Whitepaper · v1.2

Pasiv: passive income from hardware you already own

Revised August 2026 · pasiv.network

01The problem

Consumer mining has an experience problem, not a hardware problem. Modern consumer machines — Apple Silicon in particular — are genuinely competitive at CPU-friendly proof-of-work like RandomX. What stops people is everything around the mining:

• Complexity. Real miners are command-line tools with JSON configs, pool URLs, TLS ports, and per-algorithm flags. That's a hobbyist's weekend, not a product.
• Distrust. The space is crowded with bundled adware, hidden dev fees, custodial dashboards that hold your coins, and "miners" that are simply malware. A reasonable person defaults to no.
• Choice paralysis. Which coin? Which pool? When it changes weekly, the honest answer is a moving target no casual user will track.

Fixing this is a design problem: make the trustworthy path the easy path.

02Design principles

• Three taps. Download, paste a payout address, press start. No accounts, no config files, no command line.
• Non-custodial, structurally. Pools pay your address directly. Pasiv has no wallet, holds no balances, and never asks for keys — there is nothing to trust us with.
• Consent-first. Mining is off until you press start, every capability is opt-in, and stop always means stop. Nothing launches itself.
• Honest economics. One fee, stated everywhere it matters, that mechanically cannot tick while you're paused — with a local ledger and a public fee address you can check on its pool.
• Quiet by default. A menu-bar app that respects thermals and battery, not a dashboard that wants your attention.

03Architecture

Pasiv is a native desktop app built on Tauri 2 — a Rust core with a lightweight webview UI. The core is organized around a few load-bearing pieces:

• Supervisor. A single state machine (Idle → Starting → Mining ⇄ Paused, Error) owns the mining lifecycle. The UI, the tray icon, and the fee meter all read the same state — what you see is what is running.
• Open core, consumed like a dependency. The pieces of a miner you would otherwise take on faith — the fee engine, the coin and pool roster, the payout-address validators, the mining state machine, and the whole pasivd daemon — live in the public pasiv-core crate (GPL-3.0). The desktop app doesn't mirror that code; it links the crate, pinned to an exact revision recorded in the build. The code you can read is the code the shipped binary runs.
• Engine adapters. Mining engines sit behind a common interface. Today that is XMRig (the industry-standard RandomX miner, sandboxed as a sidecar process) for the RandomX coins, a native VerusHash engine that runs in-process for Verus — no sidecar, no extra binary — and a GPU adapter (SRBMiner-Multi, for Pearl, Ravencoin and Ergo on supported NVIDIA cards) built for the Windows/Linux releases. New engines slot in without touching the rest of the app.
• Sidecar provenance. Neither miner binary lives in our repository. XMRig and SRBMiner-Multi are fetched at build time from their authors' official releases and verified before anything is bundled: first against the checksums the authors publish (XMRig's come in a GPG-signed file), then against a SHA-256 pinned in our repo for both the archive and the extracted binary. Any mismatch stops the build. Before the switch to fetching, the binaries we had been shipping were compared byte-for-byte against upstream — they matched exactly. One deliberate omission: SRBMiner's Windows archive also ships a kernel driver that sits on Microsoft's vulnerable-driver blocklist; Pasiv extracts the miner alone and never bundles it.
• Hardware detection. The app inspects your CPU and GPU up front and shows only what your machine can actually run — no dead toggles, no pretending a laptop is a rig.
• Governor. Thermal and battery guardrails throttle or pause mining so the app stays a good citizen on the machine it lives on.
• Built-in diagnostics. A one-pass doctor (Settings → Diagnostics, or pasiv --doctor / pasivd doctor from a terminal) checks the hardware, every payout address's shape, pool reachability, the price feeds, and what failed last — the same checks the app runs itself, surfaced so a support answer is one screenshot, not a log hunt.
• Data-driven coin roster. Coins are registry entries (ticker, algorithm, pool, address format validator), so new coins ship as app updates — no re-architecture per coin.
• Signed auto-updates. Releases are signed and (on macOS) notarized; the built-in updater verifies release signatures on-device before installing. The release manifest is public — the website's download buttons read the same file the updater does.

04Coins & engines

Every listed coin pays out through an established public pool (MoneroOcean for Monero; HeroMiners for Zephyr, Salvium, Ravencoin and Ergo; LuckPool for Verus; LuckyPool for Pearl) straight to the address you pasted. Pools charge their own fee, typically around 1%, under their own published terms. The roster is chosen deliberately: coins a consumer machine can mine competitively, on pools with direct address payouts — and it grows via updates as candidates clear that bar. The hardware gate is equally deliberate: the GPU lane offers only what Pasiv has verified on real hardware, which today means NVIDIA Turing or newer. AMD cards and pre-Turing NVIDIA are listed by the bundled miner but stay gated off until we've measured them ourselves.

