sees your IP and timing, not your balance | Minutes to hours |
| Light wallet | A server, with your view key | The server operator | Seconds |
| Custodial exchange | Them | Them — and they hold the coins | Instant |
The interesting comparison is remote node versus light wallet, because people frequently conflate them.
With a remote node, your wallet downloads blocks and does the scanning itself. The node operator learns your IP address and roughly when you sync, but never gets your view key and never learns your balance. It is more private — and slower, because your device is doing the elliptic-curve work.
With a light wallet, the server does the scanning, which requires your view key, which means it learns your balance. Faster, less private.
Neither is "correct". They are different points on the same curve, and the right choice depends on what you are protecting.
Reducing your exposure
If you use a light wallet, several things meaningfully improve your position:
Use Tor or a VPN. This severs the link between your view key and your real IP address. The server still sees your balance but can no longer tie it to a location or to your other traffic. This is the single highest-value step available.
Separate your wallets by purpose. A light wallet for day-to-day spending, a cold wallet for savings. The server then only ever sees a small, uninteresting slice of your finances. This is the most practical advice in this article.
Prefer servers that do not log. You cannot verify this from outside, which is exactly why it should be paired with the next point.
Run your own. This collapses the trade entirely — you get instant sync and nobody else sees your view key. monero-lws is open source and, if you already run a node, adding it is a modest step. We wrote a full guide to self-hosting it, and we publish instructions for running our entire stack so you never have to take our word for anything.
Match the tool to the amount. No amount of technical mitigation makes a hot wallet appropriate for life savings. Cold storage exists for a reason.
Why we run one anyway
Given all of the above, there is a fair question: why operate a light wallet service at all?
Because the realistic alternative for most people is worse. Someone who cannot install software on a locked-down work laptop, or cannot spare 80 GB, or simply needs to check a balance from a phone, does not choose between a light wallet and a full node. They choose between a light wallet and an exchange account — which is fully custodial, sees everything a light wallet sees and holds the coins outright, and can freeze or lose them.
Against that baseline, a non-custodial light wallet is a substantial improvement. The honest framing is not "this is private", it is "this is meaningfully better than the thing you would otherwise do, and here is precisely what it costs you".
That is why we publish the architecture rather than gloss over it, keep the whole stack open source, and document how to run it yourself. If our server is the weak point in your setup, the correct response is to replace our server — and you should be able to.
The summary
- Monero cannot index balances by design, so finding your coins requires scanning every block with your view key.
- Light wallets outsource that scan, which requires handing over the view key.
- The server learns your balance, incoming payments and amounts, plus your timing and IP.
- The server can never spend, never redirect funds, and never weakens anyone else's privacy.
- Tor plus wallet separation removes most of the practical risk.
- Running your own
monero-lwsremoves the trade-off entirely.
A light wallet is a reasonable tool used deliberately, and a bad one used blindly. Now you know which you are doing.