A user wants to move cryptocurrency to self-custody but faces a practical decision at the starting point: whether to download Rabby Wallet on iPhone or Android, what permissions each platform requires, and how the initial setup differs between them. Both versions offer the same core functionality—transaction simulation, gas optimization, hardware wallet support, and access to 90+ EVM chains—but the installation path, permission model, and recovery phrase handling diverge significantly. Understanding those differences before downloading prevents frustration and reduces the risk of mistakes during the critical first-time configuration.

Rabby Wallet is maintained by the DeBank team as a free, open-source self-custody application, available as both a browser extension and a mobile app. The mobile versions represent the most straightforward entry point for users without a computer, yet they also introduce platform-specific constraints tied to iOS App Store review policies and Android’s broader permission framework. Installation itself is routine, but the moment after downloading—when a user must decide whether to create a new wallet or import an existing one—determines whether recovery phrases and private keys remain secure or become exposed to mistakes that no client-side feature can undo.

Where to safely download Rabby Wallet on iOS and Android

The official rabby wallet download occurs through Apple’s App Store for iOS and Google Play Store for Android. Both app stores subject applications to review processes, though iOS review is notably more restrictive regarding wallet functionality and recovery phrase display. Users should verify the developer before downloading: the official publisher is listed as DeBank Labs or a verified DeBank organization account. Checking the app’s publication date, update history, and number of reviews can help distinguish the legitimate version from counterfeit copies that occasionally appear in app stores or through direct downloads from untrusted sources.

For iOS, the App Store listing for Rabby Wallet typically shows a blue or distinctive icon matching the browser extension. Tapping „Get“ initiates download, followed by biometric or password authentication depending on device settings. The app size ranges between 30–50 MB depending on cached data. Android users access Google Play Store, searching for „Rabby Wallet“ and confirming the publisher before installing. The same verification principles apply: match the icon, check the developer, and review recent user feedback for warnings about performance issues or account access problems.

Installation does not require internet connectivity during the download phase itself, but the app must connect to the network before opening for the first time. At that moment, Rabby communicates with Ethereum network nodes and EVM chain RPCs to verify network status and fetch initial chain data. Users on restricted networks, VPNs, or corporate firewalls should confirm that outbound connections to Ethereum providers are not blocked before proceeding. Once downloaded, the app occupies local storage; uninstalling removes private keys, settings, and cached data unless a recovery phrase has been saved elsewhere.

iOS-specific installation constraints and permissions

Apple’s App Store policies place strict limits on what a wallet application can display and how it handles sensitive information. Rabby on iOS cannot show a recovery phrase directly in the app interface in ways that older or less-regulated wallet applications might; instead, the initial seed phrase generation occurs during setup, and users must manually write down the words in the order shown or use Apple’s built-in note encryption. This design choice is intentional: preventing screenshots or copy-paste of the full recovery phrase in one step reduces the risk that a malicious app or compromised device captures the entire secret at once.

The permission model on iOS is also narrower than Android. Rabby requests access to the device’s Keychain (for secure local key storage), network (to connect to Ethereum nodes), and biometric authentication (for local unlock). It does not request access to the photo library, contacts, or other personal data by default. Users who choose to add a profile picture during setup may be prompted to allow camera or photo access, but this is optional. The app respects iOS’s sandboxing: even if compromised, it cannot access other apps‘ stored data or system files.

Device security on iOS is enforced through hardware-backed Secure Enclave, which stores cryptographic material separately from the main processor. When Rabby generates or imports a private key on iOS, the key is sealed within the Secure Enclave and never extracted as plaintext, even to the wallet app itself. This architecture makes key theft from the device substantially harder than on Android, where key storage depends on the device manufacturer’s implementation. Users should still protect their device with a strong PIN or Face ID, as local biometric authentication is the final barrier between an unlocked phone and fund access.