One consequence of the pool-only design worth stating outright: no coin ever runs a local node or downloads a blockchain to your machine. Every engine speaks stratum to its pool and nothing else — there is no node software in the app, no sync, and no chain data on your disk, for Monero or any other coin. The working data mining does need (the RandomX dataset, GPU DAGs) is built in RAM or VRAM on start and vanishes on stop. A candidate coin whose only viable path is solo mining against a local node fails the roster bar for exactly this reason.

05Auto / Max-Profit mode

The headline feature answers the question no casual miner wants to babysit: which coin should this machine be on right now?

The RandomX coins (Monero, Zephyr, Salvium) share one algorithm, so a given machine produces the same hashrate on each. That makes their expected profitability directly comparable:

(Block time cancels out across RandomX chains, so this ranks coins per unit of hashrate.) The app computes this from public, key-free data — CoinGecko prices and pool-published network stats — and:

• starts mining on the top-ranked coin when Auto mode is on,
• re-ranks every 15 minutes while mining,
• switches only when the challenger is ahead by more than an 8% hysteresis margin, so near-ties don't cause constant churn,
• ranks on take-home, not gross — since Pasiv's 4% applies to Monero only, Auto subtracts that fee before comparing, so it won't hold Monero when a fee-free coin (Zephyr, Salvium) nets you more,
• and shows you the live ranking and the reason for the current pick — never a silent switch.

Auto mode is opt-in and off by default, and it ranks the RandomX family only. Verus uses a different algorithm (VerusHash), so a Mac's hashrate on it isn't comparable on network economics alone — it's always a deliberate manual pick. Prefer to hold a specific coin? Pick it and Pasiv stays put.

06Economics: the 4% that only ticks while you earn

Pasiv's fee is 4%, on Monero only — taken as time-sliced mining and only while you are actively earning. Every other coin in the roster carries no Pasiv fee. That is the entire amount Pasiv receives.

Two further fees exist that are not Pasiv's and never reach us. They are listed here because they affect what lands in your wallet, and you should hear about them from us rather than find them yourself:

On that second one: Pasiv ships the stock XMRig binary, which carries a 1% developer donation floor. Rebuilding it without the donation is permitted by its licence, and we built one — then decided not to ship it, for reasons set out in §08. XMRig keeps its 1%, and we say so here and in the app rather than describing it as removed.

The fee is time-sliced hashrate — the same mechanism as the dev fees experienced miners already accept, but with the books open. And since 2026-08-26, the ledger isn't the only thing that's open: the fee engine itself is open source — the address, the slice schedule, the ledger format, and the complete headless daemon that enforces them live in hash-rate/pasiv-core (GPL-3.0), pinned by tests anyone can run:

• For 4% of active Monero mining time, shares are submitted to Pasiv's fee address; the other 96% of the time they go to yours, untouched. Slices are short and frequent, never one long diversion. Mining any other coin, the fee engine simply never engages.
• The fee counter is driven by the same state machine that drives the UI, and it advances only in the Mining state. Idle, paused, starting, or errored time contributes zero — it is structurally impossible to charge a paused user.
• Enforcement is level-triggered, not fire-and-forget. Every tick, the desktop app and pasivd both read back from the miner's own local API which address it is actually mining to and reconcile that against what the slice schedule says it should be. A slice that fails to end — or anything else redirecting the miner — is corrected within one tick rather than trusted forever. Both apps consume the same fee engine from the open crate and are held to it by a conformance test.
• Every slice is written to a local, append-only fee ledger shown in the app, next to the fee address itself — which is a compile-time constant. Changing it requires a new signed release with a changelog entry. Monero is a private chain, so a block explorer shows nothing for any address; the fee address is public and its mining activity is visible on its pool. Full on-chain verification would need the fee wallet's view key — a published-view-key transparency page is on the roadmap.

There is nothing else: no ads, no subscription for personal use, no additional cut of your payouts. Pasiv Cloud — the opt-in fleet view and the Pasiv Companion phone app — shipped free, not as the per-rig paid tier earlier drafts of this document described. If that ever changes it will be announced before it does, never applied retroactively to something already free.

