KLV Signer 0.1.6 (testnet preview)

KLV Signer 0.1.6 (testnet preview)

A small safety and comfort update. Testnet only for transactions, no independent security audit yet. Built from commit 1d3de34.

Changes since 0.1.5

• Look-alike letters in texts to sign: a word that mixes normal letters with look-alike letters from other alphabets was already refused for Cyrillic and Greek; now also for Armenian, Cherokee, Coptic, Lisu, Canadian syllabics, Georgian and Tifinagh.
• New warning on the text-signing screen: when a text contains letters that aren't plain Latin (another alphabet, or special characters that only look like normal letters, e.g. Roman-numeral or fancy "styled" letters), a yellow warning names them, so you read the text twice. Normal accented letters (ä, é, ł, ı …) don't trigger it.
• The keyboard no longer hides the box you type in: every screen scrolls the password or text box into view when the keyboard opens.
• Behind the scenes: GitHub now runs all automatic tests on every change and every week.

Example app 0.1.5: the keyboard no longer hides its text boxes.

Upgrading: install over 0.1.5. Your wallet stays.

Before you start: KLV Signer is free, open-source software, provided as is, without any warranty. You use it at your own risk. Only use wallets holding funds you could afford to lose. Read every text and transaction before you approve it. Nobody legitimate will ever ask for your recovery words.

Checksums and fingerprints

• KLV Signer APK SHA-256: 49aae277c14eba6b7494a7246a754886e844d88f8031af2498b20d61748ed345
• KLV Signer signing key SHA-256: 82:D0:9D:D7:D3:27:A4:8D:DB:97:EE:05:FE:EC:0A:8C:F4:14:C4:81:7F:0F:B7:26:8B:8A:88:F0:25:7E:86:11
• Example app 0.1.5 APK SHA-256: 83f9e5b13629cfbda23bad7da1487e0efa086854871b622b397c461cca638af4
• Example app signing key SHA-256: D3:A5:AE:6C:38:39:F0:DF:44:42:23:BE:4D:27:0D:7F:04:10:2E:B4:AD:8B:BE:38:68:EA:39:FF:93:C1:A6:AF

KLV Signer 0.1.5 (testnet preview)

KLV Signer 0.1.5 (testnet preview)

A smaller download. Testnet only for transactions, no independent security audit yet. Built from commit 37745fc.

Changes since 0.1.4

• Less than half the size: about 51 MB instead of 117 MB. The Signer is now built for 64-bit phones only (64-bit ARM, nearly every Android phone of the last years). Older 32-bit phones (some very cheap "Android Go" models) and x86 Chromebooks or emulators can't install it any more; Android then says "app not installed".
• Nothing else changed: same screens, same checks, same signing.

Upgrading: install over 0.1.4. Your wallet stays.

Before you start: KLV Signer is free, open-source software, provided as is, without any warranty. You use it at your own risk. Only use wallets holding funds you could afford to lose. Read every text and transaction before you approve it. Nobody legitimate will ever ask for your recovery words.

Checksums and fingerprints

• KLV Signer APK SHA-256: 31e356bb358acafda9afb1236b543084f08a9918429ceb037c956ebd65105469
• KLV Signer signing key SHA-256: 82:D0:9D:D7:D3:27:A4:8D:DB:97:EE:05:FE:EC:0A:8C:F4:14:C4:81:7F:0F:B7:26:8B:8A:88:F0:25:7E:86:11
• Example app: unchanged, see 0.1.3.

KLV Signer 0.1.4 (testnet preview)

KLV Signer 0.1.4 (testnet preview)

A small update. Testnet only for transactions, no independent security audit yet. Built from commit a8b0c30.

Changes since 0.1.3

• Version on screen: the start screen and the unlock screen show which version is installed (handy when an app asks for a newer one).
• Danger zone behind a switch: in Settings, "Remove wallet from this phone" is hidden until you switch the danger zone on (off again each time you open Settings). Removing still needs the word REMOVE typed.
• Used by the Devikins Legacy Hub 4.4.1: the Hub's chat signs in through the Signer (text signing, new in 0.1.3).

