# Introduction Mybucks.online is a **digital cash envelope** for the internet—a Web3 utility for one-time use, gifting, airdropping and easy onboarding. Create a wallet, fund it, hand it off, and move on. It is **not** a fortress wallet like MetaMask: it does not connect to dApps, compete with your daily wallet, or serve as a vault for high-value assets or long-term savings. We use *Digital Cash Envelope* in user-facing docs; technically the product implements a **seedless, disposable wallet** framework. The system enables **1-click gifting** by generating a disposable wallet interface. It computes a private key from your passphrase and PIN inputs using an industry-standard, verified one-way hash function. This private key forms your account, allowing you to transfer, receive, and manage your crypto assets securely. To further enhance security, it utilizes the **Scrypt** Key Derivation Function (KDF). This mechanism increases the computational effort required to crack passwords, effectively delaying brute-force attacks and making them impractical. It entirely runs **in your browser** **without** using any storage or invoking any 3rd-party APIs for key management. Because your private key is generated instantly from your inputs and cleared whenever you close or refresh, there is **no footprint**. This absolutely protects your privacy. With Mybucks.online, you can send cryptocurrency—and even **the envelope itself—via a URL**. The recipient simply clicks the link to claim full ownership. This feature allows you to **initialize a one-time account** loaded with stablecoins or memecoins, transferring asset control as a gift **without ever asking for a recipient's address**. It serves as a perfect starter tool for onboarding recipients, who can easily withdraw the funds into their primary personal wallets. This is a powerful tool for **bulk distribution** and **massive airdrops** to many people simultaneously. You no longer need to ask for a wallet address or force users to connect their wallet to your app for a small $5 referral fee. You simply share the unique links through any messaging platform, social media, or email. ### Key Points #### Zero Footprint * No servers, no databases, no storage and no tracking. * 100% browser-based. * Your credentials never leave your device. * Your account is generated whenever you open it. Closing or refreshing your browser erases all traces/history. #### Fast and Easy * No app installs, no browser extensions, no registration and no KYC. * You can create or open your wallet in seconds - all you need is your browser. * Passphrase is easier to handle and remember than seed phrases. #### 1-Click Gifting * Stop asking your friends for their wallet addresses. * Send a wallet as a URL rather than just sending coins. * The recipient clicks the URL and takes full ownership instantly. * This makes gifting or airdropping perfectly easy and enables massive micro-gifting in seconds. # How it works? This page explains design principles and technical implementation. Mybucks.online is presented to users as a **digital cash envelope**—a temporary, hand-off utility rather than a daily driver wallet. The sections below describe how that product is built using a **seedless, disposable wallet** framework. #### Design principles Mybucks.online is built for speed, convenience, and decentralization. In other words, "speed and convenience" means the platform is designed to be fast and easy to use. For that purpose, we defined a few principal key points: * No app installs or browser extension downloads required. * Use a classical credential format that is human-readable and easy to remember, avoiding the 12 or 24-word seed phrases used in other crypto wallet products. We prefer decentralization for the following benefits: * It provides full transparency to users and communities. * There is no need to maintain large, secure infrastructures for handling user wallets. These key points and our preference for decentralization are the main motivations for using a hash function to convert user credentials into a wallet private key **instantly on the browser side**. However, this introduces a critical security challenge: the **brute-force attack**. To address this, **Scrypt** was deliberately chosen to delay the attack and make it practically impossible. #### Technical implementation The **Passphrase** is the primary credential used to generate your private key and create your account. It must be at least 12 characters long and include a mix of uppercase letters, lowercase letters, numbers, and symbols. Generally, a user-defined passphrase has **lower entropy (randomness)** than a machine-generated 24-word seed phrase. To address this and mitigate the risk of **rainbow table attacks** (where attackers use pre-computed tables of common passwords), we introduced the **PIN** as a secondary input. By requiring a unique pair of credentials—**a Passphrase and a PIN**—we achieve two critical security goals: * **Increased Entropy**: Combining two distinct secrets significantly increases the complexity required to guess your credentials. * **Custom Salting**: The PIN acts as a unique "**salt**," ensuring that even if two users choose the same passphrase, their resulting private keys will be completely different. This dual-input system allows us to provide a human-readable experience that remains resilient against modern cryptographic attacks. Additionally, the **PIN** serves as a **confirmation step** when backing up your credentials or transferring assets. To generate a private key, the Passphrase and PIN are used as inputs for the Scrypt key derivation function. The resulting output is then processed through a Keccak256 hash to produce the final account private key, as shown in the following diagram:

Key generation mechanism

[**Scrypt** ](https://www.tarsnap.com/scrypt.html)is a password-based key derivation function created by Colin Percival in March 2009, originally for the Tarsnap online backup service. The algorithm was specifically designed to make it costly to perform large-scale custom hardware attacks by requiring large amounts of memory. Here are the parameters of **Scrypt** being used in our wallet: {% hint style="info" %} N: 2^17, r: 8, p: 1, keyLen: 64 {% endhint %} *To ensure a smooth experience for all users, we have carefully tuned our security parameters to perform reliably on both desktop and mobile browsers. This specific level of complexity is chosen to complete the cryptographic hashing process in under 10 \~ 20 seconds on most popular Android devices, ensuring that your wallet remains secure without causing long delays during login.* **Keccak256** (**SHA-3**) is a cryptographic hash function used widely in blockchain systems like Ethereum. It's designed to be collision-resistant and irreversible, meaning it's computationally infeasible to generate the same hash from two different inputs or reverse-engineer the original input from the hash. This combination of functions generates a **pseudo-random** value and guarantees no **reversibility**, no **conflicts**, and high security. #### ⚠️ Important Security Note MyBucks.online is a credential-based wallet designed for **micro-transactions and gifting**, not long-term storage of high-value assets. While our system is robust, its security depends entirely on the **length and complexity** of your Passphrase and PIN. For a detailed breakdown of our security trade-offs, please see our [Security Deep Dive](/concept/security-consideration/security-deep-dive). # Key generation This page shows the minimal JavaScript used in the seedless, disposable wallet framework to generate a private key from Passphrase and PIN inputs. ```javascript import { Buffer } from "buffer"; import { ethers } from "ethers"; import { scrypt } from "scrypt-js"; const HASH_OPTIONS = { N: 131072, // CPU/memory cost parameter, 2^17 r: 8, // block size parameter p: 1, // parallelization parameter keyLen: 64, }; const KDF_DOMAIN_SEPARATOR = "mybucks.online-core.generateHash.v2"; async function generatePrivateKey(passphrase, pin) { const passwordBuffer = Buffer.from(passphrase); const encoded = abi.encode( ["string", "string", "string"], [KDF_DOMAIN_SEPARATOR, passphrase, pin], ); const saltHash = ethers.keccak256(encoded); const saltBuffer = Buffer.from(saltHash.slice(2), "hex"); const hashBuffer = await scrypt( passwordBuffer, saltBuffer, HASH_OPTIONS.N, HASH_OPTIONS.r, HASH_OPTIONS.p, HASH_OPTIONS.keyLen, (p) => console.log(Math.floor(p * 100)) ); const hashHex = Buffer.from(hashBuffer).toString("hex"); const privateKey = ethers.keccak256(abi.encode(["string"], [hashHex])); return privateKey; } ``` You can find the code [here](https://github.com/mybucks-online/key-generation/blob/master/index.js) on Github. You can download the repository and execute it on your local machine as a confirmation and backup for account generation. And the same codebase is encapsulated in the [@mybucks.online/core](/concept/mybucks.online-core) npm package, facilitating developers in integrating wallet generation into third-party platforms or services. ### Run in Sandbox You can also execute this key-generation process in **CodeSandbox** without setting up a local environment. Please find the interactive CodeSandbox link [here](https://codesandbox.io/p/sandbox/mybucks-online-key-generation-sandbox-default-7jktdl). # Architecture This page explains the software architecture used to implement the seedless, disposable wallet framework behind the digital cash envelope product.
