# Morphit — complete FAQ (English) > Non-custodial peer-to-peer fiat↔BTC/XMR/BLURT/USDT/USDC/DAI/BCH/LTC/DASH/DOGE/ZEC/ARRR/DCR/SOL/ETH/XRP marketplace. > No KYC. No custody. No arbitration. Federated, open-source. > Translations available at https://morphit.io/faq?lang= > where ∈ {en, es, de, pl, fr, it, ru, fa, zh-CN, zh-HK}. --- ## Why does Morphit use the AGPL-3.0 license? **FAQ key:** `why_agpl` So that nobody — not a company, not a government, not even us — can take Morphit, lock it up, and quietly turn it against the people using it. **The one rule it adds.** If you change Morphit and let people use your changed copy over the network, you must offer them its source code. Everything else is allowed: run your own instance, rebrand it, add features, charge for it. You just can't run a *secret, modified* version — which is how anyone can check that a site runs real Morphit and not a backdoored look-alike. **Why not a looser license?** Permissive licenses (MIT, BSD, Apache) would let anyone close the code, add hidden tracking, and sell it back as a surveillance app. The plain GPL has a gap for websites: its sharing rule applies when you hand out the program, not when you run a changed copy on your own server — which is exactly how Morphit is used. The AGPL closes that gap. No license at all is worse: the law then reserves all rights, so nobody could legally fork it. **For agorists.** Yes, copyright is a tool of the State. Copyleft turns it against enclosure: every fork stays open, every instance stays checkable. So fork Morphit, run an instance, and talk three friends into running more. *Morphit is licensed under the GNU AGPL, version 3 or later. This is our reasoning, not legal advice.* --- ## What is Morphit? **FAQ key:** `what_is_morphit` Morphit is a peer-to-peer marketplace where people trade cash for cryptocurrency (XMR, BTC, BLURT, USDT, USDC, DAI, BCH, LTC, DASH, DOGE, ZEC, ARRR, DCR, SOL, ETH, and XRP) directly with each other. You can barter goods and services too. Morphit never holds your cash or coins, and never asks who you are. Think of it as a public bulletin board for trades (a decentralised bulletin board service, or DBBS) — not a bank or an exchange. --- ## Is it safe? **FAQ key:** `is_it_safe` Safer than sites that hold your funds, because Morphit can't lose, freeze or run off with funds it never has. The coins go straight from one trader to the other. The real risk is the person you trade with, and nobody can reverse a trade that goes wrong. So before you trade, open their profile and check their reputation: completed trades, star rating, written feedback, and when they last traded. A green sprout 🌱 next to a name means "New trader": fewer than 4 completed trades. An account name is all Morphit knows about who anyone is — @scooby or @dingleberry, it doesn't matter. Reputation is earned by trading honestly. With someone new, start with a small trade. --- ## How is Morphit different from LocalBitcoins or LocalMonero? **FAQ key:** `vs_others` LocalBitcoins (closed 2023) and LocalMonero (closed 2024) were companies. They held your coins in escrow during a trade, and their staff settled disputes. When they shut down, their users' reputations and trade history went with them. Morphit works differently: • **No custody.** Morphit never holds your coins. The seller sends straight to the buyer. • **No company to shut down.** Orders, feedback and encrypted chat live on the Blurt blockchain. Anyone can run an instance, and instances can be reached over the normal web, Tor, I2P and Lokinet. • **Private chat.** Messages are end-to-end encrypted on your device. Operators can't read them. • **Your account is yours.** Your keys stay in your browser, and your 12-word seed opens your account on any device or instance. **The trade-off:** no escrow, no arbitrator, nobody to appeal to. Feedback is signed and permanent, so a scammer's record follows them forever — but nothing protects you from a first-time scammer. Check reputation and start small. Morphit will never add escrow or arbitration: that would bring back the middleman it exists to remove. --- ## How is Morphit different from BasicSwap? **FAQ key:** `vs_atomic_swap_dexes` BasicSwap is a kindred no-middleman project to Morphit: it does atomic swaps (a coin-for-coin trade that either completes for both people or not at all) directly between two crypto wallets, with no escrow and no central server. We share the principle; the trade-offs differ. • **Install vs. browser.** BasicSwap is a desktop app that usually runs a full node for each coin, which can take hours or days to sync. Morphit is a web page — nothing to install. • **Both online vs. any time.** A swap needs both people online until it finishes, and the coins stay locked until it does. If the other side disappears, you wait for a refund timer. On Morphit you post an order and the other person answers whenever they're ready. • **Crypto only vs. cash too.** BasicSwap trades coin for coin. Morphit also does cash, payment apps and barter. • **Reputation and chat.** BasicSwap has neither. Morphit has signed on-chain feedback and encrypted chat. On 14 July 2026, BasicSwap was exploited for more than 0.66 BTC (about $42,000), as confirmed by its own developer and by Orangefren. We mention it so you can choose with the facts, not to gloat: Morphit never holds your coins, so there is nothing to drain. Software can have bugs, but they are constantly being scanned for. Both designs are valid. They suit different people. --- ## How is Morphit different from Bisq or Haveno/Retoswap? **FAQ key:** `vs_bisq_haveno` Bisq and Haveno (and Haveno's fork RetoSwap) are the closest projects to ours in spirit: non-custodial, peer-to-peer, no KYC. Haveno is a fork of Bisq, so they work much the same way. The main differences: • **Desktop app vs. browser.** Bisq and Haveno are desktop apps. Morphit runs in any browser, phones included, with nothing to install. • **Escrow vs. reputation.** On Bisq and Haveno, both traders lock coins plus a security deposit in a multisig escrow (2-of-3 on Haveno), and arbitrators settle disputes. Morphit has no escrow, no deposit and no arbitrator — you rely on the other trader's signed, on-chain reputation. • **More to trade.** Every Haveno trade involves Monero. Morphit trades many coins, plus cash and barter. • **More ways in.** Morphit instances can be reached over the clearnet/normal web, Tor, I2P, ENS and Lokinet. An escrow-and-arbitrator safety net is also something to attack. Haveno's trade protocol was exploited on 20 May 2026 (about $2.7 million, using a forged arbitrator message) and again on 16 June 2026 through its dispute process (about 1,500 XMR, by early estimates). RetoSwap paused trading both times. Bisq has also been hacked in the past, with user funds stolen. Morphit has no arbitrator, escrow or dispute payout for attacks like these to target. The price is that you alone decide who to trust. Reputation is everything. --- ## How is Morphit different from OpenMonero? **FAQ key:** `vs_openmonero` OpenMonero (a LocalMonero clone) is custodial: it keeps users' coins in its own wallet — and it has lost them again and again. On 6 June 2025, a server misconfiguration let attackers drain about 77.85 XMR (about $25,225). On 21 May 2026 it posted a new exploit alert and told users to stop all payments. On 8 June 2026 an attacker took over its server and took about 200 XMR, which its operator said was all of the platform's funds, and on 24 July 2026 another flaw drained about 112 XMR more (122 XMR in his later count). By the operator's own count, these drains cost 399 XMR. On 20 October 2026 he told his community that 150 to 200 XMR of refunds are still pending, owed to four vendors, and that he needs more fees before he can pay them back. Server hardening added since protects a wallet that is still there to lose. Morphit keeps no wallet of users' coins. The seller sends XMR straight to the buyer, so there is nothing on a Morphit server to drain or freeze, and no operator who could vanish holding your coins. We are fully open source with no hidden code: everything that runs in your browser is published and can be checked. OpenMonero obfuscates parts of its code, so you can't fully check what it does with your funds. --- ## Is there a video tutorial? **FAQ key:** `video_tutorial` Yes. Short video tutorials are posted on [blurt.media](https://blurt.media), a video site on the Blurt network — search for "Morphit". We link out instead of embedding: Morphit doesn't embed videos or other sites, and some video players share video peer-to-peer, which can show your internet connection to other viewers. If that worries you, watch through a VPN or Tor Browser. --- ## What do I need to sign up? **FAQ key:** `signup_requirements` Nothing personal. No email, no phone number, no name, no ID. • Your browser makes your account keys right on your device. They never leave it. • Write down your 12-word seed on paper. It's your master key to get back into your account on a new device — nobody else can restore it. • Pick a public account name (3–16 lowercase letters, digits or dashes, starting with a letter). It's free: Morphit pays the Blurt network cost. That's it. --- ## How do I buy crypto? **FAQ key:** `how_to_buy` 1. Open the orderbook and filter it by the coin you want. 2. Pick a seller with a good reputation, open their order and tap **Message**. 3. In the chat, agree on the amount, the price and how you'll pay — cash, a payment app, goods, whatever you both accept. 4. Tap **Share crypto address** to send the seller your wallet address. 5. Pay the seller as agreed. Once they have your payment, they send the crypto straight to your wallet. 6. Leave each other feedback. Done! Morphit never holds anything in between, so choose sellers carefully and start small. --- ## How do I sell crypto? **FAQ key:** `how_to_sell` 1. Tap Post, choose **I want to SELL**, and pick the coin — Monero, for example. 2. Set the value range and price, tick the payment methods you accept, and optionally add your location. 3. When a buyer messages you, agree on the details in the chat. 4. Once you've really received their payment, send the crypto to the address they share in the chat (the **Pay now** button sends or records it). 5. Leave honest feedback — it helps everyone. Your very first order must be a buy of BLURT, and it's usually free (see "Is my first order really free?"); after that you can post sell orders. Posting costs a small listing fee — see "What are the fees?". --- ## What are the fees? **FAQ key:** `fees` **Morphit never takes a cut of your trade.** The price you agree is the price you get, and Morphit never touches your funds. **Posting an order costs a small listing fee:** • About **$0.125** (in US-dollar value) if you pay in BLURT — half price. • About **$0.25** if you pay in BTC or XMR, where this site accepts them. The post screen shows the exact amount before you sign. BLURT is the default (Morphit runs on the Blurt blockchain), and BLURT-paid fees count toward loyalty rewards (see "How do loyalty rewards work? (The BP milestones I saw mentioned)"). **Your first order is free** — it's a buy of BLURT. See "Is my first order really free?". **Lots of orders cost more (BLURT only).** Counting the orders you have live or posted in the last 24 hours, the first 3 cost the base fee. From the 4th, each costs 25% more than the one before, and 50% more after the 10th. This stops spammers; the post screen shows your tier. BTC and XMR fees stay flat. **Optional extras:** • A featured slot at the top of the orderbook: you bid BLURT per hour, for at least 6 hours. • Messaging someone about one of their live orders is free, and so are all replies. A first message to anyone else costs 5 BLURT (more if you message many strangers within a few minutes). Blurt itself also charges a tiny network fee on each transaction. --- ## Can I trade goods or services on Morphit, like fruit trees or vintage records? **FAQ key:** `trade_goods_services` **Yes — and for some people this is the whole point of Morphit.** If you're unbanked, living under capital controls, or watching your currency lose value, turning your goods and your work straight into hard money — without asking a bank's permission — is a lifeline. That's counter-economics in practice. **Two ways to do it:** • **Sell goods or services for crypto.** Tap Post, choose **I want to SELL**, and pick **BARTER** as the asset. Set its value in your local currency, tick the cryptos you'll accept, and describe your offer in **Terms**. One listing covers every coin you accept. • **Pay for crypto with goods.** On a normal order — say, **I want to BUY** Monero — add **Barter (goods/services)** as a payment method and describe your offer in **Terms**. *Example Terms:* "$20 per orange tree, 1–2 m tall. Pick up at my farm, or I'll ship for $5 more per tree." Or: "I'll come and wash your car for $30. Wax is $20 extra." **The one rule:** one side of every trade is a coin that Morphit supports. That's what lets honest traders build a reputation that travels with them. --- ## How do I trade cash by mail or ship physical goods through Morphit? **FAQ key:** `cash_by_mail_walkthrough` It works like any other Morphit trade, plus two chat buttons. They show up when the chat is about a live order that accepts **Cash by mail**, **Barter (goods/services)** or **Precious metals**. **Share mailing address** — for the person sending the crypto. Fill in country, street, city and postal code (name, apartment, state and a note are optional). Only the two of you can read it (end-to-end encrypted), but once sent, your partner has it for good — a P.O. box or mail-drop is safer than your home address. **Record shipment** — for the person mailing the cash or goods. Pick the carrier (or Other), enter the tracking number from your receipt, and add a note if you like. Your partner sees a **Shipped via** card with a **Track package** link. **Safety tips:** • Use a tracked, insured service and a plain envelope or box. • Mailing cash? Wrap it in aluminum foil, and use the postal service — UPS and FedEx forbid cash. Never lie on customs forms. • Sellers: look up the tracking number on the carrier's site and check it's headed to *your* ZIP or postal code. A scammer can paste someone else's number. • Send the crypto only after the package arrives and you've counted it. **Limits:** Morphit can't settle disputes or reverse anything. Lost mail without insurance is simply lost. If someone takes your cash and never pays, leave honest feedback to warn others. Start with small trades. --- ## How long do orders stay open? **FAQ key:** `order_timeouts` You choose when you post: 1, 3, 7, 14, 30, 60 or 90 days. The default is 90 days; a free first order runs for 7 days. When the time is up, the order expires and leaves the orderbook. You can cancel an open order at any time, and you have 15 minutes after posting to fix mistakes (see 'Can I fix or cancel an order after posting?'). When an order has expired or you cancelled it, the **Re-list this order** button in [My orders](/my/orders) fills in a new order with the same details for you to check. A re-listed order is a new order, with a new listing fee. How long the trade itself takes is up to you and your trade partner. Morphit sets no deadline; you agree on it in the chat. --- ## Can I fix or cancel an order after posting? **FAQ key:** `order_editing` **Fixing:** for 15 minutes after posting, Morphit lets you edit an order from [My orders](/my/orders): amounts, price, payment methods, region and terms. Editing is free. You can't change buy or sell, the coin or the currency; for that, cancel and post a new order. After 15 minutes the order is locked. **Cancelling:** you can cancel an open order at any time. Why only 15 minutes? It is enough to catch a typo, but too short to lure buyers with one price and quietly change it later. Nothing is erased: the blockchain keeps the original, every edit and the cancellation, so anyone can check an order's history. --- ## Are my chats private? **FAQ key:** `chat_privacy` What you write in Morphit's encrypted chat is private. Messages are end-to-end encrypted: only you and your trade partner can read them. Not Morphit, not the operator, not anyone reading the blockchain. What others **can** see, because chat is stored on the public Blurt chain: • who and when (@scooby chatted with @alice yesterday) • which order a chat is about • roughly how long each message is • when you read a conversation (read receipts) • whom you block There is no forward secrecy: anyone who later gets your keys can read your past messages. For very sensitive talk, use a dedicated messenger such as **Signal**, **Session** or **Matrix/Element**. The tech: X25519 key agreement that mixes a fresh one-time key per message with both people's long-term keys (which proves who sent it), ChaCha20-Poly1305 encryption and BLAKE2b, all from libsodium. --- ## Why does Morphit randomize my transfer amount? **FAQ key:** `monero_amount_jitter` So nobody can match your payment to your order. If an order says 0.005 BTC and exactly 0.005 BTC appears on the blockchain, anyone watching can link the two. So when you share your receiving address in the chat, Morphit adds a tiny random extra ("jitter") to the amount the buyer should send. The seller always gets slightly **more**, never less. Monero hides amounts on its chain, but the figure still travels through chats, screenshots, wallets and exchanges. The extra helps there too. The extra is at most: • XMR: 0.000000999999 • BTC, BCH, LTC, DASH, DOGE, ZEC, ARRR, DCR: 999 satoshis (0.00000999) • ETH, XRP, USDT, USDC, DAI: 0.000999 • SOL: 0.000000999 • BLURT: 0.099 It is on by default; the switch is under the amount when you share your address. Turn it off only when you must send an exact figure, such as an invoice. It does not protect against USDT or USDC freezes; see the [privacy guides](/privacy) for each coin. --- ## Can feedback be edited or deleted? **FAQ key:** `feedback_immutable` No. Once posted, a review stays on the blockchain for good. Nobody can quietly change or erase it: not you, not the reviewer, not Morphit. That is what makes a reputation worth something. If someone reviews you unfairly, you can post a public reply under it. The review stays, but everyone can read your side. **If people are going to trust you, your reputation is everything.