Upgrading: install over 0.1.3. Your wallet stays.

Before you start: KLV Signer is free, open-source software, provided as is, without any warranty. You use it at your own risk. Only use wallets holding funds you could afford to lose. Read every text and transaction before you approve it. Nobody legitimate will ever ask for your recovery words.

Checksums and fingerprints

• KLV Signer APK SHA-256: 194c9a5f3124b4f59aff3edfbd2dcdb26db9042b8afa3630a2306a2b9aaf298e
• KLV Signer signing key SHA-256: 82:D0:9D:D7:D3:27:A4:8D:DB:97:EE:05:FE:EC:0A:8C:F4:14:C4:81:7F:0F:B7:26:8B:8A:88:F0:25:7E:86:11
• Example app: unchanged, see 0.1.3.

KLV Signer 0.1.3 (testnet preview)

New: the Signer can sign a short text that isn't a transaction, for example to prove that you hold a wallet when signing in to a chat. Testnet only for transactions, no independent security audit yet. Built from commit 51bd58c.

Changes since 0.1.2

• Sign a text, not a transaction (new): an app can ask the Signer to sign a short text, the way websites use the Klever browser extension's "sign message". The Signer shows the whole text on its own screen, clearly marked "This is not a transaction": nothing is sent, nothing moves, no fee. You approve with your password or fingerprint, with the same safety rules as for transactions.
• Can't be misused as a transaction: texts are signed in Klever's standard message format (a fixed prefix and a different fingerprint method), so such a signature can never be used to move anything.
• Only readable texts: texts with invisible or direction-changing characters, look-alike letters from another alphabet mixed into a word, strike-through or piled-up marks, unusual spaces, many empty lines, or more than 2,000 characters are refused, so what you read is exactly what you sign.
• Developers: new request type SIGN_MESSAGE (SIGNER-PROTOCOL.md, section 3c), including how to check the signature in an Android app.
• Example app 0.1.4: a "Sign a text" card that checks the signature itself; since 0.1.3 also several NFTs (up to 20) in one transaction with one approval.
• Weekly safety check of 26 Oct: no high or medium problems; its small points are fixed (e.g. the phone's Back button on the text screen now answers "rejected"). Report in weekly-reports/.
• Second opinions: the new code was also reviewed by two other AI models (ChatGPT and Gemini). Neither found a way to misuse a text signature or to get around the approval. One suggestion led to a correction in the developer docs (Klever's message format starts with an invisible byte). Details in OPEN-FINDINGS.md.

Upgrading: install over 0.1.2. Your wallet stays.

About using a real wallet for text signing: a signed text works the same for any wallet, so the Signer can sign chat sign-ins for a wallet you use on mainnet, while it still refuses mainnet transactions. That means putting that wallet's recovery words into the Signer. Only do that with a small wallet you could afford to lose: the Signer hasn't had an independent human review yet.

Before you start: KLV Signer is free, open-source software, provided as is, without any warranty. You use it at your own risk. Only use wallets holding funds you could afford to lose. The Signer makes it harder to steal from you, but it can't stop everything: a phone with harmful apps, or someone who tricks you into approving something, can still cost you money. Read every text before you sign it. Nobody legitimate will ever ask for your recovery words. You are responsible for your recovery words, your password and your phone.

