JAW vs ZeroDev: keys, accounts & permissions

Your user is about to approve their first payment. With JAW, the Face ID or fingerprint prompt they see is the signature itself: their passkey signs, and their smart account checks that signature onchain [22]. They created that passkey, the account and, if your app has an ENS name, a name such as alice.yourapp.eth in a single sign-up step [24], [25].

With ZeroDev Wallet, the user first signs in with a passkey, a Google account, an email code or a magic link. A private key that Turnkey generated, and keeps inside a trusted execution environment, then signs for them [1], [20].

Of the wallet stacks teams compare JAW with, ZeroDev is the closest relative. Both give every user a smart account, and both enforce permissions in the account itself [3], [8], [34]. They differ in what they hand a team. ZeroDev hands over building blocks: Kernel, a modular ERC-7579 account that pairs with many signers, bundler and paymaster RPCs, more than 50 EVM mainnets, and SDKs for Swift, Kotlin, Go, Python, Rust and C. Offchain Labs, the company behind Arbitrum, acquired it in August 2025 [16], [10], [11], [13], [17]. JAW hands over a finished account for EVM networks and Solana: the passkey signs, delegated keys stay inside budgets the chain enforces, and a lost passkey comes back through guardians, zkEmail, zkOAuth or zkPassport [34], [38], [47]. ZeroDev Wallet, ZeroDev's embedded wallet, is the piece that overlaps with JAW, so it is the main point of comparison here, with notes where the Kernel SDK works differently. The post also lists, without hedging, what ZeroDev does better.

Side by side

What users see

The passkey is the signature, out of the box. With JAW, sign-up takes a username and a passkey, and the ENS name, when the app has one, arrives in the same flow [24], [25]. That passkey keeps working after sign-up: every approval is a passkey signature that the smart account verifies onchain [22]. ZeroDev Wallet supports passkeys too, alongside Google, email codes and magic links [1]. In ZeroDev Wallet, the passkey is a way in rather than the signer: once the user is in, the key held by Turnkey signs [1], [20]. Kernel accounts can use a passkey as their onchain signer too, through ZeroDev's WebAuthn validator, which KALOS audited in 2024 for Kernel v2. That is a setup the team assembles with the Kernel SDK, not what ZeroDev Wallet does by default [19], [15].

EVM and Solana from one prompt. A JAW sign-up produces two addresses, one on EVM networks and one on Solana, and a single ENS name that points to both. On Solana, the account is a Swig smart wallet controlled by the same passkey [48]. Users can pay Solana fees in SOL, USDC or USDT, and Solana apps discover JAW like any other wallet, through Wallet Standard. On Solana, ZeroDev offers fee sponsorship [12].

Fewer prompts, on the user's terms. Because JAW's passkey both signs in and signs, there is one kind of prompt to learn [22]. When an app needs to act without asking each time, the user grants a scoped permission that applies "whether it's a passkey, a server-side key, or a delegated agent", and it lapses at its expiry [35]. ZeroDev Wallet reduces prompts with a session: after login, the SDK stores one in the browser by default and refreshes it, so it can sign "without asking the user to log in again each time" [4].

Approval screens included. JAW's web SDK comes with its own sign-in, approval and permission screens, branded with the app's name, logo, colors and font style [27]. Before the user confirms, the approval screen decodes known contract calls and shows how balances will change [28]. JAW's docs point teams to a custom UI handler "when you need complete control over the user experience", and the Account class is built "for headless integration (No UI)" [29], [30]. ZeroDev's Wallet UI Kit handles sign-in, while its signature and transaction confirmation screens are still marked coming soon, so for now each team builds those itself [6].

Accounts that travel between apps. JAW's default CrossPlatform mode lets one account follow the user from app to app [26]. Someone who already has a JAW account can bring it to yours without signing up again.

Stablecoin gas without setup. If the app does not cover gas, the JAW approval screen lets the user pick a stablecoin, such as USDC or USDT, to pay it, and the app configures nothing [31], [32]. ZeroDev sponsors gas through a policy per project and chain, created in its dashboard [2]. Its Kernel SDK can charge gas in USDC on Ethereum, Polygon, Base, Optimism and Arbitrum, at a 5% exchange-rate premium, and other ERC-20 tokens need a paymaster the team funds itself [9].

Permissions, subscriptions and AI agents

Here the two products are nearest to each other. Neither leaves limits to a server deciding at signing time: both write them into the account and check them onchain. What differs is how much of the system the team has to build.