** --- ## What data does Morphit collect about me? **FAQ key:** `data_collection` Very little, and nothing about who you are. No phone number, ID, cookies, analytics or tracking, and no email address unless you give one for Offline Notifications. What does exist: • **Your IP address.** It reaches the server as on any website. Morphit's code keeps it in memory only, for rate limits (at most 24 hours), and never writes it to disk. • **What your browser asks for.** Orders, chats and the things you send go through this site's server, so its operator can see which accounts and orders you look at, and your signed actions before the blockchain does. • **What you publish.** Orders, reviews and chat messages (encrypted, but with sender, recipient and time) are public on the Blurt chain. • **Push notifications**, if you turn them on: the site keeps your account name with your browser's push address until you turn them off. • **Offline Notifications**, if you turn them on: the site keeps the address you gave for them (email, Matrix, Session, XMPP or Telegram), encrypted, until you delete it. --- ## What if I lose my password or recovery seed? **FAQ key:** `lost_keys` Nobody can recover your account for you: not Morphit, not the operator. That is on purpose. A recovery button would mean someone else holds a copy of your keys. • **Forgot your password?** Sign in again with your 12-word recovery phrase and pick a new password. • **Lost your 12 words, but still signed in somewhere?** Open [Back up my keys](/backup-keys) now and write them down again. • **Lost both?** The account is gone for good. You'll need a new one. Signed in with an existing Blurt account? Then your backup is your Keyfile (with its password) or your Blurt keys. Lose them and no one can restore them. --- ## Why did Morphit choose the Blurt blockchain? **FAQ key:** `what_is_blurt` Morphit needs a public notice board that nobody owns. Orders, reviews and chats must be readable and checkable by anyone, without trusting one company's server. Blurt is a social blockchain built for exactly this kind of public, signed data. Why Blurt fits: • **Fast.** A new block about every 3 seconds, so new orders show up in seconds. • **Cheap.** Each action costs a tiny BLURT fee, with no bidding wars over fees. (The listing fee is set by Morphit, not by the chain.) • **Anonymous but accountable.** Accounts need no email, ID or real name, yet every review is signed and permanent, so nobody can forge or erase someone's record. • **No central server.** Every Morphit site reads the same chain and shows the same orders. If one site closes, the orders are still there. • **Room for private chat.** Morphit stores chats on Blurt as encrypted messages that only you and your trade partner can read. Why not Monero? It hides data by design, which is great for money but wrong for a public orderbook. And on chains with busy fee markets, posting every order and message would cost far more. --- ## What is the most private way to sign in? **FAQ key:** `privacy_mode` Sign in for this session only, a kind of privacy mode. Pick **Seed phrase every time (most private)** when you set up, or **keep me signed in just for this session** when you sign in with your 12 words. Then nothing is saved on the device. Your keys stay only in memory, in this browser's open Morphit tabs, and are gone once you close them. Next time, you type your 12 words again. Use this on shared or public computers. The other choice, **Password (fast)** or **Remember me**, saves your keys on this device, encrypted with a password you pick, so you can unlock quickly next time. They stay until you **Sign Out**. In a session-only sign-in, your chat read marks and recent chat partners are kept in that tab only, too. --- ## Can I use a VPN to access Morphit? **FAQ key:** `use_vpn` Yes, and we recommend it. A VPN hides your real location from this site, and hides from your internet provider which sites you visit. Our favorite is Mullvad (mullvad.net), and they accept Monero too. One tip: new accounts are limited each day per internet connection (2 by default), and many VPN users share one connection. If sign-up says the daily limit is reached, switch to another VPN server and try again. --- ## How much activity is there on Morphit right now? **FAQ key:** `activity_level` See the [stats page](/stats). It shows active orders, total orders, trades (all time and the last 30 days), and how many coins and currencies have orders right now. A trade counts once it gets a review (once, even when both people review each other). The numbers come from this site's indexer reading the public Blurt chain. Every order is a signed record on that chain, so anyone can recount them with their own indexer, without asking anyone's permission. The same numbers are available as JSON for dashboards. --- ## How does Morphit stop fake reviews? **FAQ key:** `sybil_protection` In three ways: • **A review needs a real conversation.** You can only review someone you have actually chatted with: at least 2 messages each way, over at least 15 minutes. Nobody can review themselves. • **Orders cost money.** Each order has a small listing fee. Paid in BLURT, the fee climbs fast from your 4th order that is open or posted in the last 24 hours. Fake orders get expensive. • **Suspicious patterns don't count.** The indexer looks for accounts that seem to be the same person, such as two accounts swapping 5-star reviews or a group of new accounts ganging up on someone. Their reviews are marked 'Not counted toward the rating', and a pair already caught swapping reviews can't post new ones. --- ## Can I use Morphit without JavaScript? **FAQ key:** `no_js` Only partly. With JavaScript off you can read pages with fixed text, like the security page, the glossary and the run-a-node page, and the list of FAQ questions. The FAQ answers, the privacy guides, the orderbook, profiles, reviews and chat are loaded by JavaScript, so without it they stay empty. To follow orders without JavaScript, use the RSS feeds in any feed reader (see 'Can I follow Morphit with RSS?'). Trading needs JavaScript because all the cryptography (your keys, signing, chat encryption) happens inside your browser. Doing it on a server would mean the server holds your keys, and Morphit refuses to do that. --- ## Can I follow Morphit with RSS? **FAQ key:** `rss_feeds` Yes. There are three feeds, each in three formats: RSS (`.xml`), Atom (`.atom`) and JSON Feed (`.json`). Click an orange RSS button on the site to copy a link, then paste it into any feed reader. No account needed. • **All orders:** `/rss/orderbook.xml`, the 50 newest live orders. The button is in the footer. • **One coin:** `/rss/orderbook/by-asset/btc.xml` (or `xmr`, and so on). Pick a coin on the orderbook; the button sits next to **Clear filters**. • **One trader:** `/rss/orderbook/by-account/@alice.xml`. The button is on their profile, below their orders. If you set filters on the orderbook (buy or sell, currency, payment method…), the feed link includes them. Privacy: the feeds show nothing that isn't already public on the chain. But someone watching your connection may see which feed you check. A trader's feed shows you follow that trader, and a filtered link shows what you are looking for. Use Tor if that matters to you. --- ## Why should I use a new receiving address each time? **FAQ key:** `why_fresh_addresses` So your trades can't be linked together. On public chains like Bitcoin, anyone can look up an address. If you use the same one for every trade, a stranger can add up all your trades: how many, when, and how much. Monero hides addresses on its chain, but everyone you give the same address to can tell the payments go to the same person. A new address for each trade breaks that link. Your wallet makes new addresses for free, usually in a click or two. • **Monero:** use a new subaddress (it starts with 8) for each trade. Morphit also accepts a main address (starts with 4), but shows a tip suggesting a subaddress. • **Every coin:** Morphit won't block a reused address, but if you shared it from this device before, you'll see a warning. That check stays on your device. --- ## Who runs Morphit? **FAQ key:** `who_runs_it` Morphit is the open source software that runs this site and anyone can run a copy of it. The morphit.io site for example, is run by Agorise, the Dev Team of the software. The design assumes that any one site may go offline which is why this site is syndicated, push-mirrored and federated across multiple networks like Tor and I2P. Orders, reviews and encrypted chats live on the Blurt chain, so other sites (on the clearnet (normal web), Tor, I2P, ENS or Lokinet) read the same data, and your keys work on any of them. --- ## Can I run my own Morphit? **FAQ key:** `run_your_own` Yes, and please do. Morphit only stays unstoppable if many people run it. One install gives you everything: • **The website:** at your own domain, at a .onion or .b32.i2p address, or all of them. • **An indexer:** reads the Blurt chain, serves orders, chats and profiles to your visitors (also as an API and RSS feeds), and talks to the other Morphit sites. • **A relay:** creates Blurt accounts for your new users and sends push notifications. Your relay pays about 104 BLURT for each new account. You need an Ubuntu 24.04 server: a cheap VPS or an old PC with 2 CPUs, 4 GB of RAM and 80 GB of disk. One command installs it, and a wizard asks a few questions; docs/RUN-A-MORPHIT-NODE.md walks you through it. You earn 90% of the BLURT listing fees paid on your site. **Going fully hidden:** a node can run with no clearnet at all. Everything goes over Tor and I2P, and a firewall rule blocks the rest. The directory then shows "Zero use of clearnet internet", which is the node's own claim that others cannot check. Start a hidden node with fresh keys and a fresh operator account, so it can't be linked to an old clearnet site. --- ## Is Morphit vulnerable to hacking, data theft, or takedowns? **FAQ key:** `security_attack_vectors` The design leaves little to attack. • **No key database.** Your keys are made in your browser and never sent to a server. • **No logins to steal.** There are no server-side accounts, passwords or sessions to phish or hijack. • **No personal data.** No KYC, and IP addresses are kept in memory only, for rate limits. • **Nothing central to take down.** Orders live on the blockchain. If one site closes, every other site or indexer still shows them. **For the technically minded:** inputs are checked and size-limited; database queries are parameterised; the Content-Security-Policy lets scripts load only from the site itself (no inline scripts, no eval; only WebAssembly, for the cryptography); other websites can read public data only, never with credentials, and every write must be JSON; the relay checks which site a signup came from, and sends push notifications only to allowed push services (the browser makers', plus any the operator adds). No PHP, no WordPress, no OAuth. Floods meet per-client rate limits and size caps; a huge DDoS is for the hosting provider to absorb. One honest limit: the operator serves the page code, so a hostile operator can get around these defences. Pick operators you trust. The full threat model is in docs/SECURITY.md and docs/audit/. --- ## How rigorous is Morphit's security review process? **FAQ key:** `security_engineering_rigor` Security here leaves a public paper trail. • **Published threat model.** `docs/audit/` holds the current STRIDE matrix, attack tree and red-team narrative. Each threat says what the code does, whether a named test proves it, and what is still open and why. • **Open source.** Morphit is AGPL-3.0, at git.agorise.net/agorise/morphit. Anyone can read it, run its tests and send fixes. We assume the attacker has read every line. • **Little to leak.** No KYC, email, phone or session cookies. Keys are made and encrypted in your browser, and chat is end-to-end encrypted. IP addresses stay in memory only, for rate limits. What is public on chain is listed in `docs/METADATA-LEAK-CATALOG.md`. • **Monero.** Morphit never holds your XMR, never asks for a view key and never sends your transactions. A transaction key is published only when you pay a listing fee in XMR, so anyone can check that payment. • **No security by secrecy.** Rate limits, fees and what it costs to make fake accounts are all written down (`docs/OPERATIONS.md`, `docs/FEES-AND-REWARDS.md`). **Found a vulnerability?** Send a private Matrix message to **@agorise:matrix.org**. Never post details in a public issue, a chat room or on chain. An engineer answers every actionable report, and findings that materially improve security are rewarded in BLURT or BTC, scaled to severity. Details: the [security page](/security#bounty) and `docs/SECURITY.md`. --- ## How can I help make Morphit unstoppable? **FAQ key:** `help_make_unstoppable` Every independent site makes Morphit harder to stop. Ways to help: • **Run your own site.** See 'Can I run my own Morphit?'. Blocking one site does little when many others exist. • **Add a hidden address.** A .onion, .b32.i2p or .loki address lets people reach Morphit where the normal web is blocked. These need no certificate and no domain name. • **Point an ENS .eth name at your site**, usually through a copy on IPFS, so people can reach it at a decentralized name like `yourbrand.eth`. It shows up as an extra button in the footer. • **Fund a site.** Send BLURT to an operator's relay account. Each new account costs the relay about 104 BLURT, so 500 sign-ups a week need about 52,000 BLURT. • **Spread the word.** Tell your communities, write a blog post, make a tutorial. • **Translate or improve the docs.** The code is open (AGPL-3.0): send a pull request at git.agorise.net/agorise/morphit. There is no central company to pressure. Everyone who runs a piece of Morphit makes that stronger. --- ## Why doesn't trading with myself work to boost my reputation? **FAQ key:** `why_self_trading_fails` Because it costs real money and hardly helps your reputation. • **Every listing costs a fee:** about $0.125 in BLURT or $0.25 in BTC/XMR. It goes to the site and the Morphit project, not to your other account. A trade only adds to your trade count when its listing was paid for. (Your one free first buy counts too, but only for you.) • **Lots of orders cost more.** If you post many orders in a day (or keep many open), each BLURT-paid listing after the 3rd costs more: the 4th costs 1.25×, the 10th about 4.8×. • **One partner counts once.** However many times the same account reviews you, only its latest review counts toward your score. • **Fake pairs get spotted.** Morphit looks for accounts that seem to be one person: made by the same creator and first used minutes apart, swapping 5-star reviews only with each other, or aiming most of their reviews or trades at one account. Reviews and trades between flagged accounts don't count, and a warning can show on the profile. Honest trading is cheaper, and it actually works. --- ## Can I register many accounts through Morphit to spam the orderbook? **FAQ key:** `why_multi_accounts_fail` You could try, but it's slow, it costs you, and it's easy to spot. • **Signups are limited.** Each new account costs the site about 104 BLURT (Blurt's 100 BLURT account fee plus 4 BLURT to get started). So by default Morphit allows 2 signups per internet address per day, at least an hour apart, and the operator sets a daily cap for the whole site. Making accounts on Blurt yourself costs you the same account fee. • **Orders cost money.** Each account gets just one free first buy. After that every listing costs about $0.125 in BLURT or $0.25 in BTC/XMR, and BLURT-paid fees climb after the 3rd order in a day. • **The welcome bonus can't be grabbed at signup.** Each account gets it once, and only after paying for a listing and being reviewed on it by a chat partner. • **Linked accounts get flagged.** Reviews and trades between accounts that look like the same person don't count toward reputation. We publish these rules openly. Being a real trader is always the easier path. --- ## What is Blurt and why does Morphit sometimes mention it? **FAQ key:** `blurt_benefits` Blurt is the public blockchain Morphit runs on. Your account, orders, reviews and encrypted chat messages are all stored there. Its coin is BLURT. Why it comes up: • **Tiny network fees.** Blurt charges a very small BLURT fee for each action (an order, a review, an encrypted chat message), so keep a little liquid BLURT on hand. New accounts get 4 BLURT to start, enough to fill in every profile field, post a first order and send a few messages. See 'What is Mana on Blurt?'. • **Cheaper listing fees.** Paying a listing fee in BLURT costs about $0.125, half the BTC/XMR price, and it's checked on chain right away. Where the site offers it, you can pay in BTC or XMR instead. • **Rewards.** The welcome bonus and loyalty rewards come in BLURT and Blurt Power (BP). • **Blurt Power.** BP earns you a nice % APR and gives your votes weight on Blurt social sites like blurt.media and blurt.blog. You can trade XMR, BTC, USDT, USDC, DAI, BCH, LTC, DASH, DOGE, ZEC, ARRR, DCR, SOL, ETH, or XRP on Morphit without ever trading BLURT itself. You only need that little bit for network fees. --- ## How do I stake my Blurt (power up to BP) to earn interest? **FAQ key:** `how_to_stake_blurt` Staking BLURT means turning it into **Blurt Power (BP)**. Blurt calls this "powering up." BP earns a small yearly reward (your wallet shows the current rate as "Earning … APR"), gives your votes more weight, and can earn curation rewards. It stays your own coin the whole time: not a deposit, not a loan. **How:** open your [wallet](/my/wallet), choose **Power up**, enter how much BLURT, and confirm. Your own keys sign it on the Blurt chain; Morphit never holds your coins. **Getting it back:** choose **Power down**. Blurt pays it back in weekly parts over 4 weeks. That's a Blurt rule, not a Morphit one. --- ## Where does the Blurt price displayed on Morphit come from? **FAQ key:** `where_does_blurt_price_come_from` Morphit uses the BLURT price for two things: showing a rough dollar value next to BLURT amounts, and working out how many BLURT a listing fee should be so it stays about 12.5¢. Where it comes from, in order: • **api.blurt.blog**, the Blurt community's own price service, whenever its answer looks sensible. • If that's down or looks wrong: an average of several public price sites (CoinGecko, CoinPaprika, CryptoCompare, and others if the operator adds them), leaving out any that disagree too much. • Optionally, a price worked out from trades on Morphit itself. It's off unless the operator turns it on, and it's only used when the sources above fail. • With no recent price at all, the site asks for the standard BLURT fee amount and shows no dollar figure. A site reached only over Tor and I2P never contacts these price sites; it asks other Morphit sites instead. A bad price can't change what the network accepts: every site checks fees against a minimum set on the Blurt chain, not against its own price. BTC and XMR prices come first from five Haveno and Bisq price servers reached over Tor. Their price is used only when at least two of them agree and they are most of the answers. If they don't agree, the site falls back to the public price sites (or, for a Tor/I2P-only site, to other Morphit sites). The operator can show prices in a currency other than USD, such as EUR. Then the api.blurt.blog step is skipped, because it only quotes dollars. --- ## Where do I buy Blurt to use as a network fee? **FAQ key:** `where_to_buy_blurt` **Right here on Morphit.