Checksums and fingerprints

• KLV Signer APK SHA-256: 8c3aa27f7f6736f8d2dc825126bddabde3ccd0484a5bfff1ecfc05e3e3f2cde0
• KLV Signer signing key SHA-256: 82:D0:9D:D7:D3:27:A4:8D:DB:97:EE:05:FE:EC:0A:8C:F4:14:C4:81:7F:0F:B7:26:8B:8A:88:F0:25:7E:86:11
• Example app APK SHA-256: 4ef56a2a7bf28d984bfae718ea2d996f6d234e942194c99a838b5e8cedcc970a
• Example app key SHA-256: D3:A5:AE:6C:38:39:F0:DF:44:42:23:BE:4D:27:0D:7F:04:10:2E:B4:AD:8B:BE:38:68:EA:39:FF:93:C1:A6:AF

KLV Signer 0.1.2 (testnet preview)

KLV Signer 0.1.2 (testnet preview)

Fixes from the weekly safety checks of 12 and 19 Oct 2026. Testnet only, no independent security audit yet. Built from commit COMMIT.

Changes since 0.1.1

• Accessibility check fails safe: if the Signer can't read which apps have accessibility access (they can read the screen and press buttons), it now signs only with fingerprint or face instead of assuming there are none.
• Android 12 and 13: a detail only newer Android versions have is no longer read there, so those phones can't trip over it.
• Damaged signing history: the extra confirmation now stays for one hour, not only for the first request.
• Weaker passwords refused: patterns of neighbouring keys (e.g. "1234qwerasdf", "!QAZ2wsx#EDC", "123456789abc") are refused as a new password. Your current password keeps working.
• Clearer message: if a new password lock can't be test-opened, the Signer says your password was right and nothing changed (it used to say "Wrong password").
• Release check stricter: only a plain "false" counts as closed when it looks for ways into the app.
• Example app 0.1.2: optional NFT field (e.g. SGNTEST-3UC2/1), shows its version at the bottom, honest comments about what it checks, and a test link that proves the Signer refuses requests passed on by another app.
• History of the safety checks: every weekly report is now kept in the repository (weekly-reports/), and open points in OPEN-FINDINGS.md.

Upgrading: install over 0.1.1. Your wallet stays.

Before you start: KLV Signer is free, open-source software, provided as is, without any warranty. You use it at your own risk. Only use wallets holding funds you could afford to lose. The Signer makes it harder to steal from you, but it can't stop everything: a phone with harmful apps, or someone who tricks you into approving a transaction, can still cost you money. Nobody legitimate will ever ask for your recovery words. You are responsible for your recovery words, your password and your phone.

Checksums and fingerprints

• KLV Signer APK SHA-256: SIGNER_SHA256
• KLV Signer signing key SHA-256: 82:D0:9D:D7:D3:27:A4:8D:DB:97:EE:05:FE:EC:0A:8C:F4:14:C4:81:7F:0F:B7:26:8B:8A:88:F0:25:7E:86:11
• Example app APK SHA-256: EXAMPLE_SHA256
• Example app key SHA-256: D3:A5:AE:6C:38:39:F0:DF:44:42:23:BE:4D:27:0D:7F:04:10:2E:B4:AD:8B:BE:38:68:EA:39:FF:93:C1:A6:AF

KLV Signer 0.1.1 (testnet preview)

Fixes from the first weekly security check. Testnet only (Klever's practice network, no real value). No independent audit yet.

What's new since 0.1.0

• Requests that another app passes on ("forward result") are refused, so a harmful app can't borrow the name of an app you've allowed.
• Look-alike variants of common passwords (Passw0rd1234, qwertyqwerty) are refused; the message says why and how to make a strong one.
• A new password lock is test-opened before it replaces the old one.
• More invisible and right-to-left characters in notes and app names are handled safely.
• A damaged record of earlier signatures now asks for the extra confirmation instead of counting as empty.
• Release check: Android 12+ only, and no extra entry points other apps could reach.
• Example app: checks that the transfer the testnet node prepared is exactly what you typed.

Built from commit 4096152 (tag v0.1.1).