Android installation and permission model

Android’s installation process is similar to iOS in appearance but differs in permission control and key storage architecture. The rabby wallet download from Google Play Store installs the same core application, but Android requires declaration of which capabilities the app may access. Rabby requests permissions for internet access, which is mandatory for blockchain communication. On older Android versions (below API 30), Rabby may request additional permissions such as access to external storage if users choose to export or import wallet data manually. Newer Android versions limit this automatically, restricting the wallet to its sandboxed storage directory.

A critical difference is how Android handles private key storage compared to iOS. While iOS’s Secure Enclave is hardware-backed and mandatory, Android key storage depends on whether the device has a TEE (Trusted Execution Environment) and whether the manufacturer enabled it. Rabby can store keys in Android’s Keystore, which provides encryption at rest and protects keys from extraction if the TEE is available. However, not all Android devices have equivalent security to iOS Secure Enclave. Users on budget or older devices may have weaker key isolation; this does not make Rabby less secure than alternatives, but it highlights why device choice matters for high-value wallets.

Android also lacks the equivalent of Apple’s strict review process. This means users encounter fewer artificial restrictions on recovery phrase display, but it also means malicious apps can be published more easily. Users should never download Rabby from outside Google Play Store, APK download sites, or other unofficial sources. The verified rabby wallet download through the official store ensures that the version installed has not been modified to extract recovery phrases, private keys, or transaction data.

Initial setup: creating versus importing a wallet

The first choice after successfully launching either iOS or Android version determines the security posture from that moment forward. Rabby presents two options: „Create New Wallet“ or „Import Existing Wallet.“ Creating a new wallet generates a fresh recovery phrase (seed) of 12 or 24 words. Importing allows the user to restore a wallet from an existing recovery phrase, such as one created in another wallet application or saved from a previous Rabby installation.

If creating a new wallet, the app generates random words offline using the device’s entropy source. The sequence is displayed once on screen, typically with instructions to write it down on paper and store the paper in a secure location. Some apps offer the ability to copy the recovery phrase, but iOS Rabby restricts this to prevent accidental leakage to cloud storage or clipboard apps. Android Rabby may allow copying but flags this as a risky action with a warning. The best practice on either platform is to write down the words by hand, verify them by reading back, and store the physical record in a location separate from the device.

If importing an existing wallet, the user enters the recovery phrase word by word. The app checks the words against a dictionary to catch typos and warns if the phrase is not recognized as valid. EIP-55 checksum standards and BIP-39 specifications define how recovery phrases are validated. Rabby implements these standards, but a single wrong word can render the entire phrase invalid, producing a different wallet than intended. Users should confirm imported wallets by checking the first Ethereum address displayed; if it does not match the expected address from the original wallet, the recovery phrase was entered incorrectly and should not be used for funds.

Permission and network configuration during first launch

After wallet creation or import, Rabby requires network access to populate the blockchain data and display balances. On first launch, the app connects to publicly available Ethereum and EVM chain RPC endpoints. Users can modify these settings in the app’s network section, pointing to private nodes or alternative providers if desired. The default configuration uses reputable public RPC providers, which means the provider learns your IP address and can observe which addresses you query; this is a common privacy trade-off in blockchain wallets that do not use a proxy.

Users concerned about address linkage can configure Rabby to use Tor or a VPN before launching the app. On iOS, this requires enabling a VPN configuration in system settings before opening Rabby; the app itself does not include a built-in Tor client due to App Store restrictions. Android offers more flexibility: users can install Tor via Orbot and configure Rabby to route through it, though this requires manual setup and slows network requests. For most users, the default configuration is acceptable; for users operating in jurisdictions with network monitoring or those managing high-value accounts, additional privacy layers are worth the setup effort.

Before adding funds to a newly created or imported wallet, users should verify that the address displayed matches expectations. Rabby displays the primary Ethereum address during setup, formatted according to EIP-55 checksum standards, which include capital letters as a checksum to catch typos. Users can create multiple addresses within the same wallet; this is useful for receiving payments in different contexts, though it requires managing which address is which. Hardware wallet integration, available in both iOS and Android versions, allows users to manage keys on Ledger, Trezor, Keystone, OneKey, GridPlus, or BitBox02 devices instead of storing keys on the phone itself.