** BLURT is one of the 16 assets traded here, alongside XMR, BTC, USDT, USDC, DAI, BCH, LTC, DASH, DOGE, ZEC, ARRR, DCR, SOL, ETH, and XRP. Open the [orderbook](/orderbook), find someone selling BLURT, and message them. You pay them the way they accept (cash, bank transfer, another coin…), and they send BLURT to your account. No exchange account, no card, no KYC. You can also post your own buy order and let sellers come to you. **Your first order can be free.** If your very first order is a buy of BLURT worth at least $1, Morphit covers the listing fee. See "Is my first order really free?" **Once you have BLURT,** choose **Pay in BLURT** when you post an order, and the fee is sent from your BLURT balance when you sign. --- ## Is my first order really free? **FAQ key:** `first_order_free` Yes. If your very first order is a **buy of BLURT** worth at least **$1**, Morphit pays the listing fee for you. You enter the amount in your own currency, and the app checks it's worth at least $1. **The rules:** • It must be your very first order. Post any other order first and the free one is gone. • It must be a buy of BLURT. You can pay the seller with cash, another coin, or whatever you agree on. • One per account. On the [post page](/post), the free option is already picked for your first order. If you switch to paying and post, the free order is gone. **Why BLURT?** About $1 of BLURT covers roughly 8 future listing fees at the BLURT rate (about 12.5¢ each, half the BTC/XMR price), and paying fees in BLURT earns the welcome stake and loyalty rewards. **What "free" means:** no listing fee for this one order. Blurt's tiny network fee still applies (new accounts get 4 BLURT for it). You and the seller trade directly; Morphit never touches your money. **Reviews:** a review can't point to this free order (reviews need an order with a paid listing fee), so it can't earn you stars. Once you mark it completed, it still counts as one trade on your profile. --- ## What is the welcome bonus and how do I earn it? **FAQ key:** `welcome_bonus` There are two welcome rewards, then loyalty rewards: **1. First BLURT-paid listing fee → a 1 BP welcome stake.** The site you posted through lends you 1 Blurt Power (BP), even if nobody trades with you. Blurt only lends BP in amounts of about 33 BP or more, so small rewards wait until they add up: for most traders, at the 500 BLURT loyalty milestone (61 BP in all). **2. First completed trade on a listing you paid for → 10 BLURT, plus 10 BLURT powered up.** Once someone trades with you and reviews you on that listing, the site you posted through sends you 10 BLURT to spend and 10 BLURT as Blurt Power, both yours to keep. The free first buy doesn't count (it has no fee). Until 1 November 2026, if your first review comes from a trade on someone else's listing, this bonus is used up without being paid; from then on, that no longer happens. **3. Loyalty rewards → up to 1,260 BP more.** See "How do loyalty rewards work? (The BP milestones I saw mentioned)". Each reward comes once per account, from the relay of the site the order went through. Lent BP stays the site's. Waiting for a paid listing and a review stops fake accounts from farming bonuses. --- ## How do loyalty rewards work? (The BP milestones I saw mentioned) **FAQ key:** `loyalty_milestones` Every listing fee you pay in BLURT adds to your lifetime total (on all Morphit sites). When it crosses a milestone, the site whose order crossed it lends you Blurt Power (BP): • 100 BLURT paid → 10 BP • 500 BLURT paid → 50 BP • 2,000 BLURT paid → 200 BP • 10,000 BLURT paid → 1,000 BP **Good to know:** • Only listing fees paid in BLURT count. BTC/XMR fees and the free first buy don't. • Your total never resets or expires. • Each milestone pays once, and they add up: crossing 100 and then 500 gives you 60 BP. • It's a loan (a delegation), not a gift. The BP stays the site's, and its operator can take it back. • Blurt only lends BP in amounts of about 33 BP or more, so small rewards wait until they add up: for most traders, at the 500 BLURT milestone (61 BP with the 1 BP welcome stake). BP gives your votes weight on Blurt social sites like blurt.media and blurt.blog. With the 1 BP welcome stake, that's up to 1,261 BP lent to you. See also "What is the welcome bonus and how do I earn it?" --- ## Why no Escrow or Arbitration service? **FAQ key:** `no_escrow_arbitration` Escrow is a babysitter who holds your money until the trade is done. An arbitrator is a referee who decides who's right when you argue. The catch: you didn't want to trust a stranger, so now you have to trust the babysitter and the referee instead. They become a new middleman with power over your money. If they're dishonest, slow, biased or hacked, your money can still disappear. So escrow and arbitration don't solve the trust problem; they just move it to someone else. Morphit never holds your money. Instead, you get public reviews to help you choose who to trade with, and a permanent, encrypted chat record of what you agreed. Don't trust. Verify. --- ## What does the 'No JS' link in the footer do? **FAQ key:** `no_js_limits` It links to this answer about how Morphit works without JavaScript. It isn't a switch: a website can't turn JavaScript off for you, only your browser can. What still works with JavaScript off: • Pages with fixed text, like the security page, the glossary and the run-a-node page. They are built ahead of time, so they still show. The FAQ shows its questions; its answers need JavaScript. • The orderbook RSS feeds (`/rss/orderbook.xml`). They work in any feed reader. What needs JavaScript: • Live data: the orders in the orderbook, profiles, feedback and chat all load in your browser. So do the FAQ answers and the privacy guides. • Anything you sign: posting orders, chatting, leaving feedback. Your keys and the cryptography stay inside your browser, never on a server, and that takes JavaScript. --- ## How do I run a Morphit node? **FAQ key:** `how_to_run_node` A Morphit node is your own copy of the marketplace, on a computer you control. It runs three parts: the website, the indexer (reads the Blurt blockchain and serves orders and chat) and the relay (creates new users' accounts and pays their rewards). You don't run a blockchain node: the indexer reads public Blurt nodes. What you need: • A computer that stays on, rented (a VPS) or an old PC, with 2+ CPUs, 4+ GB RAM and 80+ GB of drive space, running Ubuntu 24.04 or a 24.04-based system like Linux Mint 22. See "What are the minimum hardware requirements to run a Morphit node?" • A web address, or none if you run Tor-only. • A Blurt account holding BLURT to pay for your users' signups. To install, download the release, run `sudo bash morphit-setup.sh`, choose "Full guided install" and answer the wizard's questions. Then run `sudo morphit-ops register` to register as an operator. The walkthrough is at [/run-a-node](/run-a-node); the full reference is `docs/OPERATIONS.md`. Why do it? You earn 90% of the BLURT listing fees paid on your site (see "How do operators earn?"), and your community gets one more door into the same marketplace if another site is blocked. --- ## Can I customize the look of my own Morphit instance (logo, colours, name)? **FAQ key:** `customize_your_instance` Yes. Your logo, icons, site name and colours can all be changed **without rebuilding**, so your site keeps serving the signed release and visitors never see the build-integrity warning. Copy your SVG files to the server, then run: `sudo morphit-ops branding apply --logo /home/you/logo.svg --icon /home/you/icon.svg --name "Your Site"` • `--logo`: the header and homepage logo. Add `--logo-footer` for a different footer logo. • `--icon`: the browser-tab icon and the home-screen app icon. • `--name`: your site's name. It replaces "Morphit" wherever the site names itself; mentions of the Morphit software and federation stay. • Colours: add `--theme-from '#…' --theme-to '#…'`, or a preset such as `--theme champagne-gold`. Prefer to be asked one question at a time? Run `sudo morphit-ops branding setup` (also *Branding* in the `sudo morphit-ops` menu). Every upgrade re-applies your branding. The full guide is `docs/BRANDING.md`. Changing more, like fonts, layout or wording, means forking the code (it's built with SvelteKit). A rebuilt site no longer matches the signed release, so visitors' browsers show the build-integrity warning, by design, and you keep your fork up to date yourself. One rule from the AGPL licence: if you run a **modified** version publicly, you must offer your changed source to your users. A footer link to your fork is enough. --- ## How do operators earn? **FAQ key:** `how_operators_earn` Most orders pay a small listing fee: about $0.125 in BLURT (half price, on purpose) or about $0.25 in BTC or XMR. Orders posted through your site carry your operator tag. **BLURT fees: 90% to you, 10% to the Morphit treasury.** The user's own transaction pays both parts at once: 90% straight to your fees account, 10% to the treasury, which funds the project. Nobody holds your share, and nobody can withhold it. **BTC and XMR fees: 100% to the Morphit treasury.** The Blurt chain can't split them, and splitting them by hand would mean someone holding your money. **Also yours:** 90% of the featured-slot bids on your site (you set the hourly price; 50 BLURT/hour by default) and of the fees strangers pay to send a first message (from 5 BLURT). **What you pay:** about 104 BLURT for every new account your relay creates (the chain's 100 BLURT fee plus 4 BLURT of starter funds); 10 BLURT plus 10 BLURT powered up when a user completes a first trade on a listing they paid for on your site; and 1 BLURT top-ups for active users who run low. Blurt Power rewards (a 1 BP welcome stake, loyalty rewards up to 1,260 BP per user) are lent, so that BLURT stays yours. Plus your server. At a BLURT price of $0.002, your share of one listing is about 56 BLURT, so about two paid listings cover one new account. --- ## How do I find a good operator to use? **FAQ key:** `how_to_find_good_operator` The [/operators](/operators) page lists every registered operator: their tag, when they registered, a contact link, how many orders came through their site and what they have earned. Good signs: • **A long track record.** Registered long ago and still active. • **Real use.** Many orders came through their site, so real traders trust it. • **A reachable person.** Their contact link leads to someone with a reputation outside Morphit. What matters less is looks or language. Every Morphit site reads the same blockchain, so they show the same orders, unless an operator chooses to hide some. [/compare](/compare) checks whether another site shows the same orderbook as this one. Why the choice still matters: no operator holds your money, because your keys stay in your browser. But the operator gets 90% of the BLURT listing fees you pay there, and serves the page code your browser runs. A dishonest one could show you false data, or ship code that copies your keys when you unlock them. The in-page release check catches a changed file on an honest operator's server, not an operator who serves the checker too. So pick an operator with a long public track record, compare sites when something matters, or run your own. --- ## How does Morphit chat work? **FAQ key:** `what_is_morphit_chat` Morphit chat is private messaging between two traders. Each message is locked (encrypted) on your device, stored on the Blurt blockchain, and unlocked only on the other person's device. Operators pass messages along but can't read them. • **No setup.** Your chat key is made from your account's posting key the first time you open chat. • **It lasts.** Close the tab and come back tomorrow: the conversation is still there, because it lives on the blockchain, not on one company's server. • **Check once.** Compare the safety number with each partner once (⋮ → Verify peer) to make sure nobody swapped a key. What is *not* private. Anyone reading the chain can see: • who and when (@scooby chatted with @alice yesterday) • roughly how long each message is • which order a conversation is about, how far you have read, and whom you block One more limit: your operator serves the app itself, so you are trusting their copy of the code. Pick operators you trust, or run your own. For sensitive details, use a metadata-private messenger such as Session (getsession.org) or Signal alongside Morphit. --- ## My chat message or new conversation isn't showing up — is it lost or broken? **FAQ key:** `chat_message_not_showing` Almost certainly not lost. Morphit chat is stored on the blockchain, and a brand-new conversation can take a moment to appear, sometimes on one side before the other, especially when you two use different Morphit sites. • Your message goes out the moment you send it. The other person usually sees it within seconds. • A conversation you just started can take up to about a minute to show in your inbox while your site catches up. Refreshing the page helps. • Once a conversation exists, new messages in it arrive quickly. Still missing after a few minutes? Tell your site's operator: their site may be behind on reading the blockchain. --- ## What happens if I lose my chat key? **FAQ key:** `chat_key_loss` There is no separate chat key to lose: chat uses your posting key (see 'Do I need to set up a separate key to use chat?'), so you only lose it if you lose access to your whole account. Without your keys you can't post orders, leave feedback, send chat or read past messages, and Morphit can't recover them, because it never holds your keys. Your safety net is the 12-word recovery phrase you wrote down at sign-up. Sign in with it and everything comes back, including past chats. (If you signed in with an existing Blurt account, your Keyfile and keys play that role.) See 'What if I lose my password or recovery seed?' and 'How do I back up my Morphit account? What should I write down?' --- ## Why is chat on the blockchain instead of a regular server? **FAQ key:** `why_chat_on_chain` So chat doesn't depend on any one company's server. • **No single off switch.** Every Morphit site reads the same blockchain. If one site goes down or is blocked, your conversations still exist and other sites can show them. • **No silent edits.** Once a message is on the chain, nobody can change or delete it. • **One source of truth.** There are no separate copies to keep in sync between sites. The trade-offs: • The content of each message is end-to-end encrypted, but who talks to whom and when (@bob with @sally yesterday), is public on the chain (see 'Are my chats private?'). • Messages usually arrive within a few seconds rather than instantly. That's fine for arranging a trade. --- ## Does Morphit require KYC, identity verification, or government ID? **FAQ key:** `kyc_requirement` No. Morphit is KYC-free: you never need to verify your identity. It never asks for your name, email, phone number, government ID, a selfie or proof of address. You pick an account name, and that's it. Morphit never holds your money, so it has no reason to know who you are. Like any website, it does see your internet address while you're connected; use a VPN or Tor if you want to hide that. If a site calling itself Morphit asks you for ID, it isn't Morphit. It's a scam. Close the tab. --- ## How do I trade on Morphit — a step-by-step walkthrough? **FAQ key:** `how_to_trade_walkthrough` New here? Here's a first-time user's walkthrough, from start to finish. 1. **Create a free account.** Pick a name and a password. No email, no ID. 2. **Write down your 12-word recovery phrase** on paper and keep it safe. It's the only way back into your account. 3. **Find an offer** in the orderbook: the right coin, a fair price, a payment method you can use, and good feedback. Or post your own order. 4. **Message them** with the chat button on their order. Chat is encrypted. 5. **Agree on the details:** the exact amount, where to meet for cash or which account to pay, and who goes first. 6. **Trade.