backmeupplz/plainwallet
Watch
1
0
Code Issues Pull requests 1 Projects Releases 17 Wiki Activity Actions
17 releases 17 tags
  • v0.2.1 66f1ac95c1

    0.2.1 Stable

    backmeupplz released this 2026-09-25 17:11:23 +00:00 | 30 commits to main since this release

    No known key found for this signature in database
    GPG key ID: E58B0C37DFED05DF

    Security hardening

    A security review of the Android app led to these changes, and a few apply to the extension too. Update if you use either.

    Android

    • Sites run apart from the wallet: websites now have their own browser process and storage, separate from the unlocked wallet. The app requires an up-to-date Android System WebView (140+).
    • No pop-ups from websites: sites can no longer show dialogs, and messages from sites are checked before the app reads them.
    • Know when you're in the wallet: it always shows a blue band across the top of the screen, and a website never does. If a page asks for your password or seed phrase, it isn't Plain Wallet.
    • Private screens: the wallet's screens stay out of screenshots, screen recordings and the recent-apps view. Other apps' overlays are hidden while it shows, keyboards are told not to learn what you type into it, and autofill can't see it.
    • Locks when you leave: the wallet locks after a minute away from the app (screen off included), and changing the phone's clock doesn't extend that.
    • Leaving rejects: leaving the wallet while a request is waiting rejects it, the same as closing the extension's approval window.
    • Clearer address bar: it shows only the site's host. A seed phrase or private key typed into it is refused instead of being searched.
    • Stays on this phone: app data is never backed up to the cloud or copied to a new phone.

    Extension (Chrome, Firefox)

    • The wallet no longer follows EIP-3668 offchain lookups, which a contract could use to make it fetch arbitrary URLs.
    • Approve and Send only become clickable after a short pause with no clicks or taps.

    Install

    • Android: download plainwallet-0.2.1-android.apk on the phone and open it. It installs over 0.2.0 and keeps your wallet. The signing certificate's SHA-256 is:
      1F:EC:2B:63:39:34:74:21:B0:C5:64:AB:19:EE:66:34:39:16:F7:FE:B0:81:62:C3:5F:C3:5C:9F:B5:9F:CB:83
    • Chrome / Brave / Edge: unzip plainwallet-0.2.1-chrome.zip, open chrome://extensions, turn on Developer mode, click Load unpacked and select the unzipped folder.
    • Firefox / LibreWolf: load plainwallet-0.2.1-firefox.zip temporarily from about:debugging, or, in a browser that allows unsigned extensions, set xpinstall.signatures.required to false, rename the zip to .xpi and open it.

    🤖 Generated with Claude Code

    Downloads