KLV Signer APK, SHA-256:
4fc7ab4653a99eed7df79509dbad1480e8bcbcbaa0b616d4d8c327c2ead04091
Official signing key (SHA-256):
82:D0:9D:D7:D3:27:A4:8D:DB:97:EE:05:FE:EC:0A:8C:F4:14:C4:81:7F:0F:B7:26:8B:8A:88:F0:25:7E:86:11

Example app APK, SHA-256:
c594a6a8681badffc08d73bff02dc1f7dc78510ec2c6be76cb3414fb3af18a6a
Example app key (SHA-256):
D3:A5:AE:6C:38:39:F0:DF:44:42:23:BE:4D:27:0D:7F:04:10:2E:B4:AD:8B:BE:38:68:EA:39:FF:93:C1:A6:AF

Updating from 0.1.0: install over it; your wallet stays.

Before you start
KLV Signer is free, open-source software, provided as is, without any warranty. You use it at your own risk.

• Only use wallets holding funds you could afford to lose. No app can guarantee your funds are safe.
• The Signer makes it harder to steal from you. It can't stop everything: a phone with harmful apps, or someone who tricks you into approving a transaction, can still cost you money.
• Most losses come from scams, not hacks. Nobody legitimate will ever ask for your recovery words. Read every approval screen before you sign.
• You are responsible for your recovery words, your password and your phone. If the words are lost, nobody can recover the wallet.

KLV Signer 0.1.0 (testnet preview)

First public testnet preview of the KLV Signer: a small Android app that keeps a Klever wallet's key and signs transactions for other Android apps, after you approve each one with your password or fingerprint. No app ever sees the key, and the Signer itself has no internet access.

⚠️ Testnet only. No independent security audit yet. Use a fresh test wallet with funds you could afford to lose, never your real one. KLV Signer is free software (GPL-3.0-or-later), provided as is, without any warranty.

Downloads

File	What
klv-signer-0.1.0.apk	The Signer (Android 12+)
klv-signer-example-0.1.0.apk	KLV Signer Example: a small app to try it with (connect, balance, send testnet KLV)
*.sha256	Checksums to verify the downloads
THIRD-PARTY-NOTICES.md	Licences of the open-source packages inside

Verify before installing

• klv-signer-0.1.0.apk SHA-256: 28db047cfe4a57f7d511a1093c830f45f58b4905a484f82dadcdbc20953ab90b
• Signer signing key (SHA-256): 82:D0:9D:D7:D3:27:A4:8D:DB:97:EE:05:FE:EC:0A:8C:F4:14:C4:81:7F:0F:B7:26:8B:8A:88:F0:25:7E:86:11. After installing, Settings → About must say "Matches the official KLV Signer key".
• klv-signer-example-0.1.0.apk SHA-256: dbd89615064f00ae6f264b78b16eadbf0780e3fa5fdc7cd3ea7ab30f069d4a2b
• Example app signing key (SHA-256): D3:A5:AE:6C:38:39:F0:DF:44:42:23:BE:4D:27:0D:7F:04:10:2E:B4:AD:8B:BE:38:68:EA:39:FF:93:C1:A6:AF
• Built from commit 1db246edc09c30d03927641803ea78aa81d6e877 (tag v0.1.0).

What's in it

• Wallet: 24-word recovery phrase (BIP-39, Klever's derivation), password with a deliberately slow lock (scrypt), optional fingerprint/face; stored with the phone's security chip.
• Signing for other apps: "Allow this app?" (with password), every transaction shown in plain words from the Signer's own reading, strict refusal of anything it can't explain, testnet only.
• Extra confirmation rules: large amounts (from 10,000 KLV), new receivers, tokens/NFTs, an app's first request, several transfers, many requests quickly, the same transfer again; you type a random box of the receiver address.
• Phone safety: signing off on rooted or unlocked phones, fingerprint-only while a risky accessibility app is on, screenshots and overlays blocked, no autofill.
• For developers: SIGNER-PROTOCOL.md and the example/ app.

Security overview: SECURITY.md · Latest AI review: REVIEW-2026-10-05.md

Known limits: token and NFT transfers aren't tested on the network yet (no test assets), and there has been no independent human review.

Feedback is very welcome: open a GitHub issue or post in the Klever forum.