07Trust model

Pasiv's security posture starts from an assumption of zero earned trust — reasonable, given the neighborhood:

• The code that touches money is open source. The fee engine, the coin/pool roster, the payout validators, the mining state machine, and the entire pasivd daemon are public at github.com/hash-rate/pasiv-core — the parts of a miner you'd otherwise have to take on faith, readable and buildable instead. The desktop app consumes that repository as a pinned dependency — an exact revision recorded in the build — and every release since v0.4.39 has been built from it. The GUI apps, cloud, and signing stay proprietary: open core, stated plainly.
• Signed, notarized builds. macOS releases are Developer ID-signed and Apple-notarized; updates are signature-verified by the app before install.
• Headless installs verify too. pasivd binaries are minisign-signed with the same key the desktop updater already trusts. The one-line installer — served from pasiv.network, a separate origin from the binaries it fetches — pins that public key, checks the SHA-256 of everything it downloads, and always verifies the signature — installing minisign from the distro's own repositories if it's missing, and refusing to install at all rather than fall back to a weaker check.
• No custody, no keys. There is no wallet inside Pasiv, no place to enter a seed phrase, and nothing that can move your coins. Pools pay you directly.
• What leaves your machine, precisely. With Pasiv Cloud off — the default — nothing about your rig leaves the device except anonymous product events you can disable. If you turn Cloud on to use the phone app, the machine publishes its state to your account: rig name, hardware summary, live hashrate, and which coin is active. It does not publish your payout addresses — those stay on the device and at your pool. (An earlier build briefly included them in the status row, where nothing ever read them; that was fixed — the stored field was deleted server-side and every sender stopped, and the uplink is now test-enforced to carry no payout address. The full correction is in §08.) What is published is scoped to your account by row-level security, and turning Cloud off deletes the row.
• No account wall. Wallet sign-in exists as an optional convenience and proves address ownership by signature; skipping it costs you nothing.
• Anonymous, optional telemetry. A handful of anonymous product events (never addresses, never file contents), with autocapture and session recording disabled and an in-app off switch. See the privacy policy for the exhaustive list.

08What shipped since, and what's next

This section used to be a roadmap. Most of it has shipped, so it now says what exists — a roadmap that never converts into a changelog is marketing.

Shipped: Windows and Linux releases, including the GPU engine (Pearl, Ravencoin and Ergo) on supported NVIDIA hardware. One-line installers for macOS, Windows and Linux. Pasiv Cloud — an opt-in fleet view with a phone companion that can start, stop and update rigs. Headless nodes (pasivd) for servers and homelabs with no desktop. The open core — the fee engine, coin roster, payout validators, state machine and the whole pasivd daemon published at hash-rate/pasiv-core, with v0.4.39 the first release built from the open code at a pinned revision. And the fee address is published on the home page with a link to audit it on the pool, which the earlier draft listed as a future transparency page.

Two items this section previously listed as future work have since shipped:

• Fee ledger parity on headless nodes. pasivd now writes the same append-only fee-ledger.jsonl the desktop does, in the same format, so a rack of screenless machines audits exactly like a laptop. A fee is only auditable if it is auditable everywhere it is charged; "we log it, except on the machines with no screen" was not a trust surface.
• Updating a fleet without touching it. A rig that is behind shows its version in the companion app and can be updated from there. An update installs a release we signed and can deliver nothing else — every package is verified against a key built into the app before anything is written to disk — and it still cannot change which coin a rig mines, its pool, or its payout address.

One correction, which matters more than an addition. Earlier versions of the app sent each machine's payout addresses to our servers as part of the opt-in Pasiv Cloud status row, while this document and our privacy policy both said payout addresses never reach us. Nothing ever read that field. Rather than soften the claim to match the behaviour, we changed the behaviour: the stored rows were deleted, every sender stopped, and the server now discards the field regardless of which version sends it. The claim is true again, and it is enforced in code rather than promised in prose.

Next:

• Roster growth — additional coins as they clear the bar: minable competitively on consumer hardware, direct-payout pools, honest economics. (Candidates that fail the bar are dropped, not shipped.)
• The companion app on the public stores. It is live on Google Play; the App Store release is in Apple's review.
• New ways to earn — adjacent workloads (e.g. compute markets) are evaluated continuously and added only when one meets the same consent, custody, and honesty bar as mining. No timeline is promised until one does.

A promise we are withdrawing: XMRig's 1%

Earlier drafts of this document listed an XMRig build without the 1% developer donation as planned work. We built it, measured what it was worth, and decided not to ship it. Saying so plainly is the point of this section.

The build works — XMRig's licence permits it and its own source anticipates a zero donation. But that 1% is worth roughly 54 cents per machine per year at current rates, and none of it would come to us; removing it returns 54 cents a year to you. Against that, shipping our own compilation would cost the thing we currently rely on: Pasiv bundles the official, checksum-verified XMRig release, and a self-built binary means trusting our compilation instead of theirs. It would also carry no antivirus reputation on Windows — where miners are already flagged by policy — and commit us to re-patching and re-verifying a fork on every upstream release, with a stale miner as the failure mode.

So XMRig keeps its 1%, and we will keep saying so. The engine is XMRig; its developers take 1% for building the thing this product depends on, and we do not touch it. That reads better than the alternative because it is also true.

This document describes software, not an investment. Mining earnings depend on coin prices, network difficulty, your hardware, and electricity costs; they vary and can be zero. Nothing here is financial advice, and Pasiv makes no earnings guarantees. Coin names and pool names belong to their respective projects.