Monero GUI is the official desktop wallet of the Monero project, free and open source, for Windows, macOS and Linux. It holds only Monero. Volunteers and crowdfunded developers build it, and no company stands behind it.

Most of Monero’s privacy is built into the network: the project says every transaction hides its sender, receiver and amount. The wallet decides the rest: which decoys hide your real spend, which node learns your IP address and sees the transactions you send, and what else the app contacts. For the node, the answer depends on the mode you pick on first launch.

Who Holds the Keys

The keys live in a wallet file on your computer, encrypted with your password. The Monero Project’s documentation says a remote node never receives your private keys or your wallet file and cannot spend your coins; the wallet downloads blocks and checks them for your payments on your own computer. This self-custody claim comes from the project’s own documentation; no independent audit of the GUI has checked it.

A new wallet gets a 25-word seed phrase in Monero’s own format, not the BIP39 standard used by many other coins. It is the most widely used seed format among Monero wallets, so another Monero wallet can restore your funds if this app stops being developed. The GUI shows the words on the computer screen, offers to print a template to write them on, and then asks you to fill in five missing words. It also offers to copy the phrase to the clipboard, while warning you not to store it digitally.

A seed passphrase, which Monero calls a seed offset, changes the keys the phrase produces. The GUI accepts one only when you restore a wallet, not when you create it. A wallet can also be restored from its private keys, or set up as view-only, which shows incoming payments but cannot spend.

There is no account and no reset. If you lose the seed phrase, and the passphrase if you used one, the coins are gone. The GUI has no multisig: the Monero documentation says multisig wallets can be made only with the command-line wallet.

Instead of keeping keys on the computer, the GUI can work with several hardware wallet models, which hold the keys and sign on the device. In Advanced mode it can also sign offline, as in an air-gapped wallet: a view-only wallet on an online computer exchanges files with a full wallet on a computer that never connects.

Simple Mode or Your Own Node

A Monero wallet does not store the blockchain; it asks a node. On first launch the GUI asks you to choose one of three modes, with none selected for you.

Simple mode connects through an open node picked automatically from those that advertise themselves on the Monero network. Anyone can run such a node. Before you continue in this mode, the GUI warns that a malicious node could track your IP address and the block range your wallet asks for, and send you wrong data to learn more about your transactions; you have to tick a box saying you understand. The Monero documentation adds that a remote node sees the transactions you send and which earlier outputs they spend from, and a dishonest one can inflate the fee estimate or hand your wallet biased decoys. Simple mode (bootstrap) uses such a node only until your own copy of the blockchain finishes syncing, then switches to it.

Advanced mode runs a Monero node on your computer, so no outside server sees your wallet’s requests. It needs disk space and time to sync; pruning keeps about a third of the blockchain. Your node then talks to other nodes directly. Monero spreads new transactions through a scheme called Dandelion++, which makes their origin harder to trace, but the project’s documentation says it does not protect against your internet provider or the first node your transaction reaches. Routing your node’s transactions over Tor or I2P takes extra startup options, which the GUI accepts in its node settings.

Only Advanced mode lets you choose your own remote node, for example a node you run elsewhere. The project’s guide warns that some public nodes are run to link IP addresses to transactions and recommends your own node or one run by someone you trust.

Tor and Other Connections

The GUI has no Tor built in. It has a SOCKS5 proxy setting, off by default, which you can point at a Tor client running on your computer. In Advanced mode the proxy covers connections to a remote node; in both Simple modes it covers only update downloads and price lookups, so the automatically chosen node still sees your real IP address.

By default the GUI checks for a new version once an hour; the check can be switched off. Showing your balance in dollars or another currency is off by default; before you can turn it on, the app warns that the price source sees your IP address. It then fetches the price from Kraken or Coinpaprika, and for currencies other than the dollar the exchange rate from a third service, frankfurter.dev. The GUI sends no usage statistics, has no built-in purchase or exchange and never asks for identity documents.

What Monero Hides by Itself

The Monero project says every transaction hides who sent it, who received it and how much, using stealth addresses, ring signatures and RingCT. The recipient and the amount are hidden by the protocol itself. The sender is hidden only among decoys, which the wallet picks, so the quality of that choice depends on the wallet software, as the bugs described below show. The wallet’s part is to pick decoys well and not reveal more around the transaction. The GUI gives you accounts and subaddresses, so you can hand each payer a different address. It has no coin control: you cannot choose or freeze the individual outputs a payment spends.

