Ratings · Read the licence, not the landing page
Software wallets
The best software wallets are free, open source, and have no business model pointed at you. The famous ones are free in a different sense: they earn on the swap spread you do not see, and they tell a company you never chose which addresses belong to your IP address.
Tor built in, your own node as a first-class path, reproducible builds, no swap and no fee. Bitcoin only.
MIT, audits published in the repo, simulates every transaction before you sign — and charges 0.25% against MetaMask’s 0.875%.
The one wallet that dropped its third-party default RPC on privacy grounds. GPL-3.0, no swap, no fee — its real risk is a development cadence that has slowed.
What we did · July 14, 2026We read the licence files, the privacy policies and the fee pages — then checked which RPC endpoint each wallet talks to out of the box, and who owns it.
Four wallets take a cut and will not say how much
Exodus, Rainbow, Keplr and Trust Wallet all earn money from your swaps. None of them publishes the number.
Rainbow’s own support page names a “Rainbow Fee” and promises it “will always be visible for you to review” — and never states the percentage anywhere. Exodus goes further and says it charges no swap fee at all, then publishes a separate help article explaining the “spread” between the rate you get and the market rate. That spread is the revenue. It is the same trick the instant exchangers run, and we measured that one directly. A fee you have to reverse-engineer from a quote is not a disclosed fee.
The ranking
Click any row for the quick read, or open a company for its full profile and per-criterion scores. Measured July 14, 2026. How we rate.
HOW WE SCORED THIS — CRITERIA AND WEIGHTS+
The best software wallets are free, open source, and have no business model pointed at you. The famous ones are free in a different sense: they earn on the swap spread you do not see, and on telling a company you never chose which addresses belong to your IP.
Non-custodial, MPC or custodial — and where the key actually sits on your device. Then the licence, as it stands today rather than as folklore remembers it: several well-known wallets have quietly moved to source-available terms that are not open source. Audits count only when the firm is named and the report is public.
The most underrated question in this category: which RPC endpoint does the wallet talk to out of the box, and who owns it? If the default RPC is operated by the wallet’s own vendor, that vendor sees the IP address behind every balance check and every transaction, and can link it to your addresses. We read the default configuration and the privacy policy, and we quote the clause. Can you point it at your own node, and how hard is it?
Does the wallet simulate the transaction and show you the actual outcome before you sign it, and does it warn you about known drainer contracts? The same question as clear signing on a hardware device, asked of software.
The built-in swap is how most free wallets are paid. We record the published service fee — and when a wallet does not publish one at all while still taking a cut of the spread, that silence is the finding and it is scored as one.
Standard BIP39, and whether the seed restores in another wallet. A wallet you cannot leave is a custodian with extra steps.
Which chains genuinely work, from the wallet’s own documentation.
- — The private key ever leaves the device, in any form, for any reason.
- — A closed-source wallet that holds keys and has no published audit.
Weights sum to 100. If we cannot verify a criterion, we delete it rather than score it on impressions — read the methodology.
Is there a free alternative?
The three best wallets here are free, open source, and take nothing from you. That is not a coincidence — it is the finding.
Sparrow, Rabby and Frame top this table, and none of them has a business model pointed at your trades. Frame is the clearest case: it deliberately moved AWAY from third-party default RPCs on privacy grounds, which is the opposite of what a company monetising your data would do. Against them, the household names are closed or source-available, charge between 0.67% and 1% on swaps, and route your queries through infrastructure they or their parent company own. You are not paying for a better wallet. You are paying for the one you have heard of.
What changed since last time
- 2026-07-14Category created; the old five-wallet rating was retired.It scored wallets on "ease of use" and "support" and never once asked who sees your IP address.
Questions
Is MetaMask open source?+
No, and it has not been since 2020. It moved from MIT to a proprietary Consensys licence that permits reading the code but forbids commercial forks beyond a user threshold. The code is source-available, which is not the same thing as open source, and the widely-repeated claim that MetaMask is open source is five years out of date. We checked the LICENSE file rather than repeating the folklore.
What is the problem with a wallet's default RPC?+
Every time your wallet checks a balance or broadcasts a transaction, it asks an RPC endpoint — and that endpoint sees the IP address making the request alongside the addresses being asked about. Whoever runs it can link the two. MetaMask defaults to Infura, and Infura is owned by Consensys, which also owns MetaMask: the same company sits between you and the chain by default. You can point it elsewhere, but doing so disables Smart Transactions and MEV protection, which is a soft penalty for leaving. Phantom is stricter still: there is no supported way to use your own node at all.
Which wallet is actually cheapest to swap in?+
Of the wallets that publish a number, Rabby at 0.25% is the lowest, then Safe (tiered from 0.70% down to 0.05% by size), Zerion at 0.67%, Phantom at 0.85%, MetaMask at 0.875%, and Coinbase Wallet at 1%. But the sharper answer is about the ones that publish nothing: Exodus, Rainbow, Keplr and Trust Wallet all take a cut and decline to state it. Exodus is the most instructive — it advertises no swap fee, and separately publishes a help article explaining the "spread" it earns instead. A fee you cannot look up is not a low fee.
Why do free open-source wallets beat the famous ones here?+
Because the famous ones have a business model pointed at you, and the free ones do not. Sparrow, Rabby and Frame take the top three places, and none of them monetises your trades or your queries. Frame is the clearest proof: it deliberately dropped Infura and Alchemy as defaults on privacy grounds — the exact opposite of what a company that wanted your data would do. This is the finding a site funded by referral commissions structurally cannot publish, because none of these three pays anyone anything.
Safe has the most audited contracts here — so how did Bybit lose $1.4 billion?+
Because the contracts were never the problem. Attackers compromised a Safe developer's laptop and injected malicious JavaScript into the web front-end. Bybit's signers looked at the screen, saw a routine transfer, and approved handing over the wallet. The formally-verified contracts did exactly what they were told. It is the most important lesson on this page: an open-source, formally-verified contract does not protect you if the interface showing you what you are signing has been compromised.
How this is funded
It is not. There are no affiliate links on this page or anywhere on this site, no paid placements, and no sponsored positions. Nobody in this table can buy a place in it, accelerate their inclusion, or influence a score — and none of them paid us anything, because there is nothing here to buy. The full policy.