The mechanism
- The sender's browser generates a random secret and derives a fresh throwaway address from it.
- The sender sends the stock token to that address, plus a small amount of ETH for gas.
- The secret is encoded in the link, in the URL fragment, so it never reaches a server.
- The recipient opens the link. The page creates or connects a wallet and sweeps everything across in one go.
The gift key
Keys are generated with a CSPRNG in the browser. Nothing guessable is used. Not a timestamp, not a counter, not a phrase you type.
The fragment looks like #k= plus sixty-four hex characters. Query strings are forbidden. Logs are forbidden. A server copy is a critical bug.
Whoever holds the link controls the gift. Send it the way you would send a key to a drawer.
Gas, the step naive versions forget
A brand-new address with a token and no ETH cannot move anything. The sender funds gas as part of the gift. Compose will not treat a gift as ready until the sweep cost, with a 3x margin, is sitting on the address.
Gas may rise before the claim. The margin is there so a quieter day at send time still clears a noisier day at open time.
Claiming
The card opens first. Then the honest paragraph, before any holding screen. Then a wallet made in-place for people who have never had one, or an address they already control.
The gift account transfers the token, then sweeps leftover ETH. Claiming twice fails cleanly: already claimed, or never funded.
Shares render through uiMultiplier, not the raw balance. Dividends and splits move the multiplier.
Authenticity
A token on this chain can carry a 34,090-character name containing the substring "Robinhood Token" with tens of thousands of dollars of liquidity. An includes() check would let someone gift a stranger a fake asset.
Largesse checks the address against the giftable list, requires the name to be short, and requires it to end with the exact suffix. Never a substring.
The six companies are on the companies page, with their addresses in full.
What the recipient now owns
A token that tracks the company's price, issued by Robinhood Assets (Jersey) Limited. It is not a share and carries no shareholder rights. The value moves with the company and can fall. These tokens are not registered in the US and are not offered to US residents.
Lost links
There is no recovery. If the link is gone and the sender's browser no longer has the secret, the gift sits on that address until someone who still holds the key moves it. We say this clearly instead of pretending.
Checks before you trust a send
- The secret never appears in a network request.
- A gift with token and zero gas cannot be marked ready.
- A second claim fails with a clear sentence.
- The recipient sees the not-a-share paragraph first.
- Both parties are told: the link is public-power, and the sender can reclaim until claimed.
More on the model lives in security. The token that unlocks designed cards is described in protocol.