This project utilizes the following technical stacks: * JavaScript / React / styled-components * scrypt-js * ethers * Moralis SDK * @uniswap/default-token-list We use **Github Pages** and **Github Actions** for our deployment platform. # March 2026 Security Update This page outlines the technical shifts from Legacy to Default security modes. Following our successful month-long [Honeypot cracking challenge](https://hackenproof.com/programs/mybucks-dot-online-wallet-cracking-challenge) and expert reviews from **HackenProof** researchers, we have upgraded our wallet derivation architecture to provide higher resistance against specialized hardware (ASICs/GPUs) attacks. We maintain a "**Legacy**" mode to ensure backward compatibility for all wallets created before March 2026. ### What we upgraded? #### Scrypt Parameters
Scrypt ParametersLegacy (Pre-March 2026)Default (Current)
CPU/Memory Cost Parameter (N)2^152^17
Parallelization Parameter (p)51
Block Size Parameter (r)88
keyLen6464
#### Salt Generation * Legacy ```javascript const salt = `${passphrase.slice(-4)}${pin}`; saltBuffer = Buffer.from(legacySalt); ``` * Default ```javascript const KDF_DOMAIN_SEPARATOR = "mybucks.online-core.generateHash.v2"; const encoded = abi.encode( ["string", "string", "string"], [KDF_DOMAIN_SEPARATOR, passphrase, pin], ); const saltHash = ethers.keccak256(encoded); saltBuffer = Buffer.from(saltHash.slice(2), "hex"); ``` ### Why we upgraded? * **Hardened KDF Parameters**: Following OWASP recommendations, we recognize that memory-hardness (*N*) is a more critical defense against modern hardware attacks than parallelization (*p*). By increasing the cost factor *N* from 2^15 to 2^17 and reducing *p* from 5 to 1, we have increased the memory requirements fourfold—from **32MB** to **128MB**. This significantly raises the barrier for attackers while maintaining a similar **hashing time** on the user's browser. * **Entropy Preservation in Salt Derivation**: Our legacy salt generation inadvertently discarded significant entropy by only utilizing the final 4 characters of the passphrase. This created a potential vulnerability where different passphrases with common endings could generate identical salts. The new mechanism now incorporates the **full passphrase** into the salt derivation, ensuring that every unique credential produces a unique, high-entropy salt. * **Structured Encoding via abi.encode:** To prevent salt-collision vulnerabilities, we replaced simple string concatenation with `abi.encode`. This ensures that the boundary between the Passphrase and PIN is cryptographically preserved. By using fixed-length offsets and length-prefixing for each input, we eliminate the risk of "Canonicalization Attacks," where two different credential pairs could accidentally produce the same concatenated salt. * **Domain Separation**: To prevent **cross-protocol attacks** and the unauthorized reuse of hash results, we have introduced a **Domain Separator** into the salt generation process. This ensures that the keys derived for mybucks.online are cryptographically isolated and cannot be used to compromise or spoof other services. ### User Action & Compatibility For backward compatibility, we have added a new checkbox: '**This wallet was created before March 2026.**' If you are creating a new wallet after **March 9, 2026**, you can ignore this checkbox. If you need to access a wallet created before the update, please ensure the box is checked. ### Deprecation of Legacy Mode To maintain a streamlined and secure protocol, the "Legacy" checkbox is part of a temporary migration phase. We will support the Legacy derivation path for a sufficient period to allow all users to move their funds to the updated architecture. After this migration window closes, the checkbox will be removed from the primary interface, and the **Default** mode will become the sole standard for mybucks.online. # Security Consideration This page explains the main motivation for choosing Scrypt and Keccak256 in the seedless, disposable wallet framework. #### Scrypt Scrypt is chosen for its resistance to brute-force attacks. It is a memory-hard function, meaning it requires significant memory to compute, making it impractical to perform large-scale hardware attacks. Here are some key points about Scrypt: 1. **Memory-Hard Algorithm**: Increases the difficulty and cost of brute-force attacks. 2. **Time-Consuming**: Slows down the process of guessing credentials. 3. **Widely Trusted**: Used in various secure applications and cryptocurrencies. #### Keccak256 Keccak256, the hash function used in **Ethereum**, provides robust cryptographic security. Here’s why it is an excellent choice: 1. **Cryptographic Security**: Resistant to pre-image and collision attacks. 2. **Efficiency**: Fast and efficient hashing. 3. **Widely Adopted**: Standard for blockchain applications, ensuring compatibility and security. Combining Scrypt and Keccak256 ensures that both the credentials and wallet generation processes are secure, making it extremely difficult for attackers to compromise the system. *** # Brute Force Attack This page outlines one of the major threats: Brute Force attacks. In cryptography, a brute-force attack consists of an attacker submitting many passwords or passphrases with the hope of eventually guessing correctly. The attacker systematically checks all possible passwords and passphrases until the correct one is found. In a brute force attack, attackers often use **high-speed ASIC equipment**, similar to **Bitcoin mining** machines. These devices are approximately (10^6) times faster than modern CPUs. #### Assumptions * **Character Set Size:** 94 (26 uppercases + 26 lowercases + 10 digits + 32 special characters) * **Passphrase Length:** 12 characters * **Scrypt Parameters:** (N: 2^17, r: 8, p: 1) * **Scrypt Computation Time:** Approximately 0.5 seconds on a modern CPU. For the sake of this analysis, we assume an **ASIC speed-up factor** of `10^6`, making it `5 * 10^-7` seconds per computation. #### Analysis * **Size of Possible Passphrase Space**: $$ 94^{12} \approx 4.7 \times 10^{23} $$ * **Hashes per Second by Fastest ASIC**: $$ \text{Hashes per second} = \frac{1}{5 \times 10^{-7}} = 2 \times 10^6 \text{ scrypt computations per second} $$ * **Time to Brute Force**: $$ \text{Time (in seconds)} = \frac{4.7 \times 10^{23}}{2 \times 10^6} \approx 2.35 \times 10^{17} \text{ seconds} $$ * **Convert Seconds to Years**: $$ \text{Years} = \frac{2.35 \times 10^{17}}{60 \times 60 \times 24 \times 365} \approx 7.54 \times 10^9 \text{ years} \approx 7.54 \text{ billion years} $$ Even using the fastest known ASICs, a brute force attack would take approximately **7.54 billion years**, making it impractical. ### Additional Consideration: The Role of the PIN In the above analysis, we focused strictly on the complexity of a single passphrase, but the actual security of the wallet is even stronger because the **pair of passphrase and PIN** determines the private key and wallet address. By requiring both inputs, the system effectively creates a high-entropy, multi-factor credential that acts as a self-contained salt for the key derivation process. This means that even if a common passphrase is used, the addition of a unique PIN drastically increases the difficulty of a successful attack, as an attacker must guess the exact combination of both secrets to gain access. # Rainbow Tables This page outlines the expected size and availability of rainbow tables. A rainbow table is a precomputed table for caching the outputs of a cryptographic hash function, usually for cracking password hashes. They are an efficient way to perform time-memory trade-off attacks. #### Size of Rainbow Table Given: * Each rainbow table entry is composed of 44 bytes (12 bytes + 32 bytes). * To crack a passphrase, attackers would need a rainbow table that covers all possible combinations of characters of length 12. #### Calculation * **Number of possible combinations:** * Assuming a character pool of 94 characters (26 lowercase + 26 uppercase + 10 digits + 32 special characters) * Number of combinations = 94^12 * Approximate number of combinations ≈ 4.7 × 10^23 * **Size of the rainbow table:** * Size per entry = 44 bytes * Total Size (in bytes) = 44 bytes \* 4.7 × 10^23 * Impossible to store within the current storage capabilities Even with powerful storage solutions, creating and storing a comprehensive rainbow table for this passphrase space is practically infeasible due to the enormous size required. ### Additional Consideration: The Role of the PIN In the above analysis, we focused on the storage requirements for a passphrase space, but the actual security is exponentially higher because the pair of **passphrase and PIN** determines the private key and wallet address. Rainbow tables are only effective when an attacker can precompute hashes for common inputs and reuse them across many different targets. However, because the **PIN** acts as a personalized salt, an attacker would be forced to precompute a unique, near-infinite table for every possible PIN variation, which is practically impossible. This dual-input design ensures that even if a common passphrase is used, the specific combination of both secrets effectively neutralizes precomputed attacks and protects the wallet from time-memory trade-off techniques.
