backmeupplz/plainwallet
Watch
1
0
Code Issues Pull requests Projects Releases 17 Wiki Activity Actions
17 releases 17 tags
  • v0.2.2 1d118344be

    0.2.2 Stable

    backmeupplz released this 2026-09-26 02:43:01 +00:00 | 28 commits to main since this release

    No known key found for this signature in database
    GPG key ID: E58B0C37DFED05DF

    Android: new package name

    The Android app is now com.borodutch.plainwallet, a name under a domain we own, ready for Google Play and Android developer verification.

    If you installed 0.2.0 or 0.2.1: Android treats this as a new app, so it won't update the old one. To move over:

    1. Make sure you have your seed phrase (or private key) written down.
    2. Install plainwallet-0.2.2-android.apk and restore your wallet from the seed phrase.
    3. Uninstall the old Plain Wallet.

    Your funds are on-chain, so nothing is lost; only the app on the phone changes. Nothing else changed since 0.2.1, and the browser extensions are the same apart from the version number.

    Install

    • Android: download plainwallet-0.2.2-android.apk on the phone and open it. It's signed with the same key as before; the certificate's SHA-256 is:
      1F:EC:2B:63:39:34:74:21:B0:C5:64:AB:19:EE:66:34:39:16:F7:FE:B0:81:62:C3:5F:C3:5C:9F:B5:9F:CB:83
    • Chrome / Brave / Edge: unzip plainwallet-0.2.2-chrome.zip, open chrome://extensions, turn on Developer mode, click Load unpacked and select the unzipped folder.
    • Firefox / LibreWolf: load plainwallet-0.2.2-firefox.zip temporarily from about:debugging, or, in a browser that allows unsigned extensions, set xpinstall.signatures.required to false, rename the zip to .xpi and open it.

    🤖 Generated with Claude Code

    Downloads
  • v0.2.1 66f1ac95c1

    0.2.1 Stable

    backmeupplz released this 2026-09-25 17:11:23 +00:00 | 30 commits to main since this release

    No known key found for this signature in database
    GPG key ID: E58B0C37DFED05DF

    Security hardening

    A security review of the Android app led to these changes, and a few apply to the extension too. Update if you use either.

    Android

    • Sites run apart from the wallet: websites now have their own browser process and storage, separate from the unlocked wallet. The app requires an up-to-date Android System WebView (140+).
    • No pop-ups from websites: sites can no longer show dialogs, and messages from sites are checked before the app reads them.
    • Know when you're in the wallet: it always shows a blue band across the top of the screen, and a website never does. If a page asks for your password or seed phrase, it isn't Plain Wallet.
    • Private screens: the wallet's screens stay out of screenshots, screen recordings and the recent-apps view. Other apps' overlays are hidden while it shows, keyboards are told not to learn what you type into it, and autofill can't see it.
    • Locks when you leave: the wallet locks after a minute away from the app (screen off included), and changing the phone's clock doesn't extend that.
    • Leaving rejects: leaving the wallet while a request is waiting rejects it, the same as closing the extension's approval window.
    • Clearer address bar: it shows only the site's host. A seed phrase or private key typed into it is refused instead of being searched.
    • Stays on this phone: app data is never backed up to the cloud or copied to a new phone.

    Extension (Chrome, Firefox)

    • The wallet no longer follows EIP-3668 offchain lookups, which a contract could use to make it fetch arbitrary URLs.
    • Approve and Send only become clickable after a short pause with no clicks or taps.

    Install

    • Android: download plainwallet-0.2.1-android.apk on the phone and open it. It installs over 0.2.0 and keeps your wallet. The signing certificate's SHA-256 is:
      1F:EC:2B:63:39:34:74:21:B0:C5:64:AB:19:EE:66:34:39:16:F7:FE:B0:81:62:C3:5F:C3:5C:9F:B5:9F:CB:83
    • Chrome / Brave / Edge: unzip plainwallet-0.2.1-chrome.zip, open chrome://extensions, turn on Developer mode, click Load unpacked and select the unzipped folder.
    • Firefox / LibreWolf: load plainwallet-0.2.1-firefox.zip temporarily from about:debugging, or, in a browser that allows unsigned extensions, set xpinstall.signatures.required to false, rename the zip to .xpi and open it.

    🤖 Generated with Claude Code

    Downloads
  • v0.2.0 0149027463

    0.2.0 Stable

    backmeupplz released this 2026-09-25 01:10:39 +00:00 | 32 commits to main since this release

    No known key found for this signature in database
    GPG key ID: E58B0C37DFED05DF

    Plain Wallet for Android

    The same wallet, now as an Android app: a browser with Plain Wallet built in.

