Final Identity

Your post-quantum identity: one certificate set made on your device, one address on every chain. What it is, how to create one, what it lets you do, how to keep it.

Last updated 2026-09-08 · maintained in the Final Wiki

#What it is

A Final Identity is a Final Certificate set of the wallet-identity profile — the special set of certificates that carry the four wallet key purposes. It has two stages, a live pair and an armed recovery pair, each issued as a public and a private .fcert, and each holding four post-quantum keys: a transaction key (ML-DSA-87), an access key (SLH-DSA-SHAKE-256s) and two key-encapsulation keys (ML-KEM-1024 and HQC-5). Eight keys in all, every one generated on your device.

The identity is attested by the chain — the only root there is — and your Final Wallet's address on every supported chain is derived from it. That is why the same identity has the same address on Ethereum, Optimism, Base, Arbitrum and Polygon, and why nobody can predict your address on a chain where your wallet does not exist yet.

Services, co-signers, guardians and registered issuers are Final Identities too; there is no other kind of identity in the system.

#Creating one

Open the wallet dashboard and choose Register:

Production: <https://wallet.final-de.fi/#register>
Test networks (Sepolia, OP Sepolia): <https://test-wallet.final-de.fi/#register>

Your browser generates the eight keys, mines the address and packs the four .fcert files into your Final Identity archive. Nothing is uploaded: issuance receives commitments to your keys, never the keys, and the identity exists the moment the chain admits its record. Registration runs on both planes — the production chain and the test chain, one ticket each — so the identity is valid wherever your wallet points; the other plane's registration completes on its own once that plane is reachable. Creating the wallet itself on a chain is a separate, one-action step you take when you need it there, on the wallet dashboard opened from the wallet.

You can register today. Final Wallet is live on the five supported EVM chains.

#What it lets you do

Hold one Final Wallet on every supported chain, with sub-accounts under the same identity.
Sign every intent — immediate, after a second look, at a chosen time, or privately — without paying gas yourself.
Take part in the PHI Launch Sale when it opens in month 4, and in morphing, which runs on the Pre-Final Chain now and moves to Final Chain at its launch. vAssets follow; with Final Chain, the Liquidity Cloud follows that.
Act as a guardian for someone else's wallet (with your live access key).
On Final Chain, publish under it on compatible platform modules and prove who you are to any group or authority, disclosing only what you choose — below.

#One identity to publish, and to prove who you are

On Final Chain a Final Identity is also your universal information-source identifier. When you publish on a compatible platform module — a feed, a marketplace, a registry, a forum — the publication carries your identity, and the platform's trust scores attach to it; on such platforms a Final Certificate is mandatory for publishing, so a source is never anonymous noise and never someone else's name. Current apps and platforms become such modules through special connectors, keeping what they are while gaining the identity layer.

The same identity makes identity verification a choice wherever it is asked for — never a condition of using the network; modules that ask for nothing at all will always exist, voted for by holders:

You control what you present. To any group or authority you disclose the attributes it needs and nothing more; each disclosure is yours to make.
Revocation is leaving. Withdrawing a disclosure is leaving the group or module, or closing the account there — with certain overrides where the law fixes an attribute, citizenship for example.
No constant re-verification. Once attested, an attribute is proved from chain state wherever you present it, so the cost of verifying and re-verifying identities disappears for every platform that accepts it.
The saving is shared. Part of what a platform saves goes to the very person who was verified, part to the protocol, part to all holders and node operators. The split is never fixed: it is set dynamically, per group, within limits that keep every party better off. See PHI.

#Keeping it

The private halves are your seed phrase. Offline copies, never uploaded, never pasted into a page. Nobody at Final will ask for them, and nobody at Final can sign for you.
The recovery stage is cold by design. Its keys are the pre-committed successors of the live keys and are used for one thing: rotating your credentials after a delay. Keep that pair apart from the live pair. See the recovery certificates section of Final Certificates.
Losing both stages is terminal. No copy exists anywhere to restore. That is what guardians and the recovery authority are for: Recovery and guardians.

#Status

The identity root is live on all five mainnets and both test networks, and post-quantum-native identity creation is open. The state plane attesting identities today is the Pre-Final Chain; the roots carry over to Final Chain unchanged.