ZeroDev gives developers parts. In Kernel, a permission pairs one signer with as many policies as needed: the contracts and functions it may call, with conditions on arguments and value, a gas allowance, a rate limit and a valid time window. Teams can also write policies of their own, and onchain plugins enforce all of them [8]. For a team that wants to design its own permission model, few toolkits go further. ZeroDev's docs say Kernel's permissions and modules extend ZeroDev Wallet accounts too, and a "hybrid on-chain / off-chain policy engine" is on the wallet's roadmap [1].

JAW gives users one request. An app calls wallet_grantPermissions, an ERC-7715-style API, with a per-token spend limit and a reset period anywhere from a minute to a year, the calls the key may make, and an expiry [36]. The user sees the grant in JAW's permission screen and approves it with their passkey [27], [22]. From then on, the PermissionManager contract checks each transaction against it, and the user can take it back at any time [38], [35]. In wagmi, the whole flow is two hooks, useGrantPermissions and useRevokePermissions [36].

Two cases where a budget over time beats a per-call rule:

• Recurring payments. A user agrees once to a ceiling, say 10 USDC a month. The service collects each month on its own, and cancelling is a revoke [37].
• Agents that spend. In the JAW CLI's auto mode, the user approves a budget once with their passkey, and the agent then signs with its own session key inside it, so a leaked key can only spend what the budget allows [38]. Agents connect through JAW's MCP server, where "an agent must not be able to raise its own caps", and can pay for APIs in USDC with x402 [39], [40].

ZeroDev serves agents today as well: Kernel session keys let a backend send transactions for its users, and ZeroDev has an AgentKit quickstart and server SDKs in several languages [8], [13]. What it still lists as in progress is server wallets for ZeroDev Wallet [1]. The JAW difference is in the packaging: the user grants the budget with their passkey in one standard request, and the agent gets an MCP server and x402 payments from the same CLI.

Recovery

Day to day, a JAW passkey moves between a user's devices through iCloud Keychain or Google Password Manager, end-to-end encrypted "with keys that neither Apple nor Google can access" [22]. For the rare case where every device is gone, JAW recovery restores the same account at the same address [47]:

• Several ways to prove it's you. During setup, the user decides which recovery methods count and how many must agree. A guardian can be a friend's passkey or a hardware wallet key. zkEmail checks control of an email address, zkOAuth a Google or other social login, and zkPassport a passport, each with a zero-knowledge proof that keeps those details off the chain [47].
• Time to say no. An approved recovery does not take effect at once. It waits out a delay, during which the account can cancel it, and only then is the new passkey added [47].
• No gatekeeper. Anyone can relay a recovery, because "the proofs carry authorization". The recovery contract has no owner and no upgrade path, so JAW cannot approve or block a recovery [47].
• One approval for every chain. A single approval restores the account on each EVM chain where it enrolled recovery [47].

Recovery applies to JAW's EVM accounts. Solana accounts are not covered.

ZeroDev's answer depends on the product. ZeroDev Wallet keeps the key away from the device, in Turnkey's infrastructure, so a user with a new phone logs in again with one of its methods [1], [20]. For Kernel SDK accounts, a guardian, either a single ECDSA key or a multisig, can use ZeroDev's recovery executor to replace the owner. The guide does not mention a delay, and once the owner changes, the app has to supply the account address itself, since it can no longer be derived from the new owner [14].

Developer experience

JAW starts every user on an ERC-4337 smart account [34]. Teams that want to cover gas add a paymaster such as Pimlico or Etherspot [31]. Because JAW presents itself as a standard EIP-1193 provider, any stack that talks to a browser wallet can talk to it, and wagmi apps add it as a connector [21], [41]:

jaw({ apiKey: 'YOUR_API_KEY', appName: 'My App' })

Transactions then go through the usual wagmi hooks, useSendCalls among them, and permissions through useGrantPermissions and useRevokePermissions [42], [36]. Servers and React Native apps use the headless Account class, and on mobile "every signature is produced on the device" [30], [43].

ZeroDev Wallet is a wagmi connector as well, and its setup begins in the ZeroDev dashboard. A team creates a project, turns on its networks, adds its origin to the allowlist and writes a gas policy for each chain. In code, it installs @zerodev/wallet-react and @zerodev/wallet-core, registers the connector, and then either calls ZeroDev's login hooks or drops in the Wallet UI Kit [2]:

zeroDevWallet({ projectId, aaHost, chains: [arbitrumSepolia], mode: '7702' })

React Native works through the same hooks inside an Expo app, with storage and passkey adapters set up by hand [7]. Teams that go one level down to the Kernel SDK choose an EntryPoint and a Kernel version, build a signer and a validator, and assemble the Kernel account and its client with bundler and paymaster RPCs [19]. Those RPCs route to UltraRelay, Alchemy, Gelato or Pimlico [10].