** One of you sends first; the other checks it arrived, then sends their side. 7. **Leave feedback** for each other, so future traders know whom to trust. Morphit is the bulletin board that connects you. The trade itself happens directly between the two of you. --- ## Does Morphit work in my country? **FAQ key:** `supported_countries` Yes. The software has no country checks and no country blocks; it doesn't turn anyone away because of where they are. Orders live on a public blockchain, so you can browse, post and trade from anywhere with an internet connection. If your country blocks this site, try its Tor, I2P, Lokinet or `.eth` addresses (the footer shows the ones this site has), or another Morphit site. Morphit doesn't enforce any government's rules. Knowing your local laws, and deciding what to do about them, is up to you. #agorism #countereconomics --- ## Which fiat currencies (USD, EUR, local money) does Morphit support? **FAQ key:** `supported_fiat_currencies` Practically all of them. When you post an order, you pick your currency from a list of about 150 circulating world currencies: USD, EUR, GBP, MXN, BRL, INR, NGN, ARS, PHP and many more. Search by name or code. Morphit doesn't limit which one you use, and others filter the orderbook by the currencies they want, so they can find your offer. --- ## What happens if my trading partner disappears or stops responding mid-trade? **FAQ key:** `counterparty_disappears` Morphit has no escrow, no referee and no customer service that can reverse a trade. If you send first and the other person vanishes, that money is gone. So protect yourself before you send: • Trade with accounts that have a solid feedback history. • For bigger amounts, split the trade into smaller pieces. • Agree on every step in Morphit's encrypted chat, so you both have a record. • If you're selling, wait until the payment has fully cleared. Some bank payments can be reversed days later. If someone cheats you, leave honest, detailed feedback with the facts, so the next person is warned. You get one review per trade, and it's permanent. --- ## Do I owe taxes on trades I make through Morphit? **FAQ key:** `taxes` That's between you and your tax authority. Most governments say yes, and their rules vary widely. We consider income tax theft; what you do is your choice. Morphit doesn't report anything to anyone, and it doesn't know who you are. What it does give you is a permanent, public record of your orders and feedback on the blockchain, which you can look up any time if you need it. Knowledge is power. #donoharm #agorism --- ## Does Morphit work on mobile phones, iPad, or only desktop? **FAQ key:** `mobile_desktop` Both. Morphit runs in any modern browser on a phone, tablet, laptop or desktop, and the layout fits small screens. You can also add it to your home screen so it opens like an app: on iPhone or iPad use Safari, on Android use the browser menu. See 'Can I use Morphit on my iPhone or iPad?' and 'How do I install Morphit on Android?'. There's no app-store app and nothing to sideload. Privacy setups work too, like GrapheneOS or Tor Browser. Tor Browser's "Safest" level turns JavaScript off, though, and Morphit can't run there. --- ## How do I trade anonymously or privately on Morphit? **FAQ key:** `privacy_practices` Morphit already skips the big privacy leaks: no KYC, no email, no phone number. To go further: • Use a VPN or Tor, so sites and nodes don't see your real IP address. • Make a fresh account just for trading, separate from any you use for blogging. • Never put your legal name or phone number in chat or order notes. • Use a new receiving address for every trade (for Monero, a new subaddress from your wallet). • Prefer Monero when you can. Its on-chain privacy is far stronger than Bitcoin's. • For cash in person, meet in a neutral public place and share only what the meetup needs. Remember that chats and orders leave public traces on the blockchain, such as who talked to whom (@bartsimpson with @dumbass), and when. Privacy is a habit, not a setting. For coin-by-coin advice, see the [privacy guides](/privacy) (for example [Bitcoin](/privacy/btc) or [Litecoin](/privacy/ltc)). --- ## Should I trade in person (cash meetup) or online (bank transfer)? **FAQ key:** `in_person_vs_online` Both work. Pick what fits the trade size and how much you trust the other person. • **Cash in person** is the most private: no bank, no paper trail. Meet in a busy public place in daylight, and bring a friend for bigger amounts. Don't part until the crypto has arrived. • **Bank transfer or payment app** is convenient, but your bank sees it, and some payments can be reversed (chargebacks, recalled transfers). If you're selling, wait until the money has fully cleared. "Pending" isn't paid. Morphit doesn't push either style. --- ## What scams should I watch out for on Morphit? **FAQ key:** `scam_patterns` The common ones: • **Reversible payments.** Someone pays with something they can undo after you've sent crypto, like a card chargeback or a recalled bank transfer. Only accept payments that truly clear first. • **Moving you off Morphit chat.** A "trading partner" contacts you on WhatsApp or Telegram. Morphit chat is the only channel tied to their Morphit account, so stay there. • **Fake sites.** Check the address bar, and bookmark the real site. • **Too-good prices from new accounts.** No feedback and a price far better than the market is bait. • **Small trades, then a big scam.** A few easy trades to win your trust, then one large trade that never pays. • **Asking for your keys.** Nobody honest ever needs your 12 words or keys. Morphit warns you if you try to send something that looks like one. Your best defence is feedback. Read it before every trade. --- ## Do I need technical skills to run a Morphit node? How hard is it? **FAQ key:** `node_technical_skills` Basic computer comfort is enough: opening a terminal, typing a command, and logging into a server over SSH if you rent one. If you've ever set up a home NAS, a VPN or a self-hosted app, you're ready. Installing is one command, `sudo bash morphit-setup.sh`, followed by a wizard that asks plain-language questions. No file editing. It sets up the website, the database, HTTPS, the firewall and a Tor address for you. You need Ubuntu 24.04, or a 24.04-based system like Linux Mint 22. No blockchain experience is needed. Morphit reads public Blurt nodes, so it's much closer to running a web app than running a blockchain node. The step-by-step guide is at [/run-a-node](/run-a-node). You can ask for help in the public Matrix room `#agorise:matrix.org`. --- ## How much does it cost to host a Morphit node? **FAQ key:** `node_hosting_costs` The server is cheap. The bigger cost is paying for your users' signups. **The server.** You need 2+ CPUs, 4+ GB RAM and 80+ GB of drive space (SSD is best). Many hosting companies rent servers like that for a few dollars a month. Or use an old PC at home and pay only for the electricity. **BLURT.** Your relay pays about 104 BLURT for each new account your site creates (the chain's 100 BLURT fee plus 4 BLURT of starter funds), so about 2,100 BLURT covers your first 20 signups. It also pays welcome bonuses and small top-ups. In return you get 90% of the BLURT fees paid on your site: listing fees, first-message fees and featured-slot bids (see "How do operators earn?"). A domain name is optional (about US$10 a year), or run Tor-only without one. --- ## If one Morphit instance goes down, do I lose my orders and reputation? **FAQ key:** `switching_instances` No. Your orders, profile, feedback and chats are stored on the Blurt blockchain, not on any one site. If one Morphit site goes down, any other one shows the same orders and the same reputation, read from the same chain. Nothing has to be moved. You do have to sign in once on the new site. Your browser keeps your saved, encrypted keys separately for each website, so there you sign in with your 12-word seed phrase, your keyfile or your key. An operator can hide listings on their own site, but never on anyone else's. Sites come and go; your reputation stays yours. --- ## How do I back up my Morphit account? What should I write down? **FAQ key:** `backup_practices` Write your 12-word recovery phrase on paper, in order, exactly as shown. Those 12 words rebuild every key Morphit uses, so they *are* your account. • Keep the paper somewhere safe and offline, away from your computer — a fireproof box or a safe deposit box. • For extra safety, make two copies and keep them in different places. For large amounts, stamp the words into a steel plate: metal survives fire and water, paper doesn't. • Never photograph it, email it, or save it in a password manager that syncs to the cloud. An offline password manager such as KeePass is fine. • Only ever type it into Morphit or another Morphit site you trust. **Signed in with an existing Blurt account?** Then you have no 12-word phrase, and none can be made: a phrase creates keys, it can't be worked out from keys you already have. Your backup is the keyfile from the [Back up my keys](/backup-keys) page. It is locked with your Morphit password and holds your Posting key — plus your Active key, if you chose to keep it on this device. Guard it like the paper above, and don't forget the password: without it the keyfile is useless. --- ## Is there a minimum or maximum trade size on Morphit? **FAQ key:** `trade_size_limits` No minimum, and no real maximum. The only cap is a typo guard at one trillion, so nobody can post a nonsense number. What limits you in practice: • **Finding a match.** Very small and very large orders take longer to find someone willing to trade. • **Fees.** Each listing has a small fee, so tiny trades may not be worth it. • **Payment limits.** Banks and payment apps often have their own minimums and daily caps — check before you agree. For a big amount, consider splitting it into a few smaller trades with the same person, so neither of you risks it all at once. This builds trust between you two, but not extra reputation: only their latest review of you counts. --- ## If a bad operator starts lying to users, can you shut them down? **FAQ key:** `rogue_operator` **No** — and that's on purpose. Anyone can run a Morphit site: they pay for their own server, run the open-source code and read the public blockchain. Nobody approves operators, so nobody can switch one off. We have no access to their server, there's no central gateway to block, the blockchain is public, and the software gives every operator the same rules, including the same 90% share of BLURT fees. What we **can** do is **warn** people — on our own website, in our Matrix room (`#agorise:matrix.org`) and from the @morphit Blurt account — so you can decide which site to trust. You can also check for yourself: • The [Instances](/instances) page marks a site **Mismatch** when its operator account or fee addresses don't match the values on the chain. • Each release's file fingerprints (hashes) are signed on the chain, and your browser compares them with the files the site sends. That catches a changed file on an honest server — but a hostile operator also serves the checking code and can hide a change from it. • The stronger checks: compare what two different sites show you, or download and verify the release yourself (`docs/VERIFY-YOUR-DOWNLOAD.md`). Why no off switch? If we could shut down a bad operator, a government could make us shut down a good one. And a better operator *should* win more users than morphit.io — that's the market working. --- ## What is a Monero TxID and where do I find it? **FAQ key:** `xmr_txid` A Monero transaction ID (TxID, sometimes called a *hash*) is a 64-character code, using 0–9 and a–f, that names one Monero payment. To find it, open the payment in your wallet's history: the TxID is the long code in its details, usually with a copy button. **When Morphit asks for it:** when you tell your trade partner you've paid in Monero (the **Pay now** button in chat), and when you pay a listing fee in XMR (if this site takes XMR fees). For a fee, you paste the TxID together with the payment's transaction key, so every Morphit site can check it — see "What is the Monero transaction key and why does Morphit ask for it?". **Privacy:** a TxID is public anyway — anyone can look it up on a block explorer — and it doesn't show who you are or your balance. But it is saved with your listing on the Blurt chain, which links that one fee payment to your account. Your trade payment itself goes person to person, off Blurt. If you share its TxID in chat, it travels in your encrypted chat, which only you and your partner can read. For no Monero link at all, pay the fee in BLURT: it's the default and costs half as much. --- ## What is the Monero transaction key and why does Morphit ask for it? **FAQ key:** `xmr_tx_proof` Every Monero payment has a **transaction key**: a 64-character code (0–9, a–f) kept by the wallet that sent it. With the transaction ID and this key, anyone can check that the payment reached a given address and how much it carried. The key can't move any money. **Why Morphit asks for it.** When you pay the listing fee in XMR, your listing carries the transaction ID and key, so every Morphit site can check the payment itself with public Monero explorers (Tor onion ones first). Nobody needs the treasury wallet's secret keys. **Your fee address is made for your listing.** Once the treasury's main Monero address is published on the chain, each listing gets its own fee address with a hidden listing code inside. Only your transaction key reveals that code, so nobody can copy your ID and key onto their own listing, and one payment can't pay twice. **Where to find it.** • Monero CLI: `get_tx_key ` • Monero GUI: Transactions → the payment's details → "Transaction key" • Feather: History → right-click the payment → Show details → Copy Tx Secret Key • Cake Wallet: tap the payment → "Transaction Key" • Monerujo: tap the payment → "TX Key" Only the sending wallet has it — an exchange can't give it to you. **Privacy.** The key is published with your listing. Someone who also knows your wallet address could use it to spot the change from this payment. For the most privacy, pay from an address you haven't shared with anyone, or pay in BLURT. **"Payment proofs" (OutProof…) no longer work.** A listing sent with one shows "fee can't be checked" — post it again with the transaction key. --- ## Why is Morphit's source mirrored to so many code hosts? **FAQ key:** `morphit_mirrors` So nobody can silence the project by taking down one website. A project kept in one place can be killed in one place: a platform can suspend it, a government can force a takedown, or a host can simply disappear. The Morphit source code (open source, AGPL-3.0) lives on more than a dozen code hosts, such as the Agorise Forgejo, GitHub, GitLab, SourceForge, SourceHut, Bitbucket and Launchpad, plus IPFS, which no single host controls. If one host drops it, the other copies remain, and the license lets anyone copy, check or fork it. The full list is on the [Download page](/download). There's nothing to get from an app store: Morphit installs straight from your browser. The mirrors are for the code. --- ## How do I install Morphit on Android? **FAQ key:** `android_sideload` Open Morphit in Chrome, Brave or another browser, tap the menu (⋮), then **Install app** or **Add to Home screen**. The icon goes on your home screen and opens full-screen like a normal app. Its pages open even without a connection (live orders need internet), and when a new version is out it asks you before switching. There's no APK file to download, so Android's sideloading hurdles and Google's rules for Android developers don't apply. A web app installs straight from the site — no app store, and no gatekeeper who can pull it. --- ## How does someone become a Morphit operator? **FAQ key:** `operator_registration` Anyone can run a Morphit site — nobody has to approve you. The setup guide is at [Run a node](/run-a-node). To appear as an operator, you register as one on the Blurt chain. The setup wizard can do this for you, or run `morphit-ops register`. This registration publishes a `morphit_operator_register_v1` record, signed by your relay account, that holds: • your **operator tag** — 1 to 64 characters: lowercase letters, digits, dots, dashes and underscores; • your site's name, address and contact link; • your **fees account**, which receives your 90% share of BLURT fees. Tags are first come, first served and can't be changed later; tags that imitate the project's own names are refused. Re-run the command anytime to update everything except the tag. Why it matters: registered operators are listed on the [Operators](/operators) page and in the instance directory, and other sites only accept a fee share paid to the fees account in your registration. Without it, your users' BLURT-paid orders show only on your own site. See "How do operators earn?". --- ## When do operators get paid their fee share? **FAQ key:** `operator_payouts_timing` Right away — inside the same transaction the user pays with. When someone pays a BLURT fee on your site (a listing fee, a first-message fee or a featured-slot bid), that one transaction sends 90% to your fees account and 10% to the Morphit treasury. Your share arrives as soon as the transaction is in a Blurt block, a few seconds later. No batching, no payout schedule, no minimum to withdraw, and nobody in the middle who could hold your money. **Three exceptions:** • **BTC and XMR fees go 100% to the Morphit treasury.