# Generate a Vanity I2P Address

> Generate a vanity I2P address with vain from i2pd-tools: grind a b32 prefix, install the keys under i2pd, and confirm with keyinfo.

- **URL:** https://hackindex.io/blog/vanity-i2p-address-vain
- **Authors:** [Joshua](https://hackindex.io/authors/joshua.md)
- **Published:** 2026-09-12
- **Updated:** 2026-09-12

A vanity I2P address puts a chosen word at the start of your b32 hostname, so visitors recognise the site at a glance. This page grinds one with vain from i2pd-tools and installs it into the router from the [hardened I2P eepsite](https://hackindex.io/blog/hardened-i2p-eepsite-i2pd) build. Generate the key on a separate machine and keep it offline.

## How a vanity I2P address works

A b32 address is the base32 encoding of the SHA256 hash of your destination. That gives 52 characters from the alphabet a to z and 2 to 7, and the last character is always a or q. You cannot choose the address, only search until the hash starts with your string.

vain does not build a new key pair for every attempt. It keeps the keys fixed and varies padding bytes inside the destination, so each attempt costs one hash. That makes it fast, but the odds still multiply by about 32 for every extra character.

> [!WARNING]
> A vanity prefix is cosmetic, not authentication. Anyone can grind the same first characters for a lookalike address. Tell visitors to verify the full string, never just the prefix.

## Build i2pd-tools

vain ships in the i2pd-tools repository alongside keyinfo. If you built the tools for the eepsite guide, skip this. Otherwise clone with submodules, since the build needs the i2pd library, and compile on the machine that will do the grinding.

```bash
sudo apt install -y git build-essential libboost-chrono-dev libboost-date-time-dev libboost-filesystem-dev libboost-program-options-dev libssl-dev zlib1g-dev
git clone --recursive https://github.com/PurpleI2P/i2pd-tools
cd i2pd-tools
make
```

## Grind a vanity I2P address

Give vain the prefix as the first argument, then any options. Threads default to your core count. Four or five characters land in seconds, six in about a minute, seven in under an hour, and eight in around a day; the hash counter at the end lets you measure your own rate.

Only a to z and 2 to 7 can ever match. The prefix check accepts the digits 0, 1, 8, and 9, but a search for them runs forever, so leave them out.

```bash
./vain hack -t 4
# Start vanity generator in 4 threads
# Thread 0 binded
# Thread 1 binded
# Thread 2 binded
# Thread 3 binded
# Address found hackb6kkrponmkcz2awan4huukzaqwpbrthb2syz5opn5uzbbf4a in 2
# Hashes: 1458073
# outpath for a now: hackb6kkrponmkcz2awan4huukzaqwpbrthb2syz5opn5uzbbf4a.dat
```

Without an output option, vain names the key file after the address in the current directory, which is the easiest to work with. The `-o` option does not do what you expect: it appends a counter and `.dat` to whatever you pass, so `-o site.dat` writes `site.dat0.dat`. Use `-r` to match a regular expression instead of a prefix, and `-m` to keep searching for more matches.

## Install the key

The router expects the key file at the path named in tunnels.conf, which is `site.dat` under `/var/lib/i2pd/` in the eepsite build. Stop i2pd, copy the generated file over it, give it to the i2pd user, and start again. The old address stops resolving once the new key is live. Confirm the result with keyinfo, and add `-v` to see the signature type, which should read ED25519.

```bash
sudo systemctl stop i2pd
sudo cp $I2P_ADDRESS.dat /var/lib/i2pd/site.dat
sudo chown i2pd:i2pd /var/lib/i2pd/site.dat
sudo chmod 600 /var/lib/i2pd/site.dat
sudo systemctl start i2pd
sudo ./keyinfo /var/lib/i2pd/site.dat
# hackb6kkrponmkcz2awan4huukzaqwpbrthb2syz5opn5uzbbf4a.b32.i2p
```

Here `$I2P_ADDRESS` is the 52 character address vain printed, without the `.b32.i2p` suffix, since that is the file name it wrote. Give the router a few minutes to publish the new LeaseSet before you test from a client.

> [!CAUTION]
> The key file is the address, and there is no rotation. Grind it offline, copy only the file to the server, and wipe the workstation copy when you are done. Keep an encrypted offline backup of site.dat, because losing it means losing the address for good.

With the address in place, the rest of the setup is unchanged: the tunnel, the loopback web server, and the firewall from the [hardened I2P eepsite](https://hackindex.io/blog/hardened-i2p-eepsite-i2pd) guide all keep working, now under the name you picked.

## References

- [i2pd-tools](https://github.com/PurpleI2P/i2pd-tools) - Source for vain and keyinfo, with build instructions.
- [i2pd tunnels](https://docs.i2pd.website/en/latest/user-guide/tunnels/) - How the keys file in tunnels.conf defines the destination.