# Security Deep Dive This page addresses technical risks and architectural decisions frequently raised by security researchers and auditors during our community review process. **Threat: The salt used in the key derivation process is derived from the user's passphrase/PIN rather than being a globally unique, randomly generated value. This effectively makes it a "longer password" rather than a true cryptographic salt, potentially making the wallet vulnerable to various attacks.** **Architectural Response**: We acknowledge that by strict definition, a cryptographic salt should be a unique, random value stored alongside the hash. However, mybucks.online operates under a **Zero-Storage** philosophy. Since we do not have a database to store and serve unique salts to users, we must derive the key deterministically from the user’s own credentials. To mitigate the lack of a traditional random salt: * we mandate **high-entropy inputs**. Our UI utilizes a **strength meter** based on the **zxcvbn** algorithm, which actively prevents the use of common, compromised, or dictionary-based patterns. * By requiring both a Passphrase and a PIN, we utilize "**password chunking**"—a method that is more effective than a single long password because it encourages higher total entropy. This dual-input creates a high-entropy, self-contained "salt" that makes your wallet unique and resilient. * we use the **Scrypt** Key Derivation Function (KDF) with high-cost parameters. Scrypt is a "memory-hard" algorithm specifically designed to make brute-force and hardware-accelerated (ASIC/GPU) attacks extremely expensive. * **We recommend utilizing our auto-fill feature, which generates random Passphrase and PIN credentials** with approximately 130 bits of entropy; this ensures a machine-generated high-entropy input that effectively resolves the traditional 'unique salt' requirement. This design keeps your wallet secure without needing a central database, as long as you use long, unique credentials. This trade-off is what makes the wallet fully decentralized, private, and easy to use. **Threat: Anyone who has the Transfer Link can extract the wallet's passphrase and PIN because they are encoded in Base64 format.** **Architectural Response**: This architecture is a deliberate choice to support our **1-click gifting** mechanism and our commitment to a zero-server infrastructure. Anyone with the URL can extract the passphrase and PIN, as Base64 is an encoding format used for URL compatibility rather than a layer of encryption. Mybucks.online operates without any databases or storage, meaning the wallet is fully decentralized and exists only through the credentials provided in the link. This allows recipients to take ownership of a wallet instantly without registration or app installs. The convenience of a 1-click gift, allowing a wallet to be sent as easily as a chat link, is the primary value proposition of this feature. However, using standard URLs can expose credentials to being logged by ISPs, corporate firewalls, or third-party servers via referrer headers. To minimize this, we utilize hash fragments (#) to keep data in the browser and away from server logs. #### Disclaimer Convenience and one-time use are deliberate priorities; this is not a vault like MetaMask and does not target the same threat model as cold storage or a machine-generated 12/24-word seed phrase. A credential-based, browser-derived wallet is an intentional trade-off: accessible onboarding and 1-click gifting in exchange for users bearing responsibility for credential strength and for how gifting links are shared. The framework is meant for temporary envelopes and micro-gifting—not a primary vault or long-term wealth storage. #### User Responsibility & Security The safety of each envelope is directly tied to the **complexity of your credentials**. We strongly encourage a long, unique passphrase and PIN, or the **auto-fill** feature for machine-generated credentials. Accordingly, mybucks.online is intended for **micro-transactions and gifting**, not long-term storage of high-value assets. # Browser-Level Protection This page explains how we utilize browser-level security features, such as a strict Content Security Policy (CSP), to isolate your session and protect your data from external threats. #### Content Security Policy (CSP) MyBucks.online implements a strict Content Security Policy (CSP) to provide an essential layer of defense against Cross-Site Scripting (XSS) and data injection attacks. This policy instructs your browser to only execute scripts that are explicitly authorized and hosted on our verified domain. Because the app runs entirely in your browser as a **seedless, disposable wallet** framework, the CSP is configured to block all unauthorized third-party connections. This prevents malicious actors from injecting scripts that could attempt to capture your credentials or exfiltrate sensitive data. By enforcing these restrictions at the browser level, we ensure that the wallet's code remains isolated and secure during your entire session. Minimizing third-party JavaScript dependencies is a core security baseline for our project, significantly reducing the attack surface for XSS and malicious injections. #### Actual CSP Header ``` default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://cdn.moralis.io https://logo.moralis.io https://assets.coingecko.com https://beaverbuild.com https://opensea.io; font-src 'self' data:; connect-src https://*.infura.io https://api.trongrid.io https://deep-index.moralis.io https://api.blockchain.info https://bsc-dataseed.binance.org https://gasstation.polygon.technology; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests; ``` We have removed '**self**' from the **connect-src** directive in our Content Security Policy (CSP). Since mybucks.online is a fully static, browser-only application with no backend under the same origin, this keyword was unnecessary. #### Independent Security Verification We encourage users to independently verify our security configuration using the **Mozilla Observatory**. This is a free, open-source tool provided by Mozilla that scans websites to ensure they follow modern security best practices, such as the correct implementation of **Content Security Policy** (CSP) and secure transport protocols. By running a scan, you can view our current security grade and confirm that we have strictly restricted resource loading to protect your session. You can perform a live security audit of our domain at any time by visiting the [Mozilla Observatory](https://developer.mozilla.org/en-US/observatory) and entering **app.mybucks.online**.
# @mybucks.online/core This is an independent NPM package to handle key-generation and transfer-link. The core components responsible for hashing, private-key generation, and the logic to parse and generate transfer-link tokens have been extracted into an independent package [here](https://www.npmjs.com/package/@mybucks.online/core). **This provides a great opportunity for businesses to automate their airdrops or gifting effectively using mybucks.online.** By integrating this library, you can programmatically generate thousands of unique wallet links and distribute them via your own marketing platforms, email lists, or social media campaigns. ``` npm install @mybucks.online/core ``` # Main Features This page provides a visual tour of the digital cash envelope app—core flows in the seedless, disposable wallet interface.