    • Address bar on top. Type a site, or anything else to search DuckDuckGo. Tap ☆ to favorite the site.
    • Every https site gets Plain Wallet's provider, the same one the extension injects (EIP-1193 and EIP-6963), with the same approvals, simulation and optional Jev check.
    • Favorites, with their icons, on top of the wallet's home screen.
    • Fingerprint unlock (optional; turn it on in Settings with your password). Android keeps the wallet key behind your fingerprint, and adding or removing a fingerprint turns it off. Export still asks for the password.

    Needs Android 11+ and an up-to-date Android System WebView. The app is new and unaudited. Its known differences from the extension, notably that sites and the wallet share one WebView process, are listed in the README.

    Also in this release

    • Setup checks as you type. The seed phrase is lowercased, and a line under the box says what's missing or wrong (word count, a word that isn't in the list, the checksum, private-key length). The password fields show how many characters are left and whether the two match.
    • A quieter Jev line. The summary names scam or fake-site risk only when it's worth a look; otherwise it says "probably ok". The details still show every number.

    Install

    • Android: download plainwallet-0.2.0-android.apk on the phone and open it, allowing installs from your browser or file manager when asked. Future releases are signed with the same key and install over it. The signing certificate's SHA-256 is:
      1F:EC:2B:63:39:34:74:21:B0:C5:64:AB:19:EE:66:34:39:16:F7:FE:B0:81:62:C3:5F:C3:5C:9F:B5:9F:CB:83
    • Chrome / Brave / Edge: unzip plainwallet-0.2.0-chrome.zip, open chrome://extensions, turn on Developer mode, click Load unpacked and select the unzipped folder. The zip is unsigned.
    • Firefox / LibreWolf: either load plainwallet-0.2.0-firefox.zip temporarily from about:debugging, or in a browser that allows unsigned extensions set xpinstall.signatures.required to false, rename the zip to .xpi and open it.

    🤖 Generated with Claude Code

    Downloads
  • v0.1.11 69bd4ddce6

    0.1.11 Stable

    backmeupplz released this 2026-09-24 21:29:53 +00:00 | 36 commits to main since this release

    No known key found for this signature in database
    GPG key ID: E58B0C37DFED05DF

    Shorter Megapot summary

    The collapsed Megapot line in Settings now reads Megapot: ticket/5 txs (or ticket/tx for every transaction) instead of wrapping onto two lines. Nothing else changed since 0.1.10.

    Install

    These builds are unsigned.

    • Chrome / Brave / Edge: unzip plainwallet-0.1.11-chrome.zip, open chrome://extensions, turn on Developer mode, click Load unpacked and select the unzipped folder.
    • Firefox / LibreWolf: either load plainwallet-0.1.11-firefox.zip temporarily from about:debugging, or in a browser that allows unsigned extensions set xpinstall.signatures.required to false, rename the zip to .xpi and open it.

    🤖 Generated with Claude Code

    Downloads
  • v0.1.10 73da083782

    0.1.10 Stable

    backmeupplz released this 2026-09-24 21:12:10 +00:00 | 38 commits to main since this release

    No known key found for this signature in database
    GPG key ID: E58B0C37DFED05DF

    Megapot ticket every N transactions

    Optional and off by default: under Settings → Megapot, turn on Buy Megapot tickets and choose how often (every 1, 10, 50… transactions).

    • Every transaction the wallet sends counts, whether a site asked for it or you used Send, on any network. The count stays on your device.
    • On every Nth one, the usual approval window asks you to buy one Megapot ticket: 1 USDC on Base, random numbers, for the account that sent it. It's simulated like any other transaction, and you can reject it.
    • When the USDC allowance runs out, an approval for the next 10 tickets ($10) comes first, so that extra window shows up once per 10 tickets.
    • If that account has less than 1 USDC on Base, the ticket is skipped without asking. It also needs a little ETH on Base for fees. Settings shows why the last ticket wasn't bought, if it wasn't.

    Also in this release

    • Settings: Megapot and the Jev transaction check are collapsed sections now, and the wallet's version is shown at the bottom.
    • Approval window: a request arriving just as the window closes after your last approval now opens a new window. Before, it could land in the closing one and be rejected with it.
    • Pinned dependencies: package.json pins exact versions, and a project .npmrc turns off install scripts (no dependency needs one) and pins anything added later. Build from source with npm ci.