** Splitting them would need someone to hold and forward the money, which Morphit's no-custody design rules out. See "How do operators earn?". • If your fees account is empty or not a valid account name, the whole BLURT fee goes to the treasury. • If a fee is paid from your fees account itself, the whole fee goes to the treasury, because Blurt can't send money from an account to itself. It's all on the chain, so you can check every payment yourself. --- ## Can operators block or ban specific users from their instance? **FAQ key:** `operator_moderation` Yes, on their own site only. An operator can block an account with the `morphit-ops` moderation tools. The site then stops showing that account's listings — in the orderbook, on their profile, in featured slots, in RSS feeds and in the live feed. If the blocked person signs in there, a banner tells them they're blocked on this site, with the reason if one was given. What a block does **not** do: • Touch the blockchain. Their orders are still there and still show on every other Morphit site (see [Instances](/instances)). • Touch their funds, keys or account. • Stop them trading. They can use any other site, or run their own. Blocks aren't secret: the site's public data lists every account it has blocked, and why. And a block can be undone at any time. Operators use this against spam and abuse — for example, listings for goods or services that would harm someone. #donoharm --- ## Do I need to set up a separate key to use chat? **FAQ key:** `chat_identity_key` No. Chat uses your Blurt posting key — the key you already have. There's nothing extra to create, publish, back up or lose. How it works: • Messages to you are encrypted to your posting public key, which has been on the Blurt chain since your account was created. Anyone can write to you, even if you have never opened chat, and you read it whenever you sign in. The sender pays the small network fee; you need no BLURT to receive a message. • Your private key never leaves your browser. • Conversations from before version 1.21.14 may contain messages in an older format, which used a key made from the posting key and published on chain back then. They stay readable. Since 1.21.14 every new message uses your posting key, and nothing is published for you any more. The trade-off: anyone who gets your posting key — for example by stealing your 12-word phrase — can also read all your past chats, and your new ones until you change your posting key. They could already pose as you, so the thing to protect doesn't change: keep your 12-word phrase and your password safe. --- ## What is the "Syndicate my order" checkbox? **FAQ key:** `syndicate_trade_announcement` When you post an order, you can tick **Syndicate my order to the Blurt blog**. Right after your order goes up, Morphit posts a short announcement of it to your own Blurt blog, with a link back to the order on Morphit. It's tagged #morphit, so people browsing that tag can find it. The post is signed with *your* posting key — not the operator's or the project's — so it's genuinely from you, and it's a normal post on your blog. Upvotes on it can earn you BLURT. There's also a one-time option: **Announce my first trade to the @morphit community**. It's off unless you turn it on, on the order form or in Settings. If it's on, a short first-trade post goes to the @morphit community when you leave your first feedback. After that, Settings instead lets you tick the blog box on every new order by default. --- ## Does Morphit work offline? **FAQ key:** `offline_caching` Partly. Once Morphit has loaded, its pages, design, fonts and icons are saved on your device. If your connection drops — a tunnel, an elevator, bad wi-fi — you can still open pages and read things like this FAQ. Anything live needs a connection: • the current orderbook, profiles and prices; • sending orders, chat messages and feedback. Some privacy browsers, such as Tor Browser, turn this offline saving off. Morphit still works there (except at Tor Browser's "Safest" level, which turns off JavaScript); it just loads everything fresh. --- ## What's the difference between Lock Session and Sign Out? **FAQ key:** `lock_vs_signout` **Lock session** wipes your keys from memory but keeps the encrypted copy on this device. Next time you open Morphit here, you unlock with just your password — no seed phrase needed. **Sign out** wipes your keys from memory *and* deletes the encrypted copy from this device. To get back in, you need your 12-word seed phrase, your keyfile or your Blurt key. Use **Lock** on your own device when you step away. Use **Sign out** on a public or shared computer, or before handing the device to someone else. Two details: • Lock only differs from Sign out if this device remembers you: you chose "Password (fast)" when you created your account, or ticked "remember me" when you signed in. Otherwise nothing was saved, so both end the same way. • Locking by hand also clears your unsent drafts. The automatic idle lock keeps them. --- ## Why does Morphit ask for my posting key when I log in, instead of the password I set? **FAQ key:** `login_password_vs_key` Your key (or your 12-word seed phrase) is your real login. The password only unlocks a copy of your key that Morphit saved, encrypted, in *this one browser*, so you don't have to paste the key every time. So which one you're asked for depends on whether that saved copy is here: • **You used Sign out:** the saved copy was deleted on purpose, for safety, so Morphit asks for your key again. That's normal, not a bug. • **You only locked, or closed the tab:** if this device remembers you, the copy is still here, so you just type your password. • **New computer, browser or phone:** your key was never saved there, so you need it the first time. Your key is never kept on a server, so a password alone can't unlock a new device. Tip: to keep the quick password login, use **Lock** instead of **Sign out**. --- ## When does my session auto-lock if I walk away? **FAQ key:** `auto_lock_timeout` By default after **9 hours** without activity. That's long on purpose: you can walk away to cook dinner and come back to your trades without signing in again. To change it, go to **Settings → Utility → Auto-lock after idle** (shown when this device remembers you) and pick 15 or 30 minutes, 1, 4, 9 or 24 hours, or **Never** (you lock it yourself). Typing, clicking, scrolling, moving the mouse, touching the screen, or coming back to the Morphit tab all count as activity and restart the clock. When time runs out, your session locks — like **Lock session** in the avatar menu, except your unsent drafts are kept. Your keys are wiped from memory; if this device remembers you, unlock again with your password. --- ## How do push notifications work with my privacy? **FAQ key:** `push_notifications_privacy` Push notifications tell you when someone messages you, leaves you feedback, or outbids your featured slot — even when the Morphit tab is closed. To do that, a "push service" has to hold each alert until your device picks it up. **The honest part: your browser picks that push service, not us.** Chrome and most Chromium browsers use Google, Firefox uses Mozilla, Safari uses Apple, and Edge on Windows uses Microsoft. Morphit has no way to point it at a different server. What that service sees is metadata: that your browser got a push from this site, and when. It never sees the content — every push is end-to-end encrypted, so it can't read your messages or orders. **What this site keeps for push:** your account name, the push address your browser gave you, your language and the alert types you muted — until you turn push off or the address stops working. Each alert (for example "@bob sent you a message") is also kept for about an hour after it's sent, then deleted. Not your browser's user-agent. It only sends to the browser makers' push services, or ones the operator added. If that metadata bothers you, turn push off. You still get badges on your avatar, the tab icon and the title while Morphit is open — those never leave your browser. **What we removed:** older versions had a "Self-hosted only" option. It did nothing — Chrome still used Google. It's gone. We'd like to offer a real choice of push server one day (UnifiedPush). --- ## Can I hide orders from specific users? **FAQ key:** `user_hide_accounts` Yes. On a computer or tablet, every order in the orderbook has a small hide button (it isn't shown on narrow phone screens). Click it and confirm, and you won't see that account's orders any more — your chats with them are hidden too. They are never told. When you are signed in, your hidden list is saved with your account settings, encrypted so only you can read it. It follows you when you sign in on another device or another Morphit site. To undo it, go to **Settings → Hidden accounts** and unhide one person, or everyone at once. When the orderbook has hidden orders, a note at the top says how many, with a **Show anyway** button to peek without unhiding. Hiding only changes what *you* see. It doesn't ban anyone: their orders still exist, and everyone else still sees them. --- ## How does Morphit's reputation system work? **FAQ key:** `what_is_reputation` After a trade, each side can rate the other from 1 to 5 stars and add a short comment — once per order. Reviews are saved on the Blurt blockchain, so they are public and permanent. Nobody, not even the site, can edit or delete them. Each trader's profile shows their reviews, a star breakdown and a **reputation score from 0 to 5** (for example 4.06). The same score sits on their orders, next to how many trades they have completed. How the score works, in plain words: • Newer reviews count more. A review loses half its weight each year. • A trader with only a few reviews stays close to a neutral 3.0, so one glowing review can't make a stranger look like a veteran. • A long, recent, good record earns a small bonus. Lots of trading can never rescue bad ratings. • Only reviews from a real trade partner count. Fake-looking patterns are left out. **Your reputation is everything.** Morphit has no escrow and no referee. Your track record is what lets a stranger trust you, so treat every trade as if it matters — it does. --- ## How do I build a high reputation score on Morphit? **FAQ key:** `how_to_build_high_reputation` There's no shortcut: real trades, done well, over time. **What raises your score** • **Finish real trades and get reviewed.** A review only counts if it comes from someone you really chatted with (at least 2 messages each way, over at least 15 minutes) and names an order you two traded on whose listing fee was paid. • **Stay active.** Newer reviews count more — each review loses half its weight per year. The small bonus for a good record also halves for every 6 months without a new review. • **Be good on both sides.** Your profile shows your rating as a buyer and as a seller separately. • **Review back.** When a trade goes well, leave your partner an honest review too. **What doesn't work** • Reviewing yourself — it's rejected. • Fake accounts, two friends swapping 5-star reviews, one account aiming most of its reviews at one person, or a group piling bad reviews on someone. These patterns are flagged and left out. • Lots of reviews from one person — only their latest review of you counts. • Reviews that don't name a trade. They show on your profile but don't count. New accounts carry a 🌱 badge until they have 4 completed trades. That's normal — start small. Anyone can check your score: each site publishes a public reputation receipt (for the technically curious: `/v1/accounts//reputation-receipt`) that lists every review about you, whether it counted, and why not if it didn't. --- ## How do I leave feedback after a trade? **FAQ key:** `how_to_leave_feedback` When the trade is done, you can review the other person from two places: • **In the chat** for that order. After a payment has been marked as sent, a **Mark this trade complete** card appears under the messages. • **In [My Orders](/my/orders)**, for orders you posted. Click **Mark complete / review** and pick who you traded with. Choose 1 to 5 stars, add a comment if you like (up to 256 characters), and submit. If it's your own order, this also marks it complete and takes it off the orderbook. You can only review someone you really talked with: at least 2 messages each way, spread over at least 15 minutes. The review is signed with your posting key, so there's no password prompt. Morphit charges nothing for it; Blurt takes its usual tiny network fee from your liquid BLURT. It shows on their profile in about a minute. --- ## Can I respond to a review someone left about me? **FAQ key:** `feedback_reply` Yes. Open your own profile, find the review under **Reviews received**, and click **Reply**. You get one public reply per review (up to 256 characters). It shows right under the review, so readers see both sides. Replies are saved on the blockchain like reviews, so they're permanent. Use them to explain calmly, not to argue. Nobody can edit or delete the original review — not you, not the site. --- ## Who can see the reviews I've left for other traders? **FAQ key:** `reviews_given_visibility` Everyone. Every profile has a **Reviews given** tab listing each review that person has left, with a link to the order it was about. That's on purpose: how you rate others is part of your own reputation. If someone hands out 1-star reviews that nobody else agrees with, readers can see the pattern and judge for themselves. --- ## Why did Morphit warn me about a private key in my message? **FAQ key:** `private_key_warning` Because it spotted something that looks like a private key or a seed phrase. Morphit checks what you type in chat messages, order terms, review comments and replies to reviews for: • private keys in the common 'WIF' format (like your Blurt posting or active key), • 64-character hex keys (such as Monero private keys), • 12 or more seed-phrase words in a row. A match turns red, and a warning pops up before anything is sent. A private key is the key to a wallet: whoever sees it can take everything in it, forever. No real support person, admin or trade partner will ever ask for one. If you choose **Send truncated anyway**, Morphit shortens the key on your device to its first 6 and last 4 characters, so the full secret never leaves. Other order fields and your profile get the same shortening automatically, without the pop-up. --- ## What does the 'New trader' label mean? **FAQ key:** `new_trader_badge` It's the little 🌱 sprout next to a trader's name. It means the account has fewer than 4 completed trades on record — counting only orders whose listing fee was paid (plus a trader's free first order), and leaving out trades between accounts flagged as working together. They might be brand new, or just someone who rarely trades. It isn't a red flag — everyone starts here. If you trade with a newcomer, start with a small amount. Afterwards, an honest review helps the next person decide. --- ## What's on a user's profile page? **FAQ key:** `profile_pages` Every profile lives at /@username, and anyone can view it without signing in. From top to bottom: • **Who they are** — their picture (or a pattern made from their account name), display name, a short bio, and links to their Nostr, website or streaming page if they added any. • **Reputation** — their 0–5 score, number of ratings, average stars, a 5-to-1 star breakdown, separate buyer and seller ratings, and when they last traded. • **Tabs** — *Reviews received* (with any replies), *Reviews given*, and *Active orders*, oldest first so the ones closest to expiring come first. --- ## What changes when I'm viewing my own profile vs someone else's? **FAQ key:** `profile_own_vs_others` On your own profile you also see: • your balance card, • a **Trade history** tab with your completed trades, • a **Reply** button under each review you haven't answered yet. On someone else's profile you see a **Message @name** button instead. Order pages work the same way. On your own order you get **Edit** (only in the first 15 minutes after posting) and **Cancel this order** — or **Re-list this order** once it has expired or been cancelled. On someone else's live order you see the **Message @name** button, with a short note about using it to agree on payment. --- ## Can I share a link to my order? **FAQ key:** `share_order_link` Yes. Open the order and copy the address from your browser's address bar — it ends in /@username/ followed by the order's code (like order-k3x9…). Anyone can open it without signing in and see the full offer: price, payment methods, location, terms, and who posted it with their reputation. Share it anywhere — Nostr, a chat, a forum. The link stays the same if you edit the order. Once the order is completed, cancelled or expired, the link still opens and simply shows that status. --- ## Does Morphit chat have forward secrecy? **FAQ key:** `forward_secrecy` No. Morphit chat does not have forward secrecy. That's a deliberate trade-off — here's the honest version. **How a message is locked.** Each message gets a fresh one-time key, mixed with your posting key and your partner's. Only the two of you can open it, and your partner can tell it really came from you. Your posting key stays the same until you change it. **If a key is ever stolen.** Anyone who later gets your partner's posting key can read every message ever sent to them. By default you keep a copy of what you send, so your own key opens those too. You can stop keeping that copy (⋮ → Chat Security), but your partner's key still opens them, and the encrypted messages stay on the chain forever. **Why we chose this.** • Any message opens on its own — out of order, years later, on a new device — with no setup and nothing to pair. • Every device signed in to your account is the same chat identity. • The crypto code stays small and easy to audit. • Someone holding your posting key can already post and chat as you, so per-message keys would protect little. **If that's not enough for you** — for talks that could be investigated years from now — use a dedicated messenger such as Matrix/Element, Session or Signal. Morphit chat is for arranging a trade. --- ## If I disagree with my counterparty later, can I prove what we agreed to in chat? **FAQ key:** `chat_dispute_recourse` Partly. Morphit chat is stored on the Blurt blockchain, so nobody can edit or quietly delete what was said, and you can scroll back to the very first message. (If you stopped keeping your own copy in ⋮ → Chat Security, you can't reread your own messages after you leave — your partner still can.) **What you can show others.** Each message is a blockchain transaction signed by the sender's account, with a time and a transaction ID. Anyone can look these up on a Blurt block explorer to confirm *who* sent a message to *whom* and *when*. The chain holds only the encrypted form, so it can't prove the *wording* to an outsider. **Export.** Open the chat's ⋮ menu and choose **Export chat**. You get a PDF of every message the two of you ever exchanged, in every chat about every order, each with its UTC time and transaction ID, plus a page explaining how to check them. It's an ordinary, editable file — a tidy record for a mediator or court, not proof of the wording on its own. **What it can't do.** Morphit has no escrow and nobody who settles disputes, so evidence can't force anyone to pay — see 'Why no Escrow or Arbitration service?'. How much weight a court or mediator gives it depends on where you are. **Tip:** before anyone sends money, write the exact asset, amount, payment method and any special terms in the chat. --- ## What's public and what's private about my trades on Morphit? **FAQ key:** `chat_vs_feedback_visibility` Some of it is private and some is public — on purpose. **Private (only you and your trade partner can read it):** • **What you say in chat** — prices, payment details, addresses, meeting places, phone numbers. Messages are end-to-end encrypted; operators and anyone watching the blockchain see only scrambled text. See 'Are my chats private?'. **Public (anyone can read it):** • **Your orders**, including prices and terms. • **Reviews** — stars, comments and replies. Each review names the order it's about, so it publicly links the two accounts (@squirrel and @scooby) to that trade. See 'Who can see the reviews I've left for other traders?'. • **Everything about a chat except the words:** who talked to whom, when, about which order, roughly how long each message was, and how far each of you has read (read receipts). All of it is saved on the Blurt blockchain, and nothing saved there can be deleted. The only difference is who can read it. Why? Chat stays private so payment details don't leak. Reviews stay public so anyone can check a reputation. If even the fact that you talked must stay hidden, use a separate secure messenger for that part. --- ## How does Morphit protect me from scammers and stop them from getting my private keys or personal info? **FAQ key:** `how_morphit_protects_me` Mostly by having little worth stealing, plus a few safety nets. **Little to steal.