# Transfer a wallet via URL This page explains the URL-based transfer feature for the digital cash envelope product—the seedless, disposable wallet framework's 1-click gifting flow—and the associated security warnings. With **mybucks.online**, you can send cryptocurrency—or transfer **the envelope itself** (full ownership of the one-time wallet and its contents) via a URL. The recipient simply clicks the link to open it and take full ownership. Try this link:\ [https://app.mybucks.online/#wallet=VWnsSGRGVtb0FjY291bnQ1JgIxMTIzMjQCb3B0aW1pc20=\_wNovT
]() ### What is it for? * **Effortless Gifting and One-time Use**\ This feature allows you to create a one-time wallet and put stablecoins or memecoins into it. You can transfer full ownership as a gift without ever asking for a recipient's address. These serve as a "starter" wallet for the recipients, who can then easily withdraw the funds into their own personal pockets or primary wallets. * **Massive Airdrops and Bulk Distribution**\ This is a powerful tool for bulk distribution and massive airdrops to many people simultaneously. You no longer need to ask for a wallet address or force users to connect their wallet to your app for a small $5 referral fee. You simply share the unique links through any messaging platform, social media, or email. * **Programmatic Generation and Export**\ Developers can use a few lines of code to generate a list of wallets and deposit funds programmatically. You can export these wallet links as a CSV file and feed them into third-party marketing platforms like Layer3. These platforms can then distribute the links as incentives or rewards to their users automatically. ### How it works? You can generate a link in the **Account Details** menu. Internally, this process encodes the passphrase and PIN into a URL-friendly format by **Base64** and generates a unique token. To ensure maximum privacy, this token is appended to the URL as a **hash fragment** (#wallet=...). Because information following the **#** symbol is handled exclusively by the browser, it is never sent to any server and will not appear in any server-side logs.\ When a user clicks the link, it will decode the passphrase and PIN, identify the active network, and open the account automatically. Developers can also review the [**@mybucks.online/core**](/concept/mybucks.online-core) package, which contains the essential logic for hashing and private key generation. This package is publicly available on npm and is also responsible for the logic to generate and parse gifting-link tokens. This provides a great possibility to generate wallet accounts programmatically for custom automation or integration into other platforms. #### ![⚠️](https://fonts.gstatic.com/s/e/notoemoji/16.0/26a0_fe0f/32.png) Security Warning * **The URL contains your credentials**: The passphrase and PIN are encoded into the URL. They are not encrypted. * **The recipient gains full access**: Anyone who has the link can extract the passphrase and PIN used for that specific wallet. * **Use temporary credentials**: Never use your primary email, bank, or exchange passwords for a gift wallet. * **One-time use**: Only use unique, temporary credentials for wallets you intend to transfer via URL. # Supported Chains Currently, it supports EVM chains and TRON, and we will continuously add other industry-leading networks. Below is a list of supported chain names and their corresponding IDs: * Ethereum Mainnet, 1 * BNB Chain, 56 * Polygon Mainnet, 137 * Arbitrum, 42161 * Avalanche C-Chain, 43114 * Optimism, 10 * ~~Linea, 59144~~ * ~~Celo, 42220~~ * Base, 8453 * Monad, 143 * TRON Mainnet # Token listings This page explains how to filter balances and display token lists. It currently filters balances based on @uniswap/default-token-list. This helps prevent scam or fake tokens. Please feel free to contact us for your token listings. # Security notice This page explains general, common hints for your security. Please follow these guidelines to keep your assets safe. Mybucks.online is a **digital cash envelope**, not a vault. The safety of each envelope is directly tied to the **complexity of your credentials**. * **Do not use your email or bank password.**\ Always use a unique passphrase and PIN that is not linked to your other sensitive accounts. * **Avoid simple passphrase and PIN. The longer the better**.\ Do not use easy patterns like "123456." Use a complex mix of letters, digits, and symbols to stay safe. * **Recommend using the auto-fill feature to generate a random Passphrase and PIN.**\ This provides machine-generated credentials input that meets or exceeds the security strength of a standard 12-word seed phrase. * **Do not store life savings or large amounts.**\ This product is a digital cash envelope for micro-transactions and gifting. It is not intended for long-term storage or high-value assets. * **Select the correct wallet version.**\ If your wallet was created before March 9, 2026, check the "This wallet was created before March 2026." box. If you are a new user, ignore this checkbox to use the updated default security. * **Do not use your private credentials for wallets that will be sent as a link.**\ Anyone with the gifting-link can extract full passphrase and PIN. Always use a temporary credentials for wallets intended as gifts or transfers. * **Be careful sharing URLs in public chats.**\ Anyone with the gifting-link can access the wallet instantly. Do not post your wallet URL in public social media comments or open groups unless you intend for anyone to claim it. * **Do not use the same credentials repeatedly.**\ Avoid using the same passphrase and PIN for different wallets or purposes. Unique credentials ensure one session does not affect others. * **Check the domain name carefully.**\ Phising sites often use lookalike domains to steal your keys. Always ensure you are on **app.mybucks.online** before entering any information. Bookmark the official link to avoid typing errors. * **Only use trusted devices and connections.**\ Avoid opening your wallet on public computers or unsecure Wi-Fi. Your security depends on the safety of your browser and device. * **Back up your credentials.**\ There is no reset or recovery process for your credentials. Nobody stores them. Once lost, you will lose access to your funds permanently. # Whitepaper Digital Cash Envelope — Seedless, Disposable Wallet with 1-Click Gifting ### 1) Design Philosophy Mybucks.online is a **digital cash envelope** for the internet—a Web3 utility for one-time use, gifting, and easy onboarding. It is designed for speed, convenience, and decentralization. It does not require app installs, browser extensions, or seed phrases. Under the hood, it implements a **seedless, disposable wallet** framework: human-readable credentials are converted into a wallet private key instantly using a one-way hash function in the browser. Mybucks.online is not intended to replace full-featured fortress wallets such as MetaMask or Trust Wallet. Mybucks.online targets micro-transactions and URL-based gifting, and aims to foster a lightweight, accessible gifting culture in Web3. *** ### 2) Security Architecture In mybucks.online, the **passphrase and PIN** are the primary credentials. It derives a private key from your passphrase and PIN using **Scrypt** and **Keccak256**. To strengthen resistance to brute-force attacks, the Scrypt Key Derivation Function (KDF) was intentionally chosen, as it increases the computational cost of key derivation. Key derivation runs **entirely in the browser** with no storage and no third-party key-management APIs. There is no server, no storage, and no database. The wallet is generated and erased instantly in the browser. Below is a minimal illustration of generating the private key from `passphrase` and `PIN` entirely on the client (browser-side): ```javascript import { Buffer } from "buffer"; import { ethers } from "ethers"; import { scrypt } from "scrypt-js"; const HASH_OPTIONS = { N: 131072, // 2^17 r: 8, p: 1, keyLen: 64, }; const KDF_DOMAIN_SEPARATOR = "mybucks.online-core.generateHash.v2"; const abi = new ethers.AbiCoder(); export async function generatePrivateKey(passphrase, pin) { const passwordBuffer = Buffer.from(passphrase, "utf8"); // Default mode: domain-separated salt derivation const encoded = abi.encode( ["string", "string", "string"], [KDF_DOMAIN_SEPARATOR, passphrase, pin] ); const saltHash = ethers.keccak256(encoded); const saltBuffer = Buffer.from(saltHash.slice(2), "hex"); // Memory-hard key derivation const hashBuffer = await scrypt( passwordBuffer, saltBuffer, HASH_OPTIONS.N, HASH_OPTIONS.r, HASH_OPTIONS.p, HASH_OPTIONS.keyLen ); const hashHex = Buffer.from(hashBuffer).toString("hex"); // Final wallet private key material return ethers.keccak256(abi.encode(["string"], [hashHex])); } ``` #### Scrypt Parameters | Parameter | Value | | --------- | ----- | | N | 2^17 | | r | 8 | | p | 1 | | keyLen | 64 | #### March 2026: hardened Default mode Following an open wallet cracking challenge and expert reviews, mybucks.online improved resistance to specialized **ASIC/GPU** attacks: * **Scrypt cost upgrade**: `N` increased from `2^15` to `2^17` (memory-hardness \~32MB -> \~128MB) * **Lower parallelization**: `p` reduced from `5` to `1` * **Safer salt derivation**: improved domain-separated salt generation that incorporates the full passphrase and PIN, preserving entropy without relying on stored random salts (aligned with the zero-storage philosophy) N=`2^17` was selected in line with OWASP minimum recommendation, while maintaining practical UX performance on mobile environments. For backward compatibility, a **Legacy** mode exists for wallets created before March 2026. *** ### 3) 1-Click Gifting: Wallet via URL With mybucks.online, you can send cryptocurrency and even the **wallet itself via a URL**. The passphrase, PIN, and active network ID are encoded into a URL hash fragment and shared. On the recipient side, the payload is parsed and restored, key derivation runs automatically, and the wallet opens immediately. There is no server-side link expiration: the derived on-chain address is fixed, and the same transfer link can reopen that wallet at any time. For as long as funds remain at that address, they are accessible to anyone who holds the link. This enables one-time starter wallets for gifting without requesting wallet