Both codebases are public. Kernel and ZeroDev's SDKs carry MIT licenses, and the Kernel repository includes audit reports from Kalos and ChainLight [16], [15]. JAW's SDK is Apache-2.0, its account and permission contracts are MIT, and Nethermind audited both contracts [44], [45].

Where the key lives

ZeroDev Wallet's key is created and kept in Turnkey's key infrastructure. Signing happens inside a trusted execution environment, and only the finished signature comes out [1], [20]. In ZeroDev's words, the key "is never exposed to your app, to ZeroDev, or to anyone else", and "only the authenticated user can approve a signature" [1]. That is a serious design. After login, the SDK keeps a session, in browser storage by default, so the user is not asked to log in again for every signature [4].

JAW has no server-side key to protect. The passkey is generated in the device's secure enclave, and every signature as the owner needs the user's biometrics or device PIN [22]. Keys the user has granted a permission can sign without a prompt, but only within that permission's limits, so a stolen browser session cannot sign as the owner [35]. What JAW stores is passkey metadata, such as credential IDs and public keys [23].

Where ZeroDev is a better fit

• Logins beyond passkeys. Users can come in with Google, an email code or a magic link, not only a passkey [1]. JAW's sign-in is passkey-only [22].
• Exportable keys. A ZeroDev Wallet user can take their wallet elsewhere as a seed phrase or a private key, revealed in a secure iframe [5].
• A longer EVM list. ZeroDev lists more than 50 EVM mainnets [11], against JAW's 20 plus Solana [33], [48].
• Permissions as building blocks. Kernel policies combine freely, and teams can code new ones [8]. JAW offers one standard shape: spend limits, allowed calls and an expiry [36].
• Languages other than TypeScript. Swift, Kotlin, Go, Python, Rust and C SDKs [13]. JAW is TypeScript, and reaches React Native through its headless Account class [43].

Running JAW next to ZeroDev

There is no need to pick one for every user. JAW and ZeroDev Wallet are both wagmi connectors, so one config can list both and let each user choose [2], [41]. The wagmi hooks stay the same whichever connector is active, as JAW's Reown AppKit guide shows with JAW next to other wallets [42]. A practical split: ZeroDev for users who want email or Google login, or for chains JAW does not support, and JAW for users who want a passkey account with onchain budgets and a name of their own [22], [35], [25].

Pricing

Both companies sell credits, but count them differently. ZeroDev's credits are shared across its products. Its free Sandbox plan comes with 10,000 credits a month, on testnets only. Launch costs $69 a month for 100,000 credits and adds mainnet gas sponsorship, and Scale costs $399 a month for 1,000,000 credits, with an 8% premium on sponsored gas on all self-serve plans [18]. ZeroDev Wallet charges 10 credits for an offchain signature, 20 for sending a transaction and 30 for both together [1].

At JAW, the free Build plan includes 125,000 credits a month and covers up to 1,500 accounts. Grow is $200 a month for 1,000,000 credits. An account creation or a transaction costs 30 credits, a signature or a permission change 20, and a returning user signing in costs nothing [46]. Since a credit means something different at each company, the fair comparison is your own expected traffic run through both price lists. ZeroDev's figures are from October 16, 2026, and JAW's from October 9, 2026.

Choosing between them

ZeroDev is the better pick when users need email or Google login, when key export matters, when you need EVM chains outside JAW's list, when your backend is not written in TypeScript, or when you want to build your own permission model from Kernel's parts.

JAW is the better pick when you want the passkey itself to sign out of the box, with no key on anyone's server, approval screens that already exist, accounts that move with users between apps, spending budgets a user grants in a single request, recovery through guardians, zkEmail, zkOAuth or zkPassport that no company can block, Solana next to EVM from the same passkey, and stablecoin gas that needs no configuration.

Start with an API key from dashboard.jaw.id, then follow the docs.

Sources

ZeroDev sources accessed October 5, 2026, except 1, 5, 8, 11, 14, 15, 18 and 19 (October 16, 2026). JAW sources accessed October 9, 2026.