Vulnerabilities and Incidents

The GUI’s incident history includes three privacy bugs in the core wallet code that it shares with the command-line wallet. In September 2021 the project disclosed two bugs in how the wallet chose decoys, present from version 0.14.1.0 to 0.17.2.2: one could make it clearer that a coin was spent soon after it became spendable, and the other would have exposed real spends in most transactions if network volume rose for a long time. Version 0.17.2.3 fixed both. In June 2023 the project disclosed a high-severity bug in versions 0.13.0.2 to 0.18.2.1: the wallet never picked decoys exactly 10 blocks old, so a payment spending coins of that age could often be traced to its real input. Version 0.18.2.2 fixed it. The project describes the impact of these bugs as a loss of privacy.

In October 2020 a flaw in GUI versions before 0.17.1.0 was published as CVE-2020-26947, rated high: another user of the same computer could plant a library that the wallet would load and gain higher privileges. Version 0.17.1.0 fixed it.

In November 2019 getmonero.org served malicious versions of the command-line wallet for about 14 hours, until a user noticed that the file hashes did not match. The GUI download was not named as affected, but it comes from the same page. The project publishes a list of file hashes signed by a core developer and asks you to check every download against it before running it.

Open Source and Audits

The GUI’s code is open source under the BSD licence on GitHub. The project documents reproducible builds of the Windows and Linux versions, so anyone can rebuild the app and compare it with the release; there is no such procedure for macOS. Signed rebuilds by several builders are published for the bundled node software, but not for the wallet app itself.

No security audit of the GUI has been published. Parts of the Monero protocol have been reviewed by outside cryptographers paid from community donations; in 2020 a review of the ring signature scheme found no security issues in its code. Those reviews cover the cryptography all Monero wallets use, not this app’s own code. A bug bounty covers all code in the Monero Project’s GitHub repositories, including the GUI; it pays in Monero from a pool of community donations, and how much depends on the severity and on what is in the pool.

Who Makes It

The GUI is part of the Monero Project, which calls itself a loose collective of individuals. There is no company and no business model: no part of Monero’s block reward goes to development, and work is funded by donations and the Community Crowdfunding System. The Monero Core Team took over after the project’s early fork and has provided oversight since. The project’s website terms, last revised in 2017, are governed by South African law. The first public beta of the GUI came out in December 2016, and version 0.18.5.4 was released in October 2026.

Price

Monero GUI is completely free to use and has no fee of its own.

Pros and Cons

Runs your own Monero node from inside the app, so no outside server sees your wallet
Warns you about the privacy cost of a remote node before you choose Simple mode
The 25-word seed is the format most Monero wallets read
Works with hardware wallets and offline signing
Open source under the BSD licence, with signed hashes and reproducible Windows and Linux builds
Free, with no fees of its own, no usage statistics and no identity checks

Simple mode connects to an automatically chosen open node whose operator sees your IP address and the transactions you send
No built-in Tor, and in Simple mode the node connection cannot go through a proxy
No security audit of the app, and three decoy-selection bugs weakened privacy until 2023
No multisig and no coin control
Desktop only, and the seed phrase is shown on the computer screen

Our Rating

Monero GUI suits people who hold Monero on a desktop computer and are willing to run their own node in Advanced mode, or to set up a proxy for a remote node they trust. It does not suit anyone who needs a phone wallet, multisig or other coins, or who will stay in Simple mode and expect the node operator to learn nothing.

Key Custody & Recovery7.5/10
The Monero Project's documentation says the keys stay on your computer in a password-encrypted wallet file, and a remote node never receives them. The 25-word seed is the format most Monero wallets read, so the funds are not tied to this app. A seed passphrase can be added only when restoring a wallet, the GUI has no multisig, and losing the seed means losing the funds. Several hardware wallets can hold the keys instead.
Network & Metadata Privacy7.0/10
Advanced mode runs your own node from inside the app, so no outside server sees your wallet. Simple mode instead connects to an open node picked automatically, whose operator sees your IP address and the transactions you send, and the app warns about this before you choose it. Tor works only through a SOCKS5 proxy you run yourself, and in Simple mode the node connection does not use it. There is no coin control, no built-in purchase and no usage statistics.
Security & Transparency7.0/10
The code is open under the BSD licence, releases come with signed hashes, and reproducible builds are documented for Windows and Linux. A community-funded bug bounty covers the code. No security audit of the GUI app has been published. Three privacy bugs in decoy selection and one local privilege-escalation flaw were disclosed and fixed between 2020 and 2023.
Usability & Chain Support7.0/10
The GUI covers Monero, the only network it is built for, with accounts, subaddresses, view-only wallets, hardware wallets and offline signing. Simple mode makes it usable without downloading the blockchain. It runs only on Windows, macOS and Linux, has no phone app, and choosing a remote node or Tor settings requires Advanced mode.
Price & Value10.0/10
The GUI is completely free to use and adds no fee of its own.

Overall7.5/10

Key Custody & Recovery 30% · Network & Metadata Privacy 25% · Security & Transparency 20% · Usability & Chain Support 15% · Price & Value 10%

See our rating methodology →