How to track a crypto portfolio without connecting your wallet
Most portfolio trackers ask for something before they show you a number: a wallet address, a read-only exchange key, or an account with an email and password. You can skip all of it. But it helps to understand what you are actually choosing between, because each approach trades convenience against exposure in a different way.
There are only three ways a tracker can know what you hold.
1. You paste a public wallet address
The tracker watches an on-chain address and reads its balances. You never hand over a private key, so the tracker cannot move anything — public addresses are read-only by nature.
What it costs you. A wallet address is a permanent, public identifier. Once a service has it, it can see every transaction that address has ever made and every one it makes in future. If that address is ever linked to your identity — by an exchange withdrawal, an ENS name, an NFT purchase, a donation — then the link is retroactive and permanent. Chain analysis is a real industry, and address clustering works.
When it makes sense. You hold on-chain, in a small number of addresses, and you have already accepted that those addresses are public. The automation is genuinely useful: balances update without you doing anything.
2. You connect a read-only exchange API key
You generate a key on the exchange with trading and withdrawal permissions switched off, and paste it in. The tracker polls your balances.
What it costs you. You are trusting the tracker to store that key safely, and trusting yourself to have set the permissions correctly. Read-only keys still expose your full balance and trade history. And a key stored on someone else's server is a key that can be leaked in someone else's breach. There is a long history of "read-only" keys turning out to have had withdrawal rights enabled by default, or of exchanges treating certain endpoints as read-only when they were not.
When it makes sense. You trade actively on one or two exchanges and manual updating would be genuinely impractical. If you do this, generate the key with the narrowest possible permissions, IP-restrict it if the exchange allows, and delete it the moment you stop using the tracker.
3. You type the amounts in yourself
You pick a coin, type how much you hold, and the tracker multiplies it by a public price.
What it costs you. Effort. You have to update the number when your holdings change. Nobody enjoys this part, and it is the honest reason most trackers push you towards the other two options.
What it buys you. The tracker never learns an address, never holds a key, and never needs an account. There is nothing to breach, because there is nothing stored anywhere except on your own device. A price lookup asks a public API "what is Bitcoin worth?" — a question that reveals nothing about you. The multiplication happens on your phone.
The thing worth noticing
For a tracker whose only job is to show you a total, options 1 and 2 buy automation and nothing else. They do not make the total more accurate. They do not unlock a feature you could not otherwise have. They save you from retyping a number occasionally.
That is a real convenience, and for some people it is worth the exposure. But it is worth naming the trade honestly, because a lot of apps present address connection as a security feature — "we never see your keys!" — when the actual question is whether they need to see anything at all.
What manual entry does not solve
Being fair about the limits:
- You will forget to update it. A manually entered portfolio drifts. If you trade weekly, this approach will annoy you.
- It does not track cost basis or tax. You are looking at what your holdings are worth now, not what you paid.
- **It cannot see staking rewards, airdrops, or anything that arrives without you noticing.** If value shows up on-chain, a manual tracker will not know.
- Prices come from a third party. Any tracker's numbers are only as good as its price source, and public market data can be delayed or briefly wrong.
If those matter to you, a connected tracker is the right tool and the exposure is the price of admission. If what you actually want is to open an app, see a number, and close it again, manual entry costs you a few taps a month.
How to check what a tracker is really doing
Whatever you pick, three checks take about two minutes:
- Read the App Store privacy label or the Play Data safety section. They are self-declared, but a tracker that claims "no data collected" while shipping an ad SDK is telling on itself.
- Search the privacy policy for the word "server". If your holdings are stored on the developer's infrastructure, the policy has to say so somewhere.
- Turn off your network and open the app. If your balances still render from cache, they are on the device. If the screen is empty, they were never there.
That last one is the most honest test available to you, and no marketing copy survives it.