    Install

    These builds are unsigned.

    • Chrome / Brave / Edge: unzip plainwallet-0.1.10-chrome.zip, open chrome://extensions, turn on Developer mode, click Load unpacked and select the unzipped folder.
    • Firefox / LibreWolf: either load plainwallet-0.1.10-firefox.zip temporarily from about:debugging, or in a browser that allows unsigned extensions set xpinstall.signatures.required to false, rename the zip to .xpi and open it.

    🤖 Generated with Claude Code

    Downloads
  • v0.1.9 cf0562bf87

    0.1.9 Stable

    backmeupplz released this 2026-09-24 20:42:33 +00:00 | 39 commits to main since this release

    No known key found for this signature in database
    GPG key ID: E58B0C37DFED05DF

    Transaction simulation

    Every transaction you review, from a site or from Send, is now simulated on the network's RPC before you approve it. One line under the approval shows the result:

    • Simulation: −0.01 ETH, +26.8921 USDC, no balance changes, or fails in red (the revert reason is in the details).
    • Click it for the exact amounts and each token's contract address (a token can call itself anything).

    It fills in as it arrives; the Approve and Send buttons never wait for it. It needs an RPC that supports eth_simulateV1: the defaults for Ethereum, Base, OP Mainnet, Polygon, BNB Chain and Gnosis do; Arbitrum's and Avalanche's public RPCs don't, and the line says so. Rate-limited RPCs (Base's public one) are retried.

    Optional: Jev second opinion

    Paste a typesafe.ai API key under Settings → Jev transaction check, and every transaction and signature request gets two more lines:

    • Contract: the contract and any spender looked up on Blockscout: verified or not, how old, token and holder count, scam flag. The function is named from the contract's verified ABI, or else from Sourcify's public signature list (a match must decode the calldata exactly). Red if flagged as a scam, amber if unverified, under a month old, or a spender that is a regular account.
    • Jev: what the request does (19 kinds of transaction, 12 kinds of signature, e.g. Swaps, Plays a game, Grants token access, Upgrades the account), and how likely it is a scam or a lookalike site: green under 30%, amber from 30%, red from 50%.

    Jev only sees what the wallet prepared (the simulation, the lookups, the request, the site and its page title), and a site can word things to sway it: it is advice next to the wallet's own rows, never instead of them. Without a key nothing is sent to Blockscout, Sourcify or TypeSafe. Blockscout covers Ethereum, Base, Arbitrum, OP Mainnet and Polygon, and doesn't know contracts verified only on Etherscan. See PRIVACY.md for exactly what each service receives.

    Install

    These builds are unsigned.

    • Chrome / Brave / Edge: unzip plainwallet-0.1.9-chrome.zip, open chrome://extensions, turn on Developer mode, click Load unpacked and select the unzipped folder.
    • Firefox / LibreWolf: either load plainwallet-0.1.9-firefox.zip temporarily from about:debugging, or in a browser that allows unsigned extensions set xpinstall.signatures.required to false, rename the zip to .xpi and open it.

    🤖 Generated with Claude Code

    Downloads
  • v0.1.8 dbad533ffb

    0.1.8 Stable

    backmeupplz released this 2026-09-24 17:22:34 +00:00 | 44 commits to main since this release

    No known key found for this signature in database
    GPG key ID: E58B0C37DFED05DF

    Add networks from chainlist.org

    Add network… now offers two options:

    • Add from chainlist.org opens chainlist.org. Connect Plain Wallet there, then click a network's add button. The network is added through the usual approval window, which shows its name, chain ID and RPC.
    • Add custom network opens the same form as before.

    Also in this release:

    • When a site sends several RPC URLs for a network (chainlist.org does), the wallet uses the first public https one instead of rejecting the request.
    • The provider now sets selectedAddress, which some sites (including chainlist.org) check to see whether a wallet is connected.

    Known quirk: chainlist.org checks for a connected wallet before Plain Wallet reports its address, so its buttons may still say "Connect Wallet" after you connect. Clicking the button on a network's page still adds the network.

    Install

    These builds are unsigned.

    • Chrome / Brave / Edge: unzip plainwallet-0.1.8-chrome.zip, open chrome://extensions, turn on Developer mode, click Load unpacked and select the unzipped folder.
    • Firefox / LibreWolf: either load plainwallet-0.1.8-firefox.zip temporarily from about:debugging, or in a browser that allows unsigned extensions set xpinstall.signatures.required to false, rename the zip to .xpi and open it.

    🤖 Generated with Claude Code

    Downloads