How each power is read
Everything comes from Solana mainnet, read when you ask (or from a cache: 10 minutes for a wallet, an hour for a token and for the list on the home page). Nothing is signed, nothing is connected, and no transaction is sent.
The chips, and where each one comes from
| Chip | Read from | What it means |
|---|---|---|
| can freeze your tokens | the mint's freeze authority | Its holder can freeze any account of this token, yours included: a frozen account cannot send. "Issuer" on this site means whoever holds this key. |
| can mint more | the mint's mint authority | Its holder can create new tokens at will. |
| can pull tokens out of any wallet | Token-2022 permanentDelegate | Its holder can move or burn tokens from any holder's account without that holder's signature. |
| can pause all transfers | Token-2022 pausableConfig | Its holder can stop every transfer of the token. "transfers are paused now" shows when the switch is on. |
| runs a program on every transfer | Token-2022 transferHook, program set | Every transfer calls the named program, which can refuse it. Whether that program can itself be changed is not read here. |
| can add a program to every transfer | Token-2022 transferHook, authority set, no program yet | Its holder can attach such a program later. |
| takes a cut of every transfer (N%) | Token-2022 transferFeeConfig | Each transfer withholds N% of the amount (up to the configured maximum). The rate for the current epoch is shown, and the next one when it differs. |
| can set a cut of every transfer (0%) | Token-2022 transferFeeConfig, rate 0, authority set | Nothing is taken now; the authority's holder can set a rate. |
| new accounts start frozen | Token-2022 defaultAccountState | A new account of the token starts frozen until the freeze authority thaws it. |
| name and image can change | the metadata's update authority: Token-2022 tokenMetadata and metadataPointer, or the metadata record (mutable flag) | Its holder can change the token's name, ticker and image. |
Each chip names the address that holds the power. Tap it to copy the full address; the token's own page links each one to an explorer and says what kind of address it is:
- a single key: an ordinary account; one private key can use the power.
- a token-program multisig: the token program's built-in multisig; several keys must sign.
- a program-derived address: no private key exists for it; only the program that derived it can sign, often a multisig vault or a protocol's own program.
- an account of program …: an account owned by that program, which decides how it is used.
What you granted
| Line | Read from |
|---|---|
| you approved X to move up to N | your token account's delegate and delegatedAmount: an approval you signed at some point. Your wallet's settings can revoke approvals. |
| someone else can close this account | your token account's closeAuthority, when it is not you |
| this account is frozen now | your token account's state |
| wallet no longer owned by the system program | the owner of your wallet's own account. An ordinary wallet is owned by the system program. A signed Assign instruction hands it to another program, after which your key alone can no longer move its SOL. The line appears only for an address that has a private key (a point on the curve) and is owned by another program; program-derived addresses, vaults, stake and vote accounts are described as what they are, not flagged. |
Other Token-2022 extensions
Decoded into the chips above: freeze and mint authorities, permanentDelegate, pausableConfig, transferHook, transferFeeConfig, defaultAccountState, metadataPointer, tokenMetadata. Every other extension on a mint is listed by name only, under "other": for example mintCloseAuthority (the mint can be closed once its supply is zero), confidentialTransferMint and confidentialTransferFeeConfig (private balances and transfers), scaledUiAmountConfig (the shown balance is multiplied by a factor its authority can change), interestBearingConfig, nonTransferable, groupPointer, tokenGroup.
What it cannot tell you
- Why an issuer holds a power. Most stablecoin and tokenized-stock issuers keep freeze and mint powers; the site shows who holds them, not whether that is good or bad.
- An issuer's off-chain terms.
- Whether a transfer program can be changed: the program is named, not inspected.
- Pre-signed transactions (durable nonces) you may have signed.
- Revoking anything: it only reads. Your wallet's settings can revoke approvals.
- NFTs: they are counted, not checked (an NFT's freeze and mint keys belong to its NFT program by design).
Limits
- A wallet check reads the first 500 token accounts with a balance, and says so when there are more. Empty token accounts are counted, not listed.
- Each visitor can run 20 new (uncached) checks an hour. The site has a daily allowance of chain reads; when it is used up, cached answers and every shared link still open, and new checks resume 00:00 UTC.
- Names and images come from each token's metadata. When they cannot be read, the powers are still complete and the token is listed under "no known name". A name is whatever the token's creator wrote: it is shown as written, escaped, never trusted.
What is kept
- A shared link (
/x/…) stores the counts of one check and its time. It never stores the wallet. Token tickers are included only when you tick "include token names". - A wallet's answer is cached for 10 minutes so a second look costs nothing; it is not written anywhere else.
- Usage is counted as completed checks, once per visitor per day, using a hash of the visitor's IP address with a salt that changes every day (the IP itself is never stored), plus the site that linked to the visit.
The list on the home page
Widely held tokens, each mint address taken from its issuer's own page (the three tokenized stocks from a wallet's verified listing; on-chain they share every key with the xStocks on the issuer's own product list). Their powers are read live, like any other token.
| Token | Issuer | Mint address taken from |
|---|---|---|
| USDC | Circle | developers.circle.com |
| USDT | Tether | tether.to |
| PYUSD | Paxos | docs.paxos.com |
| USDG | Paxos | docs.paxos.com |
| EURC | Circle | developers.circle.com |
| USDe | Ethena | docs.ethena.fi |
| TSLAx | Backed (xStocks) | solflare.com, checked on-chain |
| NVDAx | Backed (xStocks) | solflare.com, checked on-chain |
| SPYx | Backed (xStocks) | solflare.com, checked on-chain |
| JitoSOL | Jito | jito.network |
| mSOL | Marinade | docs.marinade.finance |
| JUP | Jupiter | docs.jup.ag |
| PYTH | Pyth | docs.pyth.network |
| HNT | Helium | docs.helium.com |
| WIF | dogwifhat | its token transparency filing |
None of these issuers publishes its authority addresses on those pages, so no key is named after an issuer: each is shown as the address it is.