addresses, and supports **bulk distribution** and **massive airdrops** through shareable links. Below is a minimal codebase to show how to encode credentials into URL format. ```javascript const TOKEN_VERSION_COMPACT = 0x02; const passphraseBytes = Buffer.from(passphrase, "utf-8"); const pinBytes = Buffer.from(pin, "utf-8"); const networkBytes = Buffer.from(network, "utf-8"); const payloadBuffer = Buffer.concat([ Buffer.from([TOKEN_VERSION_COMPACT]), Buffer.from([passphraseBytes.length]), passphraseBytes, Buffer.from([pinBytes.length]), pinBytes, Buffer.from([networkBytes.length]), networkBytes, ]); // Convert Base64 to Base64URL so token remains safe in URL hash/query contexts. const base64Encoded = payloadBuffer .toString("base64") .replace(/\+/g, "-") .replace(/\//g, "_") .replace(/=+$/g, ""); const padding = nanoid(12); const token = padding.slice(0, 6) + base64Encoded + padding.slice(6); console.log("https://app.mybucks.online/#wallet=" + token); ``` *** ### 4) Core Package Integration Core functions such as key derivation and URL parameter generation/parsing are published as an independent package, **@mybucks.online/core**, in the npm registry. {% embed url="" %} Below is a minimal codebase to generate temporary accounts for massive airdrops programmatically. ```javascript import { generateHash, getEvmPrivateKey, getEvmWalletAddress, getTronWalletAddress, generateToken, randomPassphrase, randomPIN, } from "@mybucks.online/core"; const network = "polygon"; const passphrase = randomPassphrase(6); const pin = randomPIN(8); // Example passphrase: ZaeJU~-@T_PhV-.+tJ0'-EWC}6w // Example PIN: kzsh4ees const hash = await generateHash(passphrase, pin); // Example hash: b5a1d33cd5db14e97d6896d7845d9b49cefcac8e0ae6a9b8261f386f9dcd1c4cd3f409ee72e640dce05392af1766cb06c038eff01d04212e5e9a0ea6dcf18f35 const privateKey = getEvmPrivateKey(hash); const address = network === "tron" ? getTronWalletAddress(hash) : getEvmWalletAddress(hash); const walletToken = generateToken(passphrase, pin, network); const giftingLink = "https://app.mybucks.online/#wallet=" + walletToken; console.log({ passphrase, pin, privateKey, address, network, walletToken, giftingLink }); ``` *** ### 5) Browser-Level Hardening mybucks.online uses strict **Content Security Policy (CSP)** to reduce risks from XSS and unauthorized script injection by restricting where resources and connections can come from. For transfer links, credential data is encoded in a URL **hash fragment** (`#wallet=...`) so it stays browser-side and helps reduce exposure in typical server-side logs and upstream network logging paths. The `wallet` parameter is removed immediately after parsing, further reducing the risk of unexpected sharing through the Referer HTTP header. *** ### 6) Vulnerabilities and Mitigation Strategy This section summarizes ethical hackers' feedback on potential vulnerabilities and our mitigation approach. #### Major Vulnerabilities * The salt in key derivation is deterministically derived from passphrase/PIN instead of using a globally unique random salt. * Users can choose weak, compromised, or common passphrase/PIN combinations. * Anyone with a transfer link can extract passphrase/PIN because they are Base64-encoded for URL transport. #### Our Response * Added `zxcvbn` validation to actively block common, compromised, and dictionary-based patterns. * Instead of relying on a single long password, we use both a Passphrase and PIN, applying a password-chunking approach. * Users are strongly encouraged to choose long, unique credentials and use the auto-fill feature for high-entropy passphrase/PIN generation (approximately 130-bit entropy). * This product prioritizes convenience and accessibility, with explicit trade-offs relative to maximum-security wallet models. * Explicitly positioned mybucks.online for micro-gifting and convenience, not for long-term storage of high-value assets. *** ### 7) Networks & Token Display Supported networks include: * **EVM chains** (e.g., Ethereum, BNB Chain, Polygon, Arbitrum, Avalanche C-Chain, Optimism, Base) * **TRON** Token display is filtered against **@uniswap/default-token-list** to help reduce scam/fake token visibility. *** ### 8) Trust & Verification Security documentation and verification resources provided in the project: * [**Secure3 security audit**:](/more/security-audits#secure3) published findings (links available in the docs) * [**HackenProof wallet cracking challenge**](/more/security-audits#hackenproof): community stress-testing and follow-up security improvements *** ### ⚠️ Disclaimers & User Responsibility Important: * mybucks.online is a **digital cash envelope** for micro-transactions and gifting, not a fortress wallet or long-term storage for high-value assets. * There is **no reset/recovery** for the **passphrase + PIN**. If lost, funds will be permanently inaccessible. * To withdraw funds from a gifting wallet, the recipient needs a small amount of the chain’s native token to pay network gas; the gift giver is encouraged to deposit that together with the gift. *** ### References * [https://mybucks.online](https://mybucks.online/) * [https://app.mybucks.online](https://app.mybucks.online/) * * * # Security Audits We received a security audit from Secure3, and battle-tested on HackenProof. ## Secure3 **Secure3** is a battlefield where elite auditors compete to safeguard Web3 innovations against security threats. They have provided security audits for over 140 projects, including zkSync, Polkadot, and more! All findings have been successfully resolved and published on their site. The audit report can be found here: * * **Note:** Secure3 is currently experiencing technical issues with their content server. We have provided the GitHub link as a secondary option to ensure you can always access the report. ## HackenProof A huge thank you to Hackenproof and their incredible ethical hackers who stress-tested our protocol, including [@seifelsallamy](https://hackenproof.com/hackers/seifelsallamy), [@jonas-millard](https://hackenproof.com/hackers/jonas-millard), [@hartjustin6](https://hackenproof.com/hackers/hartjustin6) and [@cats-are-aliens](https://hackenproof.com/hackers/cats-are-aliens). **HackenProof** is a bug bounty platform that connects blockchain companies with a global community of ethical hackers to uncover security vulnerabilities. To battle-test our architecture, we’ve launched an open-entry Wallet Cracking Challenge here: After a month-long active cracking window, the Honeypot wallet proved its resilience. We have successfully withdrawn the bounty funds. To allow for community verification of our deterministic derivation, the credentials used were: ![🔑](https://fonts.gstatic.com/s/e/notoemoji/17.0/1f511/32.png) Passphrase: **3xFbsYA9V\*FP** ![🔢](https://fonts.gstatic.com/s/e/notoemoji/17.0/1f522/32.png) PIN: **225588** In addition to the challenge, we received several constructive reports and architectural reviews from the community. To implement these insights and further harden the security of mybucks.online, we have released a [major update](/concept/march-2026-security-update). This new version—featuring optimized **Scrypt parameters** and an enhanced **salt generation** mechanism—is now the **default** for all new wallets. ## Building Trust Our goal is to continuously enhance our product and undergo additional security audits. By obtaining more certifications, we aim to build trust and ensure you can use our product with confidence. # Roadmap Our roadmap highlights two primary focuses: building trust and integrating various crypto networks into our product, all while enhancing UI/UX performance. ### Building Trust Building trust is paramount. We aim to assure our users that they can use our product confidently and securely, without any concerns. To achieve this, We will conduct regular security audits and obtain certifications from industry leaders. ### Network Integration Integrating more networks into our product is our next focus. This integration ensures that users can seamlessly manage their valuable crypto assets within our space, eliminating the need to switch platforms. We plan to add more networks, such as Tron, Solana, and TON. The integration of Tron is currently underway. By following this roadmap, we are committed to providing our users with a secure, reliable, and user-friendly experience while expanding our platform's capabilities. ### Your Donation Will Accelerate Our Progress 💰 Your support plays a crucial role in helping us achieve our goals more swiftly. By contributing, you enable us to advance security audit and development. # FAQs This page covers frequently asked questions and their answers.
How does mybucks.online work? Mybucks.online is a **digital cash envelope** for the internet—a Web3 utility built on a **seedless, disposable wallet** framework. It turns your credentials into a wallet private key directly, without seed phrases, site registration, app installs, or extension downloads.\ Only the **passphrase and PIN** determine the private key and wallet address, allowing you to create a wallet in seconds on your browser.\ It internally uses the **Scrypt** Key Derivation Function (KDF) and **Keccak256**, making brute-force attacks computationally expensive and impractical compared to old-school "Brain wallets."
What is the uniqueness, and advantage? By utilizing a human-readable and memorable passphrase and PIN as a key, it eliminates the need for seed phrases, site registration, or separate private key storage, ensuring **user-friendliness** without compromising safety. It is self-custodial, decentralized, hosted on a public domain and provides instant-access. No KYC is required, and truly self-custodial. With MyBucks.online, you can "**Send the Wallet**" instead of just the coins by sharing a 1-Click URL via Telegram or WhatsApp. The recipient just clicks the link to instantly take full ownership of the assets with no app installs or registration required. This makes it perfect for gifting and airdropping.
What purpose can you use this for? Mybucks.online is a **digital cash envelope**—designed for **speed** and **convenience**, not as a fortress wallet. It is ideal for **micro-gifting** and small, instant transactions. It is not intended for long-term storage of your life savings. It is not for interacting with dApps. Do not store large amounts like 1 BTC here.