** Morphit never holds your coins, and your private keys are made on your device and never sent to the site. No email, phone number or ID is asked for, and IP addresses are kept only in memory, to limit abuse. A hacked server holds none of your keys and no identities — though it could serve tampered page code, so use sites you trust. **Key guard.** Paste something that looks like a private key or seed phrase into a chat, order or review and you get a red warning; send anyway and only its first 6 and last 4 characters go out. See 'Why did Morphit warn me about a private key in my message?'. **Spam gates.** A stranger who isn't answering one of your orders must pay a small BLURT fee to message you first, unless you wrote to them first. Blocked accounts can't reach you. See 'How does Morphit stop spam and unsolicited messages from strangers?'. **Hard-to-fake reviews.** A review counts only if the reviewer really chatted with you and names an order one of you paid a listing fee for — and only their latest review of you counts. See 'How does Morphit stop fake reviews?'. **A locked-down site.** What you send is checked, and pages run only the site's own code. See 'Is Morphit vulnerable to hacking, data theft, or takedowns?'. No software can stop a scammer talking you into a bad deal — see 'What scams should I watch out for on Morphit?'. --- ## How does Morphit stop spam and unsolicited messages from strangers? **FAQ key:** `chat_anti_spam` Three layers keep strangers from flooding you, while normal trade chat stays free. **1. Block.** You can block any account; its messages to you are then simply not delivered. A new account still has to get past the two layers below. **2. A small first-contact fee.** The first message to someone you have never chatted with costs 5 BLURT, paid once per person (90% to the site operator, 10% to the Morphit treasury). It is free if the two of you have already exchanged a message, or if you are writing about one of their live orders — posting an order is an invitation. The fee doubles for each extra stranger a sender contacts within 5 minutes: 5, 10, 20, 40… up to 640 BLURT each. Eight strangers in 5 minutes cost 1,275 BLURT. After 5 quiet minutes it is back to 5. **3. Limits until you reply.** Until you answer someone, they can send you at most 50 messages, and at most 20 unanswered new people can start chats with you in 24 hours. Your first reply lifts both limits for that person. These numbers are fixed in the code and the same on every Morphit site; operators can't change them. --- ## How does the chat inbox work? Can I mute or unmute someone? **FAQ key:** `chat_inbox_features` Tap **Chat** in the header to open your inbox. It works like email: **one card per discussion**, not one per person. Talk with the same trader about three orders and you get three cards. Each card has a "RE:" line naming the order and its state — Live, Canceled, Expired or Paid — or "RE: -" if the chat isn't about an order. Opening a card marks **only that one** read, on all your devices. Unread cards have a green border, and the badge on your avatar (top right), the browser tab and the site icon show the unread count. **Mark all as read** clears them all. Read marks are saved publicly on the chain: anyone can see up to when you read a chat with someone, never what it said. Three tabs: • **Inbox** — everything lands here. • **Starred** — tap the star on a card (or in the conversation's ⋮ menu) to keep it here; tap again to move it back. • **Archived** — tap **Archive** to file a discussion away; it stops counting as unread, and a new message brings it back. **Restore** returns it to the Inbox. Starred and Archived sync between your devices, encrypted; the other person never sees them. **Mute = Block.** In a conversation, open ⋮ → Block: that account can no longer message you. To unmute, go to **Settings → Blocked accounts** and tap Unblock. Blocks are public — see 'If I block someone, will they know?'. --- ## How does Morphit let me know when something happens — a new message, an order filling, feedback arriving? **FAQ key:** `notifications_overview` Morphit tells you about new things in a few ways. The quiet ones are always on; the louder ones are your choice, in **Settings → Notifications**. **Always on (no permission needed):** • The browser tab title starts with the unread count, like "(3)". • The site icon in the tab gets a small dot with the count. • If you installed Morphit as an app, its icon gets a badge (where your system supports it). These work while you are signed in and unlocked. **Your choice (off until you turn them on):** • **Desktop notifications** — a pop-up when the Morphit tab isn't in front. Your browser asks permission the first time one would show. • **Sound** — a short chime. • **Vibration** — a short buzz, on phones that support it. • **Push notifications** — alerts even when Morphit is closed. They travel through your browser maker's push service; see 'How do push notifications work with my privacy?'. **What you're told about:** orders and trade steps, chat messages, and feedback. All three are on by default; switch off any you don't want. **Quiet hours** and **Silence everything** stop pop-ups and sounds. Push notifications still appear (browsers require it), but silently. **While you're away:** if this site offers it, Morphit can also send a short note to an app you use, like email or Telegram. See "How do offline notifications work, and how is my address kept private?". For the chat inbox, see "How does the chat inbox work? Can I mute or unmute someone?". --- ## How do offline notifications work, and how is my address kept private? **FAQ key:** `offline_notifications` If someone sends you a chat message while you're away, Morphit can send you a short note on an app you already use, so you don't miss it. It's off until you turn it on, in **Settings → Offline Notifications**. **Turning it on.** Pick one of the apps this site offers: Matrix, Session, XMPP, Telegram or email. Each site chooses which ones it offers. Type your address for that app and we send a code to it. Type the code in, and it's on. For Telegram it works the other way round: you send our bot a code, and the button does that for you. The code proves the address is yours, so nobody can sign up someone else. **What the note says.** Only "Someone just sent you a chat message on Morphit", with a link. It never says who wrote or what they wrote. The link opens that conversation, and only for you; anyone else who gets hold of it gets nothing. It stops working after 7 days. **When it comes.** Not right away: 10 to 60 minutes after the message, and always on the hour, quarter past, half past or quarter to. (Why is explained below.) You don't get one if you're already on the site, or once you've read the conversation or replied. You get one note per conversation until you look at it, and at most one a day from someone you've never written to. **How your address is kept private.** • It is stored encrypted, and the key that unlocks it is kept apart from the database. A copy of the database alone opens nothing. • It is never shown to anyone. It isn't on your profile, it isn't shown to the people you trade with, and it's never shared with other sites. Once it's saved, even you only see "On". • It is left out of the site's backups and logs. • Only you can add or change it, because every change is signed with your key. • **Turn off** removes one app; **Delete all my addresses** removes everything. Your address is deleted right away. If the site stops offering an app, the addresses saved for it are deleted, or the card shows a button to delete yours. **The honest part.** • The app that brings you the note can read it, the same as any message you get there: it can see that you use this site and when a note came, never who wrote or what. Only Session encrypts it from end to end. That's why notes go out after a random wait, at times shared by everyone: from the moment one arrives, it's much harder to tell which chat message it was about. • To deliver a note, the service the site sends it through (its email, Matrix, XMPP, Session or Telegram account) has to be given your address, as with any message sent to you. • The people who run this site run the server that holds the key, so you're trusting them with your address, as with any service you give an address to. Nothing on the site shows it to them, but whoever controls the server could get at it. **Tip:** for the most privacy, use an address you don't use for anything else. Session needs no phone number or email address at all. --- ## What does "We couldn't safely send" mean? **FAQ key:** `chat_key_changed` The first time you message someone, Morphit remembers their chat key in your browser. Before every later message it checks that the key your site reports still matches. If something doesn't add up, the message is held back instead of sent. **Most common: their key changed.** That happens when your partner resets their keys — or when someone is trying to read your messages. Open ⋮ → **Verify peer** and compare the safety number with them another way (a call, in person). Accept the new key only if the numbers match; until then nothing is sent. Their older messages stay readable but are marked unverified. **Other cases** — the key record looks tampered with, is older than one you've already seen, is missing on the chain, or is garbled. These point to a broken or out-of-date indexer, not to your partner. **What to do:** • Retry once — it may be a hiccup. • Switch to another Morphit site (link at the bottom of the page); each runs its own indexer. • Ask your partner, another way, whether they reset their keys. These checks read the chain through your site's own servers, so they catch a broken indexer, not a lying operator. The safety number protects you there: compare it once with each partner. See also 'How does Morphit chat work?' and 'Are my chats private?'. --- ## My order isn't showing up. What does the fee status mean? **FAQ key:** `order_fee_rejected` An order shows on the public orderbook only after its listing fee is confirmed. **My orders** shows each order's fee status: • **Visible in orderbook** — fee confirmed. All done. • **Verified (attested)** — a BTC or XMR fee the block explorers couldn't answer for, vouched for by two independent community members instead. Your order is live. • **Awaiting attestation** — a BTC or XMR fee still being checked. A paid fee is usually confirmed within minutes of your payment confirming on its own chain. • **Waiting for your BTC fee** — pay the BTC fee to the address shown for that order; it goes live once the payment confirms. • **Not yet verified** — not checked yet. Wait a little. • **Fee payment not received** — no matching fee was found: the payment failed, went to the wrong place, or the transaction ID was wrong. • **Fee underpaid** — the fee was too small. A BLURT fee goes up when you have many live orders or posted many in the last 24 hours. • **Payment already used** — that BTC or XMR payment already paid for another order. One payment pays for one order. • **Fee can't be checked** — post the XMR order again, this time with the transaction key. If an order is stuck on a "Not in orderbook" status, cancel it and post a new one with the right fee. --- ## Signup isn't working. What do these errors mean? **FAQ key:** `signup_stuck` This site's relay creates your Blurt account and pays the fee for you (about 104 BLURT), so it has limits against abuse. What the messages mean: • **"Verifying you're human…" takes long, or "Human verification failed"** — your browser solves a small puzzle (Altcha). Close other tabs, refresh and try again. • **"You've made too many attempts. Try again in an hour."** — too many sign-up tries from your internet connection in the last hour. Shared Wi-Fi counts everyone on it. Wait, or use another network. • **"You recently created an account. Please wait…"** — signups from one connection must be spaced apart (an hour, by default). • **"You've reached today's signup limit"** — your connection's daily limit. Try tomorrow. • **"This instance has reached its daily signup limit"** — the whole site's daily cap. It resets at midnight UTC, or try another Morphit site. • **"Signups are temporarily unavailable"**, **"temporarily out of funds"** or **"Registration is paused"** — the operator has paused signups or needs to top up the relay. Try later, or another site. • **"Your signup token expired or was already used"** — often your connection changed (say, Wi-Fi to mobile data). Refresh and retry. • **"That name was just taken"**, **"isn't allowed"** or **"is reserved"** — pick another name. Names are 3–16 characters: lowercase letters, digits and single dashes, starting with a letter, no dots. • **"Registration was rejected"** — try a different name. • **"The Blurt network did not confirm in time"** — wait a minute and retry with the same name. See also 'What do I need to sign up?', and after signing up, 'What is the welcome bonus and how do I earn it?'. --- ## What is the "Verified chat" badge on a review? **FAQ key:** `verified_chat_badge` A small green check on a review. It means the reviewer and the trader really talked in chat before the review was posted: • at least 2 messages from each side, • spread over at least 15 minutes, • and the two haven't been caught swapping top reviews with each other. Today every new review needs this — a review without such a chat is refused — so all new reviews carry the badge. Some older reviews don't. **What it doesn't prove:** that the two accounts are different people. One patient person with two accounts can chat with themselves. **Why not check IP addresses?** That would mean collecting them, VPNs and Tor would beat it, and honest people on shared Wi-Fi would be wrongly flagged. **How to use it:** as one clue among several. A reviewer with an older account who has reviewed many different traders tells you more than the badge alone. --- ## Why are some reviews greyed out as 'not counted toward rating'? **FAQ key:** `feedback_suppressed` These suppressed reviews still show, but they don't count toward the star rating or review count at the top of the profile. They're greyed out and marked "Not counted toward the rating". A review doesn't count when: • **Same maker:** both accounts were created by the same account (not a Morphit site's signup service) and became active within 5 minutes of each other. • **Back-scratching:** two accounts gave each other 3 or more top reviews (4.8★+ on average) within 7 days and reviewed nobody else. • **Pile-on:** 3 or more accounts left low reviews (2★ or less on average) for one trader within 7 days, and those accounts started around the same time and review almost no one else. • **One favourite:** at least 80% of a reviewer's reviews (5 or more in 30 days), averaging 4.5★+, go to one trader. • It isn't linked to an order, so it can't be tied to a trade. • The same reviewer reviewed this trader again later — only their latest review counts. **Why show them at all?** The chain is public, so hiding them would only pretend. Greyed out says: this exists, but it doesn't count. **Wrongly flagged?** The checks aren't perfect. The operator of the site you're viewing can clear a flag for a pair — contact them. See also "How does Morphit's reputation system work?". --- ## If I block someone, will they know? **FAQ key:** `block_privacy` **Morphit never tells someone you blocked them** — telling a stalker who blocked them only helps them get around it. But a block isn't secret. **What they see:** if they message you, their message shows as not accepted for delivery ("the recipient may not be taking messages from you right now"), without saying why. **What's public:** a block is saved on the Blurt chain, like everything on Morphit. Anyone who reads the chain — or looks up your block list through a site's public data feed — can see whom you blocked and when. Morphit's screens just don't point it out. **If they make a new account:** your block covers only the account you blocked. A new one must pay the first-contact fee (5 BLURT and up, doubling if they rush) — unless they write about one of your live orders, which is free. Also, at most 20 unanswered new people can start chats with you per 24 hours. You can block the new account too. **Changed your mind?** Go to **Settings → Blocked accounts** and tap Unblock. That's public too, and messages sent while they were blocked are not delivered later. See also "How does Morphit stop spam and unsolicited messages from strangers?". --- ## What is Mana on Blurt? **FAQ key:** `what_is_mana` On Blurt, Mana is your voting power. It only decides how much weight your upvotes carry. Think of a stamina bar: each vote uses a little, and it refills by about 20% a day. The more Blurt Power (BP) you hold, the more your votes count. Mana does **not** pay for anything you do. (On Steem and Hive, "Resource Credits" pay for actions; Blurt dropped that.) On Blurt, every action costs a small fee in BLURT, taken from your liquid (unstaked) balance: a transfer, a post, and on Morphit an order, a review or an encrypted chat message. Mana only matters for voting. So the rule is simple: keep a little liquid BLURT in your account and your actions go through. You never have to wait for Mana to refill before you trade. Receiving BLURT is free, so topping up is easy. --- ## What are the minimum hardware requirements to run a Morphit node? **FAQ key:** `node_minimum_requirements` Modest. An old PC or laptop, a small mini-PC, a cheap rented server (VPS) or a Raspberry Pi will do, as long as it meets these minimums: • **CPU:** 2 cores or more (64-bit x86 or ARM). • **Memory:** 4 GB of RAM or more. • **Disk:** 80 GB free or more. An SSD is best. • **System:** Ubuntu 24.04 LTS, or a flavor built on it (Linux Mint 22, Pop!