ZeroDev sources 1 to 20, JAW sources 21 to 48

1. ZeroDev Wallet overview (key model, login methods, roadmap, credits per action): https://docs.zerodev.app/wallets
2. ZeroDev Wallet quickstart: https://docs.zerodev.app/wallets/quickstart
3. Connector options (7702 and 4337 modes): https://docs.zerodev.app/wallets/connector-options
4. Session management: https://docs.zerodev.app/wallets/session-management
5. Export wallet: https://docs.zerodev.app/wallets/export
6. Wallet UI Kit: https://docs.zerodev.app/wallets/auth/wallet-ui-kit/getting-started and https://docs.zerodev.app/wallets/auth/wallet-ui-kit/coming-soon
7. React Native quickstart: https://docs.zerodev.app/wallets/react-native/quickstart
8. Kernel permissions, session keys for backends, and the AgentKit quickstart: https://docs.zerodev.app/smart-accounts/permissions/intro, https://docs.zerodev.app/smart-accounts/permissions/transaction-automation and https://docs.zerodev.app/smart-accounts/permissions/agentkit
9. Paying gas with ERC-20 tokens: https://docs.zerodev.app/smart-accounts/pay-gas-with-erc20s
10. Bundler and paymaster RPCs: https://docs.zerodev.app/api-and-toolings/infrastructure/rpcs
11. Supported networks: https://docs.zerodev.app/api-and-toolings/faqs/chains
12. Solana fee sponsorship: https://docs.zerodev.app/smart-accounts/sponsor-gas/solana
13. SDKs overview: https://docs.zerodev.app/get-started/sdks/overview
14. Kernel SDK recovery: https://docs.zerodev.app/advanced/account-recovery/sdk-recovery
15. Kernel audit reports, including KALOS's WebAuthn/P256 plugin assessment (2024): https://github.com/zerodevapp/kernel/tree/main/audits
16. Source and licenses: https://github.com/zerodevapp/kernel and https://github.com/zerodevapp/zerodev-wallet-sdk
17. Offchain Labs acquires ZeroDev (August 13, 2025): https://docs.zerodev.app/blog/zerodev-acquired
18. Pricing: https://zerodev.app/pricing
19. Kernel SDK quickstart and passkey signers: https://docs.zerodev.app/get-started/quickstart and https://docs.zerodev.app/onboarding/passkeys/overview
20. ZeroDev Wallet core SDK README (key management through Turnkey): https://github.com/zerodevapp/zerodev-wallet-sdk/blob/main/packages/core/README.md
21. Why JAW: https://docs.jaw.id/why-jaw
22. Passkeys: https://docs.jaw.id/concepts/passkeys
23. Passkey server: https://docs.jaw.id/advanced/passkey-server
24. Account.create: https://docs.jaw.id/account/create
25. ENS subnames: https://docs.jaw.id/concepts/ens
26. CrossPlatform mode: https://docs.jaw.id/configuration/mode/cross-platform
27. App name, logo and theme: https://docs.jaw.id/configuration/appName and https://docs.jaw.id/configuration/theme
28. Approval screen, call decoding and balance preview (SDK source): https://github.com/JustaLab-co/jaw-mono/blob/main/packages/ui/src/hooks/useAssetPreview.ts and https://github.com/JustaLab-co/jaw-mono/blob/main/packages/ui/src/hooks/useDecodedCalldata.ts
29. Custom UI handler: https://docs.jaw.id/advanced/custom-ui-handler
30. Account API (headless): https://docs.jaw.id/account
31. Gas sponsoring: https://docs.jaw.id/guides/gas-sponsoring
32. Paymasters: https://docs.jaw.id/configuration/paymasters
33. Supported networks: https://docs.jaw.id/supported-networks
34. Smart accounts: https://docs.jaw.id/concepts/smart-accounts
35. Permissions: https://docs.jaw.id/concepts/permissions
36. Granting and revoking permissions: https://docs.jaw.id/api-reference/wallet_grantPermissions, https://docs.jaw.id/wagmi/useGrantPermissions and https://docs.jaw.id/wagmi/useRevokePermissions
37. Subscription payments: https://docs.jaw.id/guides/subscription
38. CLI auto mode: https://docs.jaw.id/cli/auto-mode
39. MCP server: https://docs.jaw.id/cli/mcp
40. Paying for APIs (x402): https://docs.jaw.id/cli/x402
41. wagmi connector: https://docs.jaw.id/wagmi/jaw
42. Reown AppKit: https://docs.jaw.id/guides/reown-appkit
43. React Native: https://docs.jaw.id/guides/react-native
44. Source and licenses: https://github.com/JustaLab-co/jaw-mono, https://github.com/JustaLab-co/justanaccount and https://github.com/JustaLab-co/permissions
45. Nethermind audits: https://github.com/JustaLab-co/justanaccount/blob/master/audits/Nethermind-October-2025.pdf and https://github.com/JustaLab-co/permissions/blob/master/audits/Nethermind-March-2026.pdf
46. Pricing: https://jaw.id/pricing
47. Account recovery (JustaRecoveryManager): https://github.com/JustaLab-co/jaw-recovery
48. Swig smart wallet, the account JAW uses on Solana: https://onswig.com and https://github.com/anagrambuild/swig-wallet