Split it. Spread it.
Know the limits.
Scatter plans how one amount could be broken into many randomised pieces, sent to many brand-new addresses over time. It generates real keys and exact splits in your browser — then shows, honestly, everything an observer can still link.
One source. Many fresh addresses. Over time.
Each run draws fresh randomness from crypto.getRandomValues, generates K real keypairs with crypto.subtle, splits your amount with exact integer maths (no rounding drift), and schedules the delays. Nothing is sent anywhere.
The plan (each row = one fresh address)
| # | send at | amount | address | key ✓ |
|---|
What an observer can still link
Hidden vs. public.
Scatter hides almost nothing from a chain observer. What it changes is the pattern — and only some patterns matter to some observers.
K fresh keypairs
Real keypairs from Web Crypto (Ed25519 where your browser supports it, otherwise ECDSA P-256), each proven with a sign-and-verify self-test.
Randomised pieces
Exponential random weights over exact integers, a floor so nothing is dust, and a remainder spread so the pieces sum to the total exactly.
Scheduled times
Random, Poisson-like, or evenly spaced (deliberately bad, so you can see why a metronome is a fingerprint).
Scorecard
Computed from your plan: amount spread, round numbers, gap regularity, bursts — and the unavoidable fan-out edge.
A chain explorer sees
- one source address paying K new addresses (the fan-out)
- every amount, exactly, and that they sum to the source amount
- every timestamp and the fee payer
- anything those addresses do next
Only you hold
- the K private keys
- the plan itself: the intended K, window and delay style
- the fact that these K addresses are meant to belong together
Known limitations — please read
- This is not anonymity. A global observer sees the source paying all K addresses. Against anyone who follows the source's outgoing transfers, the anonymity set is 1. Scatter reduces trivial linkability at best — for example for someone who looks at a single destination and never traces its funding transaction, which is a very low bar.
- The funding transaction is the link. Every fresh address is created by a transfer from your source. That edge is public and permanent.
- Amounts sum exactly. Conservation of value means the K pieces add up to the source amount. Randomising the pieces does not change that; an observer can verify it instantly (the scorecard shows this).
- Timing re-links. Delays inside a short window, bursts, or evenly spaced sends are easy to cluster. Even random delays still sit right after the source's activity.
- Spending together re-links. If two of these addresses ever sign one transaction, or pay the same destination, common-input and common-destination heuristics merge them — try it by selecting nodes.
- Fees and rent leak too. Each fresh address needs fees (and, on Solana, rent for token accounts). If you fund those from your main wallet, you have drawn another link. This demo does not model fees.
- Nothing is sent. The keys are real keypairs held only in this page's memory; no transfers are made. Ed25519 availability depends on your browser; the P-256 fallback is not a Solana address scheme. Do not use these keys for real funds.
- Running a plan for real needs a scheduler that holds keys or signs on a timer — a custody and operational-security risk this demo does not address.
- Unaudited, demo-grade, no statistics. No usage numbers or effectiveness claims are made. Follow the laws and tax rules that apply to you.
What exists, what doesn't.
If it isn't live, it says Coming Soon. There is no token, no deployed program and no audit.