_OS 24.04, Zorin OS 17). The one-command installer refuses anything else, including Debian and older Ubuntu. • **Power and internet:** a machine that stays on. The installer checks your machine before it starts and tells you if anything falls short. **What you don't need:** • Your own blockchain node. Morphit reads the Blurt network through public servers. • A static IP. At home, the installer keeps your domain pointed at you even when your address changes (dynamic DNS). • A domain, if you choose Tor-only. Your site then lives at a `.onion` address. • A data center. But a normal (clearnet) site run from home will expose your home IP address to every visitor. A Tor-only site does not. One cost to know: your relay pays about 104 BLURT for every account it creates, so a site that signs up many people can lose money if very few people on it are actually trading. --- ## Can I use Morphit on my iPhone or iPad? **FAQ key:** `iphone_install` Yes. Morphit is a web app (a PWA), so there is nothing to get from the App Store and no jailbreak. To put it on your Home Screen: 1. Open this site in **Safari**. 2. Tap **Share** (the square with an arrow pointing up). 3. Tap **Add to Home Screen**. 4. Tap **Add**. The new icon opens Morphit full screen, like an app. Notifications on iPhone and iPad need iOS 16.4 or newer, and work only from the Home Screen icon. --- ## Is there a block explorer for Morphit? **FAQ key:** `block_explorer` Yes. Go to [the explorer](/explorer) to look up any Blurt account, transaction or block. It is public and needs no account. Morphit's own actions (orders, reviews, chat messages, which stay encrypted, and more) are labelled in plain words, so you can tell what each one is. Payments in other coins happen on their own blockchains. When a transaction ID for one of them appears in a chat, Morphit links it to an outside explorer for that coin, for example mempool.space for Bitcoin and xmrchain.net for Monero. The site's operator can change these links. On this site's Tor, I2P or Lokinet address these links open only explorers that are on Tor or I2P themselves; a coin that has none shows no link. --- ## Can I build a block explorer or aggregator on top of Morphit's data? **FAQ key:** `public_api` Yes, and it is free. Every Morphit instance serves the same read-only public API under `/v1/*`: no API key, no signup. Only the hostname changes. • **Reference:** `docs/API.md` in the source lists every endpoint, for example `/v1/orderbook` (live updates at `/v1/orderbook/stream`), `/v1/orders/:account`, `/v1/accounts/:account/feedback`, `/v1/instances` and `/v1/health`. RSS, Atom and JSON feeds live under `/rss/orderbook`. • **Stability:** documented `/v1` fields are never renamed or removed without a new `/v2`. New fields can appear, so ignore ones you don't know. • **Rate limits:** by default 120 requests a minute per IP for lists and 600 for single-record lookups. Each operator can change these. Going over returns `429` with a `Retry-After` header. • **Writing:** the API doesn't change data. Orders, reviews and chat are Blurt transactions you sign yourself; an instance only passes a signed transaction on (`POST /v1/broadcast`). • **Chat:** messages are on-chain but encrypted. Only the two people in the chat can read them. For heavy use, run your own instance (see `RUN-A-MORPHIT-NODE.md`): no rate limits, and no dependence on someone else's server. Use `/v1/instances` to find other instances and spread your load. All of this data is on the public Blurt chain anyway. The API just saves you from building your own indexer. --- ## What is the featured slot and how does the auction work? **FAQ key:** `what_is_featured_slot` Featured slots put up to **3** orders in a highlighted spot at the top of the orderbook and on the home page of **this site**. Each site runs its own, so a bid here only buys space here. **How to bid.** In [My orders](/my/orders), pick one of your live orders whose listing fee is confirmed, and choose 6, 24 or 72 hours. You pay the site's hourly price times the hours, in BLURT. Each operator sets their own price, and the form shows the total before you pay. 90% goes to the site's operator and 10% to the Morphit treasury. **Who gets the slots.** Bids rank by BLURT paid per hour; at the same rate, the earlier bid wins. Because the form pays the site's current price, slots usually go first come, first served. If all 3 are taken, your bid waits and shows when a slot frees up. Your hours start counting as soon as the bid is recorded, even while it waits. To push someone out, a bid must pay at least 1 BLURT an hour or 5% more than them, whichever is bigger; the form checks this before you pay. **No refunds.** The BLURT goes out with the bid and is not returned. See 'What happens to my featured slot if someone outbids me?' --- ## What happens to my featured slot if someone outbids me? **FAQ key:** `featured_slot_displaced` Your bid stays on record, but it drops out of view. Nothing is refunded. Morphit shows the 3 bids paying the most BLURT per hour. If a new bid beats the lowest of the 3 by at least 1 BLURT an hour or 5% (whichever is bigger), that lowest bid drops to 4th place and leaves the featured spot. If a bid above yours ends while your hours are still running, yours comes back. Your hours keep counting the whole time: you paid for a chance at the slot during those hours, not for guaranteed visibility. **What helps:** • **Outbid alerts.** If you turned on push notifications, Morphit tells you when you're pushed out, with a link to the order in My orders. My orders also marks the bid "Outranked". • **No last-second sniping.** When a new bid comes in and a top-3 bid ends within 5 minutes, that bid gets 5 more minutes. This can happen up to 6 times per bid (30 minutes in all), so you have time to respond. • **Look first.** Before bidding, check what the current slots pay, and prefer shorter bids when competition is high. --- ## How can I be sure no one is reading my chats? (Verify safety number) **FAQ key:** `verify_peer_fingerprint` Morphit chats are end-to-end encrypted: messages are locked on your device, and only you and your partner can open them. There is one weak spot. The first time you chat with someone, your browser trusts the chat key your site's server says is theirs. A dishonest server could slip in its own key and read along. **The safety number lets you rule that out.** If your partner's key changes later, nothing is sent to the new key until you check the new number and accept it (see 'What does "We couldn't safely send" mean?'). **How to check:** 1. Open the chat and tap ⋮ → **Verify peer**. 2. You see 60 digits in 12 groups of 5. Your partner opens the same screen. 3. Compare the digits by voice call, in person, or another channel you both already trust. **Not in this chat.** 4. If every digit matches, nobody swapped a key. If even one differs, treat the chat as compromised and stop. **What it can't catch:** the wrong person on the call (you must recognise them), a hacked phone, or a dishonest copy of the app itself. Checking is optional and posts nothing to the chain. The number is made from public keys only, and faking a match is far out of reach. --- ## What is QR login and is it safe? **FAQ key:** `qr_login` QR login signs you in to Morphit on a computer using your phone, without typing your seed phrase. **How it works:** on the computer, choose **Sign in with your phone via QR**. A one-time code appears; it works for 5 minutes. On your phone (signed in and unlocked), tap your avatar → **Sign in to another device** and scan the code. Your phone shows the website's address. Tap **Yes, that was me** only if you just opened that site yourself. **Why it's safe:** your keys never leave your phone. The code is only a request, so a screenshot of it is useless without your phone saying yes. The server just passes along a sealed message it can't read or fake. **Watch out:** read the website address on your phone carefully. A fake site can look almost the same (a 1 instead of an l). If you didn't just open it, tap **No, I didn't**. **Good to know:** the computer is read-only. You can browse and see your orders and profile there, but to post, send messages, leave reviews or read encrypted chats, use your phone. If you lose your phone, sign in with your written seed phrase. --- ## What is USDT (Tether)? **FAQ key:** `what_is_usdt` USDT (Tether) is a stablecoin: a crypto token made to stay worth about 1 US dollar. It is issued by the company Tether. People use it to hold dollar value without leaving crypto. On Morphit you can buy and sell USDT person to person on four networks: Ethereum (ERC-20), Tron (TRC-20), Solana (SPL) and BNB Smart Chain (BEP-20). You must pick the network for every trade; see 'Which USDT network should I pick — ERC-20, TRC-20, SPL, or BEP-20?' USDT is for trading only. You can't pay Morphit's fees with it: listing fees are paid in BLURT, BTC or XMR, and first-message and featured-slot fees in BLURT. --- ## What is USDC? **FAQ key:** `what_is_usdc` USDC (USD Coin) is a stablecoin: a crypto token made to stay worth about 1 US dollar. It is issued by the company Circle. On Morphit you can buy and sell USDC person to person on four networks: Ethereum (ERC-20), Solana (SPL), Base and Polygon. Pick one that both you and your trading partner use. The order form makes you choose, because coins sent on the wrong network can be lost. USDC is for trading only: Morphit's fees are never paid in USDC. For the honest privacy trade-offs, see [the USDC privacy guide](/privacy/usdc). --- ## Why does Morphit show a chip about how USDT is issued and transmitted? **FAQ key:** `why_usdt_warning` Morphit shows this chip to share two facts, so you can choose with open eyes: • **Tether can freeze addresses.** Tether, the company behind USDT, can freeze the USDT at an address, and has done so. • **USDT payments are public.** On all four networks (Ethereum, Tron, Solana, BNB Smart Chain) anyone can see the transactions. That's how those chains work, not something special about USDT. This doesn't make USDT bad: it holds a steady dollar value and is easy to trade almost anywhere. If privacy matters most, XMR is the better tool. If you want a coin no company can freeze, look at BTC, BLURT, BCH, LTC, DASH, DOGE, DCR, SOL, ETH, or XRP. The chip is information, not a verdict. --- ## Why does Morphit show a privacy warning when I trade USDC? **FAQ key:** `why_usdc_warning` For the same reason as USDT: USDC is a stablecoin run by a company. The warning shares two facts: • **Circle can freeze addresses.** Circle, the company behind USDC, can freeze the USDC at an address on any supported network, and has done so. • **USDC payments are public** on all four networks (Ethereum, Solana, Base, Polygon). The other coins here (XMR, BTC, BLURT, BCH, LTC, DASH, DOGE, ZEC, ARRR, DCR, SOL, ETH, XRP) have no company that can freeze them. Many traders accept this trade-off for a steady dollar value, and that's fine. The warning appears on Morphit's order form and in the window where you share an address; it never blocks anything, it just makes sure the choice is yours. An operator can also switch USDC off for their whole site. If so, pick another coin or another site. --- ## Which USDT network should I pick — ERC-20, TRC-20, SPL, or BEP-20? **FAQ key:** `which_usdt_network` Pick a network that you and your trading partner both use. Rough fees, as shown in the order form: • **Tron (TRC-20):** about $1, fast. The most common for person-to-person trades. • **Ethereum (ERC-20):** about $5–20, slow. Accepted almost everywhere. • **Solana (SPL):** under $0.01, fast. Needs a Solana wallet on both sides. • **BNB Smart Chain (BEP-20):** about $0.30, fast, less common. There is **no default** on Morphit: the order form won't post a USDT order until you choose. That's on purpose, because USDT sent on the wrong network can be lost for good. Take extra care with Ethereum and BNB Smart Chain: their addresses look the same (both start with `0x`). Before you send, check the network named next to the address in the chat. --- ## Which USDC network should I use? **FAQ key:** `which_usdc_network` Pick a network that you and your trading partner both use. Rough fees, as shown in the order form: • **Solana (SPL):** under $0.01, fast. Needs a Solana wallet on both sides. • **Base:** about $0.01, fast. Works with Ethereum-style wallets. • **Polygon:** about $0.01, fast. Also works with Ethereum-style wallets. • **Ethereum (ERC-20):** about $5–20, slow. Accepted almost everywhere, but costly for small trades. **Watch out:** Ethereum, Base and Polygon addresses look exactly the same (they all start with `0x`), but each network keeps its own separate balance. If you send USDC on Polygon to an address your partner gave you for Base, it lands on Polygon and their Base wallet won't show it. The order form makes you choose a network, and a shared address in the chat says which network to send on. Always check it before you send. --- ## What is DAI? **FAQ key:** `what_is_dai` DAI is a stablecoin: a coin meant to stay worth about one US dollar. It is run by MakerDAO, not by a single company like Tether (USDT) or Circle (USDC). • **No freeze button.** The DAI token itself gives nobody a way to freeze your address. • **Partly backed by USDC.** Some of what keeps DAI at $1 is USDC, which Circle *can* freeze. So DAI is more independent than USDT or USDC, but not fully. • **Not private.** Every DAI payment is public on its blockchain. On Morphit you can trade DAI on four networks: Ethereum, Polygon, Base and Arbitrum One. You pick one when you post, and both of you must use that same network (see "Which DAI network should I use?"). You can't pay listing fees in DAI — those are paid in BLURT, BTC or XMR. More tips: [DAI privacy guide](/privacy/dai). --- ## Why does Morphit show a privacy warning when I trade DAI? **FAQ key:** `why_dai_warning` Because DAI is only partly independent, and never private. The warning says three things: • **No freeze button on DAI itself.** Unlike USDT and USDC, nobody can block your address on the DAI token. That is a real plus. • **Some backing is USDC.** Part of what keeps DAI at $1 is USDC, and Circle can freeze USDC. So Circle's power reaches DAI indirectly. • **Everything is public.** Anyone can see DAI payments on Ethereum, Polygon, Base and Arbitrum. The warning is just information — it never stops you from trading. A site's operator can also switch DAI off for their whole site. --- ## Which DAI network should I use? **FAQ key:** `which_dai_network` Use a network you and your trade partner both have. Morphit supports DAI on four: • **Ethereum (ERC-20)** — works almost everywhere, but fees are high (often $5–20 a payment). • **Polygon** — low fees, usually cents. • **Base** — Coinbase's network on top of Ethereum; low fees. • **Arbitrum One** — another network on top of Ethereum; low fees. **Be careful:** all four use the same kind of address (`0x…`), so an address looks identical on every one. But each network keeps its own separate balance. DAI sent on the wrong network may be lost, or very hard to get back. You pick the network when you post the order, and the address you share in chat names it too. Still, agree on the network in chat before anyone sends. --- ## How does arbitrage between Morphit and centralized/decentralized exchanges work? **FAQ key:** `arbitrage_morphit_vs_exchanges` Morphit keeps arbitrage cheap. Posting an order costs only a small listing fee (about 12.5¢ in BLURT, or 25¢ in BTC or XMR). Replying to someone else's order costs no Morphit fee, just Blurt's tiny network fee. And because Morphit never holds your coins, there are no withdrawal fees, limits or waiting times. If you see a price gap between Morphit and an exchange (Coinbase, Kraken, Uniswap and so on), post an order on the cheap side. Choose **Market price** and add a small +/- percent: the order then follows the market rate, so you never have to re-price it. How you settle is up to you and your trade partner: wallet to wallet for crypto-for-crypto, or any payment method you both agree on. One limit: an account with more than 3 orders live (or posted in the last 24 hours) pays a higher BLURT fee for each extra one — 1.25× for the 4th, 1.56× for the 5th, and rising. It is there to stop spam. --- ## Can I market-make or run a trading bot on Morphit? **FAQ key:** `market_making` Yes. Morphit welcomes market makers and bots. • **Low cost.** There's no maker or taker fee. Posting an order costs a small listing fee (about 12.5¢ in BLURT, or 25¢ in BTC or XMR); replying to someone else's order costs no Morphit fee. • **Orders that price themselves.** Choose **Market price** with a +/- percent, and the order follows the market rate on its own. • **Open data.** Read the orderbook through the public `/v1` API and its live stream, the RSS feeds or the read-only MCP tools — no API key, no signup, no KYC. • **Your keys, your coins.** An order is a plain Blurt transaction. Your bot signs and sends it itself; Morphit never holds your funds. One limit: an account with more than 3 orders live (or posted in the last 24 hours) pays a higher BLURT fee for each extra one — 1.25× for the 4th, 1.56× for the 5th, and rising. A bot that keeps many orders open pays that higher rate when it pays in BLURT; the BTC and XMR fee stays the same. --- ## What is DOGE on Morphit? **FAQ key:** `what_is_doge` DOGE is Dogecoin, one of the best-known coins. Like Bitcoin, every payment is public on its blockchain. No company issues it, and nobody can freeze your coins. It is merge-mined with Litecoin, so the same miners help secure both. On Morphit, DOGE is **trade-only**: you can buy and sell it, but you can't pay listing fees with it (those are paid in BLURT, BTC or XMR). **Addresses** start with `D` (most common), or with `9` or `A` (rare). **Privacy:** Dogecoin has no privacy features. Use a fresh receive address for every trade — most wallets make one for you. More tips: [DOGE privacy guide](/privacy/doge). --- ## What is ZEC on Morphit? **FAQ key:** `what_is_zec` ZEC is Zcash. With Zcash you choose, per address, whether payments are public or private: • **Transparent addresses** (`t1…`, `t3…`) work like Bitcoin: anyone can see who paid whom, and how much. • **Shielded addresses** (`zs1…`, and the newer `u1…`) keep payments private: when both of you use shielded addresses, the sender, the receiver and the amount are hidden. Morphit accepts all of these. Agree with your trade partner which kind to use — some older wallets can't send to `u1…` addresses. On Morphit, ZEC is **trade-only**: you can buy and sell it, but you can't pay listing fees with it (those are paid in BLURT, BTC or XMR). More tips: [ZEC privacy guide](/privacy/zec). --- ## What is Pirate Chain (ARRR), and why is it on Morphit? **FAQ key:** `what_is_arrr` Pirate Chain (ARRR) is a coin where **every** payment is private: the sender, the receiver and the amount are always hidden. It has no public (transparent) addresses at all. It is on Morphit so people can trade it person to person, without ID. On Morphit, ARRR is **trade-only**: you can buy and sell it, but you can't pay listing fees with it (those are paid in BLURT, BTC or XMR). **Addresses** start with `zs1` and are 78 characters long. They look exactly like Zcash addresses, so check that the order says ARRR, and receive with a Pirate Chain wallet. A site's operator can switch ARRR off for their site; other Morphit sites can still trade it. More tips: [ARRR privacy guide](/privacy/arrr). --- ## What is Decred (DCR), and why is it on Morphit? **FAQ key:** `what_is_dcr` Decred (DCR) is secured by both miners and coin holders: miners make each block, and holders with staking "tickets" vote on it. Holders also vote on changes to the rules. Payments are public by default, like Bitcoin. The Decred wallet has optional mixing (CoinShuffle++) for more privacy. On Morphit, DCR is **trade-only**: you can buy and sell it, but you can't pay listing fees with it (those are paid in BLURT, BTC or XMR). **Addresses** start with `Ds` (most common) or `Dc`, and are 35 characters long. Use a fresh one for each trade. A site's operator can switch DCR off for their site; other Morphit sites can still trade it. More tips: [DCR privacy guide](/privacy/dcr). --- ## What is Solana (SOL), and why is it on Morphit? **FAQ key:** `what_is_sol` Solana (SOL) is a fast proof-of-stake blockchain: validators who stake SOL take turns making blocks. Nobody can freeze your coins. Every payment is public. On Morphit, SOL is **trade-only**: you can buy and sell it, but you can't pay listing fees with it (those are paid in BLURT, BTC or XMR). **Addresses** are 32–44 letters and numbers (most are 44). A SOL address looks just like a USDT or USDC address on Solana, so check that the order says SOL. **Copy and paste addresses — never type them.