Straight answers.
Is Tilde custodial?
No — and not as a policy, as an architecture. Keys are generated on your iPhone into the hardware-backed Keychain, and Tilde has no server that could hold, freeze, or lose your names. The details, including the tradeoffs of each storage tier, are on the security page.
What is SPV and what does it verify?
SPV (simplified payment verification) means Tilde downloads and verifies proof-of-work block headers itself, over Handshake's encrypted P2P network, then checks name-ownership proofs against them — all on your device. It does not validate every transaction in every block the way a full node does. Verify, don't trust — stated honestly.
What does Tilde's SPV client not verify?
Three things, plainly. It does not validate the transactions in blocks that aren't its own, so it cannot detect an invalid transaction that miners built on. It cannot prove the money supply — that needs a full node. And it follows the chain with the most accumulated work, so an attacker with majority hashrate could in principle feed it a consistent lie. What it can't be fooled about is name ownership: that's an Urkel tree proof checked against a header Tilde verified itself. The full scope, including two gaps in our current implementation, is written up in detail.
Can I bid on name auctions from Tilde?
Yes — the full lifecycle: browse open auctions, place blinded bids, reveal on time with reminders, renew. Tilde's own tildewallet/ was won from the app. Handshake auctions are sealed-bid Vickrey: the winner pays the second-highest revealed bid, not their own. Here's how the phases and blinds work.
What happens if I miss a bid reveal window?
The bid's locked-up value is unrecoverable. A BID output can only ever be spent by a REVEAL, and REVEAL is only valid inside the 1,440-block (~10 day) reveal window — after that the coins are stranded. This is the most expensive mistake in Handshake, so Tilde reveals every bid on a name in one transaction and notifies you before the window closes. A lost blind record is a different, survivable problem: Tilde derives bid nonces the way hsd does, so your seed plus the exact bid amount re-derives the nonce.
How do I renew a Handshake name, and what if I forget?
Renewing is a RENEW covenant transaction that costs a network fee and pays your name's value back to the address it was already on — there is no registrar and no renewal price. The window is 105,120 blocks (about two years) from the name's last renewal. Miss it and the name state clears: your DNS records stop resolving, anyone can open a fresh auction on it, and nobody has the authority to give it back. Tilde computes each name's expiry on your device and notifies you 90, 30 and 7 days out. Full detail here.
What happens if I lose my phone?
Depends on the tier you chose. Guarded: your written seed phrase is the only recovery — no phrase, no wallet, permanently. Resilient / Accessible: sign in to iCloud on a new device and restore. Tilde tells you this tradeoff plainly at setup, before you choose.
Someone sent me a name — why isn't it mine yet?
Handshake transfers stay cancellable by the sender until a FINALIZE transaction confirms. Tilde's receive flow shows exactly where you stand — pending, finalizable, finalized — so a pending transfer can't pretend to be a finished one.
Can the sender cancel a Handshake name transfer?
Yes, at any point before FINALIZE confirms — and cancelling needs no waiting period. This surprises people, so it's worth being exact: a TRANSFER output stays owned by the sender; the recipient's address is only recorded in the covenant. After a 288-block lockup (about two days) the sender can send FINALIZE, and that is what actually moves the name. So a "pending incoming transfer" proves nothing, and you should never pay for a name until it appears in My names. Tilde's receive screen is built around that fact rather than hiding it.
Does Tilde download the whole Handshake chain?
No. Tilde ships with pre-verified bootstrap data pinned to the app — block headers, per-block filters, and an index of live names — so first sync and wallet restore are fast without a full chain download. The packs are verified data, not keys: headers self-validate on open (linkage walk, compiled-in checkpoints, proof-of-work spot checks), and any block the wallet fetches afterwards is still merkle-verified against a proof-of-work-verified header. Restoring matches your addresses against the filters locally, so it reveals no addresses to anyone.
Can I search for Handshake names offline?
Yes — the bundled name index makes search and browse work with no network at all. It's for discovery only: the moment you act on a name, Tilde verifies its real state with a live Urkel proof (including proofs of non-existence), so an offline suggestion can be stale but a bid is never placed on stale state.
How do I visit tildewallet/ or other Handshake sites?
You need a resolver that knows Handshake's root zone — a local hnsd or hsd running as your DNS resolver, an HNS-aware resolver service, or a gateway that proxies HNS names. Without one, your device asks ICANN's root, which has never heard of tildewallet/. To be clear about scope: Tilde is a wallet, not a resolver or a browser — it manages the on-chain records a name serves, it doesn't make name/ links work system-wide. This site is served byte-for-byte at both tildewallet.com and tildewallet/, so you can always reach it either way.
Can I use my own Handshake node?
Yes. "My node" mode takes your own node's address, and the format of what you paste decides the transport — an https:// URL talks to its REST API, while identitykey@host:port connects over Handshake's encrypted P2P protocol. You're choosing whose infrastructure to trust, not which wire protocol to use. A node you configured is never silently swapped for a public one: your node fails loudly rather than falling back.
What is Handshake?
A decentralized naming protocol — a root zone owned by its users instead of a central authority. The full story is on the Handshake page.