First transaction: testing with small amounts and understanding fees

The first actual transaction should be a small test transfer to confirm that the wallet setup is correct and that fund recovery is possible if needed. Users should send a tiny amount of ETH or a stablecoin to the Rabby wallet from an exchange or another wallet they control. This test accomplishes several goals: it confirms the address is correct and funds are accessible, it demonstrates how fees are calculated, and it verifies that transaction simulation and gas optimization features are working as expected.

Rabby’s transaction simulation feature shows a preview of the transaction before signing, including a risk assessment. This simulation uses the OpenZeppelin standard security patterns and ERC token approval protocols to identify common mistakes such as sending to contract addresses that do not accept the token, or approving contracts with excessive permissions. Gas optimization through Rabby’s Gas Account feature allows users to pay Ethereum network fees using USDC or USDT balances instead of ETH, which can be more convenient if the wallet holds stablecoins but not ether.

During the first transaction, users should note how long confirmation takes (typically 15 seconds to a few minutes depending on network congestion), what the actual fee was, and how it compared to the estimated amount shown before signing. Understanding fee variability prevents panic later when network demand spikes or when a transaction takes longer than expected. The test transaction also creates a recovery checkpoint: if funds arrive successfully, the setup is confirmed; if the test transaction fails or funds do not arrive, troubleshooting can begin with a small amount rather than a larger balance.

Token approval decoding and phishing prevention

Once the wallet is funded and tested, users will encounter token approvals when interacting with decentralized applications. When a DApp asks to „connect“ or requests permission to spend tokens, Rabby displays a decoded version of the contract interaction, explaining in plain language what the app is asking to do. This feature prevents blindly approving permissions that could allow malicious contracts to drain the wallet.

Rabby’s approval management tool shows all previously approved tokens and contracts, allowing users to revoke access that is no longer needed. This is particularly important because many contracts ask for unlimited approval—permission to spend any amount of a token—to reduce gas costs on subsequent transactions. Revoking unused approvals reduces the surface area for compromise if a DApp’s contract code is later found to be exploitative. Users should regularly audit their approvals and revoke any that they no longer recognize or use.

Phishing prevention is built into address verification: Rabby warns when a destination address is flagged by Chainalysis or other blockchain security services as potentially malicious, though users must understand that no list is comprehensive. The best phishing defense remains manual verification: confirming that a payment destination is correct before signing, checking URLs carefully, and never entering a recovery phrase or private key into any webpage or app other than Rabby itself.

Backup and recovery testing after initial setup

The recovery phrase written down during wallet creation is the single most important piece of information for restoring access if the device is lost, stolen, or deleted. Before moving substantial funds into the wallet, users should test the recovery process: create a new test device or uninstall and reinstall Rabby, then import the recovery phrase to confirm it produces the same wallet and addresses. This test should be performed with a small amount of funds to ensure the recovery process is understood and the recovery phrase is written correctly.

If the recovery phrase is lost or damaged and not backed up elsewhere, the wallet cannot be recovered. Rabby cannot reset or recover a lost recovery phrase because the wallet is non-custodial—only the user holds the key. This is a feature, not a limitation: it means no third party can freeze or reset the account, but it also means fund loss due to backup failure is permanent. Users should store the physical recovery phrase in multiple locations: a home safe, a safety deposit box, or an encrypted note protected by a strong password that is itself stored separately.

After testing recovery and confirming the setup is solid, users can proceed with confidence. The rabby wallet download and initial configuration process is designed to be straightforward, but the moment where the recovery phrase is first displayed is the most critical. Taking time to verify the phrase, test import, and establish a backup routine transforms a casual setup into a secure self-custody foundation. The security of the wallet thereafter depends far more on the user’s backup practices and approval caution than on any feature the application provides.