Honest limits — read before any real PRL moves
- One transaction, one sender key. Every input must be spendable by the single sender key you sign with. Multi-sender batches are not supported — split them.
- Dust is refused, never rounded. Any recipient under 333 grains stops the manifest with a loud error. Change under 333 grains is absorbed into the miner fee and disclosed on the review screen — never silently dropped.
- Memos are off-chain labels. They ride along in the unsigned bundle for your bookkeeping and are verified by the fingerprint — they never appear on-chain. Pearl has no smart contracts and no memo field.
- The unsigned bundle commits to the final txid. Under segwit rules the txid covers only the non-witness data, so the bundle's fingerprint and txid survive signing unchanged. Import re-verifies everything and refuses loudly on any mismatch — always pair a bundle with its fingerprint.
- Blockbook is read-only until the single broadcast POST. UTXO scans, fee estimates and tracking are GET-only against the endpoint you configure. If it is unreachable, the page says so — it never presents guesses as data.
- Secrets stay in this page. Keys you paste live in page memory only, are wiped automatically after signing, and are never written to storage or sent anywhere. Verify every address and amount out of band — start on testnet.
- Optional builder tip — off unless you tick it. The Fund step offers an opt-in tip of 1% of the dispatch total to the builder address in the footer. It is never automatic: unticked, no tip output exists. When ticked it appears as its own labeled recipient before you sign; mainnet only, and waived (never rounded up) when 1% would fall below the dust floor.
Recipients manifest — load the cargo
Paste one recipient per line — <address>, <amount>, optional memo — or import a CSV. Every address is bech32m-validated, every amount is dust-checked, duplicates merge into one output when merging is on. Nothing moves on this step.
Cargo manifest VALIDATED
- Recipients
- Total dispatch
- Duplicates merged
| # | Address | Amount | Memo |
|---|
Fund freight — load the inputs
Point at the sender's prl1…/tprl1… address, pull its UTXOs over Blockbook (GET-only) or paste them air-gapped, then pick inputs by hand or let the auto-loader take the largest first. Running totals update live.
Freight ledger
| # | TXID | vout | Value | Conf |
|---|
Running totals
Dispatch review check the bill of lading
The full breakdown before anything is signed. Fee comes from the exact vB formula — fee = keypathTxVBytes(nIn, nOut) × rate, grain-exact. If the numbers don't balance to the grain, the plan is refused.
Bill of lading UNSEALED
Recipients
| # | Address | Amount | Memo |
|---|
Inputs
| # | TXID | vout | Value |
|---|
Fee math
Sign seal the container
Export the unsigned bundle to sign on an air-gapped machine, or sign here. The key must derive the sender address or signing is refused — and every Schnorr signature is re-verified locally before the hex is shown. The key is wiped from memory the moment signing succeeds.
Unsigned bundle
- Fingerprint
- Unsigned txid
Import a bundle
Paste a bundle exported elsewhere — it is fully re-verified (fingerprint, unsigned-txid digest, fee, vBytes) before anything loads.
Local signing
Sealed SIGNED · N/N VERIFIED
- Signatures
- TXID
Broadcast release the shipment
Two explicit confirmations stand between the signed hex and the network. After broadcast, the page tracks the txid and verifies every recipient output on-chain.
Ready to release
- TXID
- Recipients
- Total out
- Fee
…or via your own pearld
Run this against your node's RPC (port 44107) — nothing here touches your node.
Tracking BROADCAST
Standalone txid verifier
Check any batch txid against its manifest — no keys, no signing, read-only.