** Solana addresses have no built-in typo check, so a mistyped one can be a real address nobody owns, and the coins are lost. Use a fresh address for each trade. A site's operator can switch SOL off for their site; other Morphit sites can still trade it. More tips: [SOL privacy guide](/privacy/sol). --- ## What is Ethereum (ETH), and why is it on Morphit? **FAQ key:** `what_is_eth` Ethereum (ETH) is the coin of the Ethereum blockchain, which has run on proof-of-stake since 2022. Nobody can freeze your ETH. Every payment is public. On Morphit, ETH is **trade-only**: you can buy and sell it, but you can't pay listing fees with it (those are paid in BLURT, BTC or XMR). **Addresses** start with `0x` and are 42 characters long. An ETH address looks exactly like a USDT, USDC or DAI address, so check that the order says ETH. Morphit trades ETH on the main Ethereum network only — not on Base, Arbitrum or Polygon. **Paste the raw `0x…` address, never type it.** Morphit doesn't accept names like `alice.eth` and doesn't check an address's typo checksum. Also make sure it is a normal wallet address, not a smart contract, which may refuse the ETH. A site's operator can switch ETH off for their site; other Morphit sites can still trade it. More tips: [ETH privacy guide](/privacy/eth). --- ## What is Ripple (XRP), and why is it on Morphit? **FAQ key:** `what_is_xrp` XRP is the coin of the XRP Ledger. There is no mining: a list of trusted validators agrees on each new entry. Nobody can freeze native XRP. Every payment is public. On Morphit, XRP is **trade-only**: you can buy and sell it, but you can't pay listing fees with it (those are paid in BLURT, BTC or XMR). **Addresses** start with `r` and are 25–35 characters long. Two things to know before you trade: • **No destination tags.** Morphit can't pass along a destination tag (the extra number exchanges ask for). So whoever receives the XRP must share their own wallet's address — never an exchange deposit address, or the XRP can land in the exchange's pool and never reach them. • **1 XRP minimum for a new address.** An XRP address only exists once it holds at least 1 XRP. Sending less to a brand-new address fails, so its first payment must be at least 1 XRP. A site's operator can switch XRP off for their site; other Morphit sites can still trade it. More tips: [XRP privacy guide](/privacy/xrp). --- ## What is Bitcoin Cash (BCH), and why is it on Morphit? **FAQ key:** `what_is_bch` Bitcoin Cash (BCH) is a coin that split off from Bitcoin in 2017. Like Bitcoin, every payment is public, and nobody can freeze your coins. On Morphit, BCH is **trade-only**: you can buy and sell it, but you can't pay listing fees with it (those are paid in BLURT, BTC or XMR). **Addresses:** Morphit accepts the modern CashAddr format (`bitcoincash:q…` or `bitcoincash:p…`, with or without the `bitcoincash:` part) and the old format starting with `1` or `3`. Old-format BCH addresses look just like Bitcoin addresses, so check that the order says BCH. Use a fresh address for each trade; CashFusion (optional mixing in some BCH wallets) can add privacy. A site's operator can switch BCH off for their site; other Morphit sites can still trade it. More tips: [BCH privacy guide](/privacy/bch). --- ## What is Litecoin (LTC), and why is it on Morphit? **FAQ key:** `what_is_ltc` Litecoin (LTC) is one of the oldest coins, started in 2011 from Bitcoin's code. Like Bitcoin, payments are public and nobody can freeze your coins. On Morphit, LTC is **trade-only**: you can buy and sell it, but you can't pay listing fees with it (those are paid in BLURT, BTC or XMR). **Addresses:** Morphit accepts addresses starting with `L`, `M`, `3` or `ltc1`. An LTC address starting with `3` looks like a Bitcoin address, so check that the order says LTC. **Privacy:** Litecoin has an optional private mode called MWEB, but MWEB addresses (`ltcmweb1…`) can't be shared on Morphit — you receive LTC at a regular address. Use a fresh one for each trade. A site's operator can switch LTC off for their site; other Morphit sites can still trade it. More tips: [LTC privacy guide](/privacy/ltc). --- ## What is Dash (DASH), and why is it on Morphit? **FAQ key:** `what_is_dash` Dash (DASH) is a Bitcoin-style coin: payments are public by default, and nobody can freeze your coins. Dash wallets offer optional mixing called PrivateSend for more privacy. On Morphit, DASH is **trade-only**: you can buy and sell it, but you can't pay listing fees with it (those are paid in BLURT, BTC or XMR). **Addresses** start with `X` (most common) or `7`, and are 34 characters long. Use a fresh one for each trade. A site's operator can switch DASH off for their site; other Morphit sites can still trade it. More tips: [DASH privacy guide](/privacy/dash). --- ## I'm a wallet developer — can I integrate Morphit's orderbook into my wallet UI? **FAQ key:** `wallet_developer_api` Yes, please. Every Morphit site serves the same free, public, read-only API at `/v1/…` — no API key, no signup. It is documented in `docs/API.md` in the source code. **What you can build:** • An orderbook screen filtered to the coins your wallet supports (`/v1/orderbook?asset=…`) • Live updates without polling (`/v1/orderbook/stream`) • Trader reputation: rating and feedback count (`/v1/accounts//feedback`); each orderbook entry also carries the trader's rating and completed trades • Order details: amounts, payment methods, region, terms **Good to know:** • Writing doesn't go through the API. Posting an order or a reply is a Blurt transaction your wallet signs with the user's keys. • Chat is end-to-end encrypted inside the user's app. Most chat routes are deliberately left out of `docs/API.md`; open an issue if you need them. • The default limit is 120 list requests a minute per IP. Need more? Run your own Morphit node. • `/v1/instances` lists other Morphit sites. They all read the same Blurt chain, so their orderbooks largely match (an operator can switch some coins off). • TypeScript types for the responses are in `packages/indexer-client`. • To import Morphit's 12-word seed phrases, see `docs/SEED-IMPORT-FOR-WALLET-DEVELOPERS.md`. Morphit's code is AGPL-3.0. Questions? Join `#agorise:matrix.org` or open an issue at git.agorise.net/agorise/morphit. --- ## How do I get people to use Morphit? **FAQ key:** `how_to_spread_morphit` Word of mouth. Every person you bring makes the orderbook more useful for everyone. Ideas that cost little or nothing: • **Write about it** on Blurt.blog, your own blog or Substack, and share it where it's on-topic. • **Demo it at meetups** — Bitcoin, Monero, privacy, freedom-tech and agorist groups. Five minutes is enough. • **Print flyers and stickers** with a big QR code to your site and one line, like "Buy crypto, no ID". Try community boards, cafés, libraries, campuses and factory gates at shift change. • **Reach other coin communities.** Morphit supports Ethereum, Solana, XRP, Pirate Chain, Decred and more — "trade your coin person to person, no KYC" lands well. • **Operators:** pay a local promoter a small salary plus bonuses in BLURT for new signups, first trades or demos. **Don't:** • Spam groups you're not part of — it burns the name. • Pitch people happy with their exchange. Pitch the unbanked, the privacy-minded and people whose accounts got frozen. • Overpromise. Morphit has no escrow, no referee and no guaranteed buyers. Orders posted on one Morphit site show up on the other Morphit sites too, so local growth helps everyone. --- ## What is two-factor authentication and how do I enable it on Morphit? **FAQ key:** `totp_2fa_what_is_it` Two-factor authentication (2FA) means unlocking your account in Morphit takes two things: your password, plus a 6-digit code from an app on your phone. The code changes every 30 seconds and can't be used twice while the page is open. It's optional. Morphit will never force it on you or nag you about it. To turn it on, go to Settings → Two-factor authentication (2FA) → **Set up 2FA**. Install an open-source authenticator app (we suggest Aegis, 2FAS or Ente Auth), scan the QR code, type the code the app shows, and save your 10 backup codes somewhere safe. The option is there when your account is saved on this device with a password. Honest limits: 2FA is a lock inside the app, not extra encryption. It stops someone who learned your password from unlocking your account in Morphit. But the 2FA secret sits in the same encrypted file as your keys, so someone with that file AND your password could open it with other software. For a factor that is never in that file, use a YubiKey in YubiKey-only mode (Settings → Hardware key). --- ## I lost my authenticator app — how do I get back in? **FAQ key:** `totp_2fa_lost_authenticator` Use a backup code. When you set up 2FA, Morphit gave you 10 backup codes (they look like `XXXX-XXXX`). On the unlock screen, type one where it asks for the 6-digit code — the box takes either. Each backup code works once; Morphit marks it used. No backup codes left? Sign in again with your 12-word seed phrase: on the unlock screen choose **Sign in with seed phrase**, type the 12 words and choose a new password. Your keys come from the seed, so you get everything back. 2FA is off after that; you can set it up again. (If you joined with an existing Blurt account, you have no seed — use the **Blurt posting key** option instead.) Nobody can reset 2FA for you. Morphit never holds your keys, so if you lose the authenticator, the backup codes AND the seed, the account can't be recovered. --- ## Why doesn't Morphit recommend Google Authenticator? **FAQ key:** `totp_2fa_why_not_google_authenticator` Two reasons: • **Closed source.** Nobody outside Google can check what it does with your 2FA secrets. • **Cloud sync.** It backs up your 2FA secrets to your Google account by default (you have to opt out), and they aren't end-to-end encrypted with a password only you know. Anyone who takes over your Google account could get all your codes at once — which defeats the point of a *second*, separate factor. Morphit suggests open-source apps where you decide where backups go: **Aegis** (Android, encrypted local backups), **2FAS** (iOS and Android, cloud backup only if you turn it on) or **Ente Auth** (every platform, end-to-end encrypted sync). Already use another authenticator you trust, such as KeePassXC or Bitwarden Authenticator? That's fine. Our list is a suggestion for new users, not a ban. --- ## How does Morphit keep my privacy-coin trades private? **FAQ key:** `privacy_coins_onchain` Morphit trades several privacy coins — XMR, DASH, ZEC, ARRR, and DCR — and protects them all the same way. **Your coins never touch Morphit's chain.** You send them straight from your wallet to your trade partner's, on that coin's own network. The Blurt chain Morphit uses carries only the public listing, your encrypted chat, any listing fee paid in BLURT and, if you leave one, your public review. **What a listing shows.** A listing is an ad, so its side (buy or sell), coin, currency, price, amount range, payment methods, region (if you set one) and terms are public — that's how people find it. Nothing extra is added: the listing's ID is a random code (`order-…`) that doesn't name the coin, the expiry is rounded down to the day, and no IP address, time zone or browser details are attached. It does carry the language you choose and the tag of the site you post from. **Amount jitter.** When you share a receive amount in chat, Morphit adds a tiny random amount so the payment can't be matched to your listing by its size. It's on by default. **Listing fees.** You pay in BLURT (the default), or in BTC or XMR where the site accepts them — never in ZEC, ARRR, DASH or DCR, so their transaction IDs never appear on the Blurt chain. If you pay in XMR, that fee payment's transaction ID and key are written into your listing. Want no Monero link at all? Pay in BLURT; at the base rate it is also half the price. Each coin has its own [privacy guide](/privacy) — for example [Monero](/privacy/xmr). --- ## What is Barter on Morphit? **FAQ key:** `what_is_barter` Barter lets you buy or sell goods and services — baskets, bike repairs, a crate of oranges — and settle in crypto. **How it works:** • Describe exactly what you're offering in the Terms (required). • Set its value in your local currency — one price or a range. • Tick the crypto(s) you'll accept, say XMR, BTC and DOGE. It's **one listing**, not one per coin. When you and the buyer settle up in chat, Morphit only lets you share a payment address or report a payment in the coins the listing accepts. **Goods change hands outside Morphit** — in person or by post — and Morphit never touches the goods or the payment. Meet in a public place, share only what you need to, and treat a stranger like a stranger. Barter is for trading wares only: you can't use it to pay Morphit's listing fee. --- ## What is a Transaction ID (or Hash)? **FAQ key:** `what_is_a_txid` When you send crypto, the blockchain gives that payment a unique ID called the Transaction ID. Wallets name it differently: “TxID”, “Transaction Hash”, “Tx Hash” or just “Hash” (Mycelium, for example, calls it “Hash”). It's a long string of letters and numbers, usually 64 characters (Blurt's are 40). To find it: open your wallet, tap the payment you sent, and copy the ID or Hash it shows. Pasting it into Morphit lets your trade partner — or, for a listing fee, Morphit — check that the payment really happened. Anyone with the ID can look the payment up on a public block explorer. On open chains like Bitcoin that shows the amounts and addresses involved; on Monero it shows very little. --- ## Does anything see or leak my IP address when I use Morphit? **FAQ key:** `ip_address_and_rpc_nodes` **What this site sees.** Like any website, the server gets your IP address with each request. The code keeps it only in memory, for rate limits — about a minute for ordinary requests, up to 24 hours for the signup limits — and never writes it to disk or a log, or sends it anywhere. The web server keeps addresses only in memory for its own limits and short bans, and keeps no access log with them. No cookies, analytics, trackers or telemetry. Orders, encrypted chat, balances and the block explorer data are all secured on-chain. **Nobody else.** Your browser talks to this site and to nothing else — no Blurt node, no price service, no tracker. The one exception is push notifications, if you turn them on (sites reachable only over Tor or I2P don't offer them): your browser then also uses its maker's push service (Google, Mozilla, Apple or Microsoft), which delivers each alert encrypted and sees when it arrives — see "How do push notifications work with my privacy?". This site's security policy (its Content-Security-Policy) lets your browser connect to this site only. Every read from the Blurt chain, every broadcast and the daily release check go through this site, which asks the network for you: the network's nodes see this site, never you. **The release check.** At most once a day (and once after each site update, or when you press **Try again** on a fee panel), your browser asks this site for the signed release record that says which Morphit version is current: two small requests — the last 100 entries of @morphit's history, then the block holding the release. If the release is older than those 100 entries, one more history request is made (up to about 115 KB). This site answers only with what two Blurt RPC operators agree on, and your browser checks @morphit's signature itself: nobody can fake a release, though this site could hold back news of a newer one. The result is remembered for 24 hours and shared by all your tabs; if the record names a release older than this site's, your browser asks again within the hour, and if this site could not get an answer, after 12 hours. If your browser blocks this site's storage, it can't remember, so it asks each time you open Morphit. You can watch all of it in your browser's Network tab. **Links you open.** A payment link for another coin opens a public block explorer in a new tab, and that explorer sees your IP like any site you visit. On this site's Tor, I2P or Lokinet address these links open only explorers that are on Tor or I2P themselves; a coin that has none shows no link. **Use Tor or a VPN** to hide your IP from this site and from any explorer you open. --- ## Metadata Total FAQ entries: 147 Canonical URL: https://morphit.io/faq License: AGPL-3.0 (content may be quoted/redistributed) Source of truth: https://git.agorise.net/agorise/morphit