What is the passphrase and PIN? The **passphrase** is the primary field used to generate a private key and create your account. The **PIN** is added specifically to resolve the "**random salt**" issue in a zero-storage environment**.** It also serves as a secure layer to protect sensitive information during a live session. These two fields are **combined** together to generate a private key.
Is it free? is there any service fee? The wallet itself is **free to use**, but standard blockchain transaction fees will apply. Your generous donations help us continuously enhance and improve our product.
Can I recover credentials? No. You **can't reset or recover** the passphrase and PIN. Do not lose them and back them up.
How can I change or update my credentials? There is **no direct method to change** the passphrase and PIN. Each passphrase and PIN generates a unique wallet. To update your credentials, create a new wallet with the desired passphrase and PIN and transfer your assets to it.
Can different credentials generate the same account? No absolutely! Each passphrase and PIN uniquely generates its own corresponding private key and wallet address. The **Scrypt** and **Keccak256** algorithms transform the passphrase and PIN into a 256-bit private key. These two hash functions produce pseudo-random values and are widely verified and accepted across the industry.
Who can know or steal my passphrase and PIN? **Malware** can **steal** your credentials by tracking keystrokes. Avoid using personal information, such as your **name** or **birthday** as a passphrase or PIN. There's no admin or database, so your credentials are safe from us.
What is the backup option? You can back up private key itself as plain text. You can import the private key into other wallet like Metamask.
What is the risk or vulnerability? A simple passphrase and PIN are **susceptible** to brute force attacks, and there is **no option to recover** or reset the credentials. Once lost, you will lose your funds permanently.
Does it support privacy? Absolutely! No server, no database, no storage, and no tracking. Your keys are generated entirely in your browser’s temporary memory and vanish the moment you close the tab. It does not require personal information, including an email address, and using a one-way hash function means sharing the wallet address does not compromise the private key or credentials.
I received cryptocurrency. but it is not shown in my wallet. It may take a couple of minutes to update your balance in the wallet. Please ensure you have selected the correct blockchain network.
Why is my account locked automatically? To safeguard your funds, the system **locks** your account after 15 minutes of inactivity.
Is it open source? can I review the codebase? Yes, it is fully open source. You can review the codebase [here](https://github.com/mybucks-online/app). It is deployed into Github Pages by using Github Actions.
Can I store NFT in this wallet? Currently, there is no UI to manage NFTs, but you can still store them in this wallet without any issues.
Can I connect DeFi apps to this wallet? It is not designed for interaction with Web3/dApps, but you can extract the private key into MetaMask and connect to DeFi apps.
How can I trust this wallet? We prioritize transparency. Our codebase, deployment processes, and actions are all managed on GitHub. You can verify the codebase, deployment history, and DNS configuration and audit reports.
How long does it take to brute force 12 length passphrase? A passphrase with 94 possible characters (uppercase + lowercase + digits + symbols) and a length of 12 would have approximately (94^12) possible combinations. Assuming each brute-force attempt takes less than 1 millisecond with a cutting-edge ASIC attacker, it would take about (5.36 \* 10^23) milliseconds, or roughly **(1.7 \* 10^13) years**, to exhaust all possibilities. This duration is extremely long and practically unbreakable by brute force methods.
What would be the size of a rainbow table required to store all possible 12-character passphrase along with their corresponding hash results? Storing a full rainbow table for all 12-character passwords with 94 characters each would need about **(1.5 \* 10^10) petabytes of storage**. This shows that creating and storing such a large table is impractical, making longer, complex passphrase more secure against these attacks.
# License Mybucks.online is licensed under the MIT License. ``` MIT License Copyright (c) 2024 Mybucks.online Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. ``` # Terms of Use **Last updated:** June 2026 ### 1. Acceptance of Terms By accessing or using Mybucks.online ("the Service", "we", "us", or "our"), you agree to be bound by these Terms of Use ("Terms"). If you do not agree to these Terms, you must not use the Service. ### 2. Description of Service MyBucks.online is a **digital cash envelope** for the internet—a browser-based Web3 utility for one-time use, gifting, and easy onboarding. For purposes of these Terms, the Service implements a **seedless, disposable, self-custodial wallet framework**. It is not a fortress wallet or general-purpose Web3 provider (such as MetaMask) and does not support dApp interaction, DeFi interfaces, or long-term vault use. The Service generates a private key from your passphrase and PIN inputs using an industry-standard, verified one-way hash function (scrypt Key Derivation Function and keccak256). Your private key forms your account, allowing you to transfer, receive, and manage your crypto assets. The Service offers two derivation standards: **Legacy** (original) and **Default** (March 2026 hardened standard). The Default mode utilizes an upgraded Scrypt configuration with N=2^17 and structured salt encoding via abi.encode for enhanced brute-force resistance. Additionally the service allows users to generate unique URLs that contain the necessary credentials to access a specific wallet. This feature is designed for instant activation and ownership transfer without the need for the recipient to install software or provide a wallet address. The Service is a specialized tool for direct asset transfers and gifting. It is not a general-purpose Web3 provider and does not support direct interaction with decentralized applications (dApps), smart contract execution interfaces, or NFT marketplaces. #### Key Features * **Zero Footprint**: The Service is entirely browser-based and operates without any server-side storage. Your private key is generated instantly from your passphrase and PIN inputs; once you close or refresh your browser, no data footprint remains on our infrastructure. * **Fast and Easy**: Access to your wallet requires only a passphrase and PIN. There are no app installs, no browser extensions, and no seed phrases required. This allows for immediate wallet creation while maintaining a fully self-custodial architecture where you hold 100% control of your keys. * **1-Click Gifting (URL Transfer)**: You can generate a unique "Transfer Link" to send a wallet and its contents to others. This feature encodes credentials into a URL, allowing recipients to take full ownership of the assets instantly without registration or account setup. ### 3. Self-Custodial Nature and User Responsibility #### 3.1 Self-Custodial Wallet You acknowledge and agree that: * You are solely responsible for the custody and security of your passphrase, PIN, and private keys * You are responsible for remembering which security version (Legacy or Default) was used to create your wallet. Selecting the incorrect version will result in a different private key and address being generated. * We do not store, have access to, or can recover your passphrase, PIN, or private keys. * You are solely responsible for any transactions initiated from your wallet. #### 3.2 No Account Recovery **IMPORTANT**: There is no account recovery mechanism. If you lose your passphrase or PIN, you will permanently lose access to your wallet and all assets. We cannot and will not assist in recovering lost credentials. #### 3.3 Backup Responsibility You are solely responsible for: * Safely storing and backing up your passphrase and PIN. * Maintaining the confidentiality of your credentials. * Ensuring you can access your wallet when needed. #### 3.4 Risks of URL-Based Transfers The Service includes a "Transfer via URL" feature that allows for 1-click gifting and wallet sharing. By using this feature, you acknowledge and agree to the following: * Credential Exposure: You understand that this feature encodes your passphrase and PIN directly into the URL string. This data is not encrypted and can be decoded by anyone who has access to the link. * Transmission Risk: You assume all responsibility for the secure transmission of these links. We are not liable for funds lost due to link interception on third-party messaging platforms (e.g., Telegram, WhatsApp, Discord) or via email. Browser Logs: You acknowledge that URLs containing credentials may be stored in your browser history, cache, or by your Internet Service Provider (ISP). You are responsible for clearing your local history when using this feature on shared or public devices. ### 4. Risks and Disclaimers A consolidated summary of disclaimers is available on the [Disclaimers](/more/disclaimers) page. The following sections form part of the binding Terms. #### 4.1 Cryptocurrency Risks You acknowledge that: * Cryptocurrency transactions are irreversible. * The value of cryptocurrencies is highly volatile and can result in significant losses. * Cryptocurrency markets are unregulated and may be subject to manipulation. * There is no guarantee that cryptocurrency will maintain its value or liquidity. #### 4.2 Technical Risks You understand and accept that: * The Service relies on blockchain networks that may experience congestion, forks, or other technical issues. * Network fees may apply to transactions and can be significant. * Smart contract interactions carry inherent risks. * Browser-based applications may be subject to security vulnerabilities. * You are responsible for ensuring your device and browser are secure and free from malware. #### 4.3 No Warranties THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. ### 5. Limitation of Liability **5.1 General Limitation** TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL MYBUCKS.ONLINE, ITS DEVELOPERS, CONTRIBUTORS, OR AFFILIATES BE LIABLE FOR: * ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES; * LOSS OF PROFITS, REVENUE, DATA, OR USE; * LOSS OF CRYPTOCURRENCY ASSETS (INCLUDING BUT NOT LIMITED TO LOSSES DUE TO VOLATILITY, NETWORK FAILURES, OR USER ERROR); * UNAUTHORIZED ACCESS TO OR USE OF YOUR WALLET; * ANY DAMAGES RESULTING FROM YOUR USE OR INABILITY TO USE THE SERVICE; **5.2 Intended Use ("Pocket Money" Policy)** You acknowledge that the Service is designed as a disposable, high-utility tool for low-value transactions, onboarding, and gifting ("pocket money"). The Service is not intended for, nor does it support, interacting with dApps. It is NOT intended for the storage of high-value assets or long-term "cold" storage. If you choose to store significant value or your primary wealth within the Service, you do so at your own exclusive risk and acknowledge that the Service was not designed for such use cases. While we provide a 'Legacy' mode for backward compatibility, this mode is considered a deprecated security standard. Users are strongly encouraged to migrate assets to the Default mode to benefit from current industry-standard protections. MyBucks.online is not liable for losses resulting from the continued use of the Legacy mode after the migration period. **5.3 URL-Based Loss** Specifically, MyBucks.online shall not be liable for any loss of funds resulting from the use of the "Transfer via URL" feature, including but not limited to: * Interception of links by third parties. * Unauthorized access to browser history or device cache. * Accidental public sharing of a transfer link. **5.4 Sole Risk** YOU ACKNOWLEDGE THAT YOUR USE OF THE SERVICE IS AT YOUR SOLE RISK AND THAT YOU ARE SOLELY RESPONSIBLE FOR ANY LOSSES INCURRED. ### 6. Prohibited Uses You agree not to: * Use the Service for any illegal purpose or in violation of any laws or regulations. * Use the Service to engage in money laundering, terrorist financing, or other criminal activities. * Attempt to gain unauthorized access to the Service or any related systems. * Interfere with or disrupt the Service or servers. * Use the Service in any manner that could damage, disable, or impair the Service. * Use automated systems or bots to access the Service without authorization. ### 7. Intellectual Property The Service is open-source software licensed under the MIT License. You may use, modify, and distribute the software in accordance with the terms of that license. However, the Mybucks.online name, logo, and branding are protected intellectual property. ### 8. Privacy Our privacy practices are described in the [Privacy Policy](/more/privacy-policy). In summary: * No registration or personal information is required. * No passphrases, PINs, or private keys are stored or transmitted to our servers. \ **Note:** When utilizing the "**Transfer via URL**" feature, credentials exist within the URL string to facilitate decentralized, client-side access. These credentials never touch our infrastructure but are visible to the user's local environment and any party with whom the link is shared. * All key generation and wallet operations occur entirely in your browser. * We do not track user activities within the wallet application. * Analytics may be used on the landing page only (not within the wallet application). ### 9. Service Availability and Modifications #### 9.1 Availability We do not guarantee that the Service will be available at all times or that it will be free from errors, interruptions, or security vulnerabilities. The Service may be unavailable due to: * Maintenance or updates * Technical issues * Network problems * Force majeure events #### 9.2 Modifications We reserve the right to: * Modify, suspend, or discontinue the Service at any time. * Update these Terms at any time. * Change the Service's features or functionality. * Deprecate and remove the 'Legacy' compatibility checkbox after a sufficient migration period. Following removal, users may need to use archived versions of the open-source code to access wallets created under the Legacy standard. We will make reasonable efforts to notify users of significant changes, but you are responsible for reviewing these Terms periodically. ### 10. Third-Party Services and Links The Service may integrate with or link to third-party services, including: * Blockchain networks (Ethereum, Tron, etc.) * Blockchain explorers * Token lists (e.g., Uniswap default token list) * External APIs (Infura, Moralis, Trongrid) #### 10.1 Token Filtering Token balances displayed in the Service are filtered based on the Uniswap default token list. This filtering mechanism helps to hide spam tokens and improve user experience by showing only verified tokens. **Important Notes:** * Not all tokens in your wallet may be displayed if they are not included in the filtering criteria. * The filtering conditions may be updated or modified at any time without prior notice. * Tokens that are filtered out are still in your wallet and accessible through other means (e.g., direct contract interaction). * We do not guarantee that all legitimate tokens will be displayed, nor that all spam tokens will be filtered. #### 10.2 Third-Party Service Disclaimers We are not responsible for: * The availability, accuracy, or reliability of third-party services * Any losses resulting from the use of third-party services * The content, privacy practices, or terms of third-party services * The accuracy or completeness of token lists used for filtering #### 10.3 Infrastructure and Deployment The Service is hosted using GitHub Pages and deployed via GitHub Actions. You acknowledge that: * Service availability is subject to GitHub’s uptime and Terms of Service. * The transparency of the deployment process allows you to verify that the live site matches the open-source repository, but we are not responsible for any failures or security breaches originating from the GitHub platform itself. ### 11. Compliance and Legal Requirements You are solely responsible for: * Complying with all applicable laws and regulations in your jurisdiction. * Determining whether your use of the Service is legal in your jurisdiction. * Paying any taxes that may be due on transactions or holdings. * Complying with anti-money laundering (AML) and know-your-customer (KYC) requirements if applicable. ### 12. Indemnification You agree to indemnify, defend, and hold harmless Mybucks.online, its developers, contributors, and affiliates from any claims, damages, losses, liabilities, and expenses (including legal fees) arising from: * Your use of the Service * Your violation of these Terms * Your violation of any law or regulation * Your infringement of any rights of another party ### 13. Service Discontinuation #### 13.1 Service Availability Since the Service is a self-custodial, browser-based application with no user accounts or registration system, we cannot terminate or suspend individual user access. However, we reserve the right to: * Discontinue hosting the Service on our public domain at any time. * Modify or remove the Service from public availability. * Stop maintaining or updating the Service. #### 13.2 Your Right to Discontinue Use You may stop using the Service at any time. Since the Service operates entirely in your browser and does not store any data, simply closing your browser or not accessing the website constitutes discontinuing use. #### 13.3 Open Source Nature The Service is open-source software licensed under the MIT License. If the public service is discontinued, you may continue to use the software by hosting it yourself or using community-maintained versions, subject to the MIT License terms. ### 14. Governing Law and Dispute Resolution These Terms shall be governed by and construed in accordance with applicable laws. Any disputes arising from or relating to these Terms or the Service shall be resolved through appropriate legal channels. ### 15. Severability If any provision of these Terms is found to be unenforceable or invalid, that provision shall be limited or eliminated to the minimum extent necessary, and the remaining provisions shall remain in full force and effect. ### 16. Entire Agreement These Terms constitute the entire agreement between you and Mybucks.online regarding the use of the Service and supersede all prior agreements and understandings. ### 17. Contact Information If you have any questions about these Terms, please contact us through: * Email: ### 18. Acknowledgment BY USING THE SERVICE, YOU ACKNOWLEDGE THAT: * YOU HAVE READ, UNDERSTOOD, AND AGREE TO BE BOUND BY THESE TERMS; * YOU UNDERSTAND THE RISKS ASSOCIATED WITH CRYPTOCURRENCY AND SELF-CUSTODIAL WALLETS; * YOU ARE SOLELY RESPONSIBLE FOR THE SECURITY OF YOUR CREDENTIALS, ASSETS, AND THE SELECTION OF THE CORRECT WALLET VERSION (LEGACY OR DEFAULT) DURING ACCESS; * YOU WILL NOT HOLD MYBUCKS.ONLINE LIABLE FOR ANY LOSSES RESULTING FROM YOUR USE OF THE SERVICE; * YOU ACKNOWLEDGE THAT THIS SERVICE IS INTENDED SOLELY FOR MICRO-TRANSACTIONS AND GIFTING; YOU ASSUME ALL RISK IF YOU CHOOSE TO STORE LARGE ASSETS OR USE THE SERVICE FOR LONG-TERM STORAGE; * YOU UNDERSTAND THE SERVICE IS NOT DESIGNED FOR DAPP INTERACTIONS, DEFI TRADING, OR LONG-TERM STORAGE; *** **IMPORTANT REMINDER**: Mybucks.online is a **digital cash envelope**—a self-custodial, disposable wallet for micro-transactions and gifting, not a fortress wallet or long-term vault. You are solely responsible for your passphrase, PIN, and private keys. We cannot recover your wallet if you lose your credentials. This Service is not intended for dApp interactions, high-value assets, or long-term storage. Use the Service at your own risk. # Privacy Policy **Last updated:** June 2026 #### 1. Scope This Privacy Policy describes how Mybucks.online ("we", "us", or "our") handles information when you use: * **mybucks.online** — the marketing and information website (the "Landing Site") * **app.mybucks.online** — the browser-based wallet application (the "Wallet App") * **docs.mybucks.online** — project documentation Together, these are referred to as the "Service" or "Services". This policy does **not** apply to **p2p.gifts** or other third-party websites, even when they link to or integrate with Mybucks.online. p2p.gifts has its own [Terms of Use](/p2p.gifts/terms-of-use) and [Privacy Policy](/p2p.gifts/privacy-policy). #### 2. Privacy by Design Mybucks.online is a **digital cash envelope** built on a **seedless, disposable, browser-based wallet** framework. The Wallet App does not require registration, accounts, or email addresses. Passphrases, PINs, and private keys are **not stored on our servers** and are **not transmitted to Mybucks.online infrastructure** during normal wallet use. Key generation, signing, and credential handling occur **entirely in your browser**. When you close or refresh the tab, wallet secrets are cleared from the application's memory. We do not operate a backend database of user wallets or credentials. #### 3. Information We Do Not Collect In the Wallet App, we do **not**: * Require or store your name, email, phone number, or government ID * Store your passphrase, PIN, private keys, or seed material on our servers * Log wallet credentials or transaction signing inputs on Mybucks.online servers * Track in-app wallet activity for analytics or advertising There is no account system and no server-side user profile. #### 4. Information Processed in Your Browser When you use the Wallet App, the following stays on **your device** unless you choose to share it (for example, by sending a gifting link to someone else): * Passphrase and PIN inputs * Derived private keys and wallet addresses * Transaction data you choose to sign and broadcast You are responsible for protecting this information on your device, including browser history, clipboard contents, and shared links. #### 5. Transfer via URL (Gifting Links) The Wallet App and related tools can generate URLs that encode wallet credentials so a recipient can access a wallet without installing software. * Credential data is placed in the URL **hash fragment** (`#wallet=...`). Hash fragments are handled by the browser and are **not sent to web servers** in HTTP requests. * Anyone who obtains the full URL can decode the credentials and access the wallet. * URLs may be stored in browser history, bookmarks, sync services, or messaging apps you use to share them. See also: [Transfer via URL](/user-guide/transfer-a-wallet-via-url) and [Terms of Use — Section 3.4](https://docs.mybucks.online/more/pages/HNUvb8RsQVz6LZz5zy47#id-3.4-risks-of-url-based-transfers). #### 6. Third-Party Services (Wallet App) The Wallet App runs in your browser and may connect **directly from your browser** to third-party providers for blockchain and market data. These requests are initiated by your device, not routed through Mybucks.online servers. Examples include: | Provider | Purpose | Data typically sent | | -------------------------------------- | -------------------------------------------------- | --------------------------------------------------------------- | | **Infura** (and similar RPC endpoints) | Read chain state, broadcast signed transactions | Public wallet address, signed transaction payloads, RPC queries | | **Moralis** | Token balances and (when enabled) transfer history | Public wallet address, chain ID, token contract addresses | | **TronGrid** | TRON network access | Public wallet address, TRON-related RPC queries | | **Blockchain explorers** | Links opened by you | Depends on the explorer; usually via standard web navigation | | **Google Fonts** | Typography | Standard font CDN requests | | **TrustedSite** (optional badge) | Trust / security badge display | Standard third-party script requests | We do not control how these providers collect, use, or retain data. Their practices are governed by their own privacy policies. You should review those policies if you have concerns about third-party processing. **Important:** Third parties receive your **public wallet address** and network-related query data. They do **not** receive your passphrase or PIN from Mybucks.online, because we never send those to our own servers. Optional token history (`VITE_ENABLE_TOKEN_HISTORY`) uses Moralis from the browser when enabled in a given deployment. #### 7. Local Storage (Wallet App) The Wallet App may store **non-sensitive preferences** in your browser's local storage — for example, light/dark theme choice. This does not include passphrases, PINs, or private keys. #### 8. Landing Site Analytics The Landing Site (**mybucks.online**) may use **Google Tag Manager** for aggregated website analytics (such as page views and referral sources). This analytics is intended for the **marketing site only**, not for in-wallet activity inside **app.mybucks.online**. The Wallet App is configured with `noindex` directives and is designed **without** first-party analytics or advertising trackers in the wallet interface. Analytics on the Landing Site may involve cookies or similar technologies managed by Google. You can manage preferences through your browser settings and, where applicable, Google's opt-out tools. #### 9. Hosting and Infrastructure The Services are hosted on third-party platforms (for example, **Netlify** for the Landing Site and **GitHub Pages** for the Wallet App and documentation). Those platforms may process standard web server logs (such as IP address, user agent, and requested URL path). Because wallet credentials in gifting links use URL **hash fragments**, those fragments are **not** included in typical server access logs for page loads. Static site hosting does not give Mybucks.online access to your wallet secrets. #### 10. Documentation Site **docs.mybucks.online** serves static documentation. It does not provide wallet functionality and is not intended to collect personal information beyond ordinary web hosting logs from the hosting provider. #### 11. Open Source Mybucks.online is open-source software. Anyone may review, fork, or self-host the code. If you use a copy hosted by someone other than Mybucks.online, that operator's privacy practices may differ from this policy. #### 12. Security We apply browser-level protections (including Content Security Policy) to limit which third-party domains the Wallet App may contact. No method of electronic storage or transmission is completely secure. You are responsible for securing your device, browser, and credentials. See: [Security Notice](/user-guide/security-notice), [Browser-Level Protection](/concept/security-consideration/browser-level-protection). #### 13. Children The Service is not directed at children under 13 (or the minimum age required in your jurisdiction). We do not knowingly collect personal information from children. #### 14. Your Rights Depending on where you live, you may have rights to access, correct, delete, or restrict processing of personal information held by a data controller. Because the Wallet App does not maintain user accounts or store credentials on our servers, we generally **cannot** identify or delete wallet data on your behalf — that data exists only in your browser or on public blockchains. For Landing Site analytics, you may use browser controls and applicable vendor opt-out mechanisms. To exercise rights or ask questions, contact us using the details below. #### 15. International Users The Service may be accessed from many countries. Third-party providers (RPC, analytics, hosting) may process data in jurisdictions outside your own. By using the Service, you understand that such transfers may occur. #### 16. Changes to This Policy We may update this Privacy Policy from time to time. The "Last updated" date at the top will be revised when changes are published. Continued use of the Service after updates constitutes acceptance of the revised policy where permitted by law. Material changes may also be reflected in project documentation or release notes. #### 17. Contact Questions about this Privacy Policy: * Email: * Website: * Documentation: #### 18. Related Documents * [Terms of Use](/more/terms-of-use) * [Disclaimers](/more/disclaimers) * [Introduction](/) * [Architecture](/concept/architecture) * [Transfer via URL](/user-guide/transfer-a-wallet-via-url) *** **Summary:** Mybucks.online is a digital cash envelope designed so wallet secrets stay in your browser. We do not operate a custodial backend or user account database. The Wallet App may call third-party blockchain APIs with your public address; the Landing Site may use analytics. You are responsible for credentials, shared links, and device security. # Disclaimers **Last updated:** June 2026 This page summarizes key warnings found across Mybucks.online documentation. It is not a substitute for the [Terms of Use](/more/terms-of-use). If anything here conflicts with the Terms, the Terms govern. #### General Mybucks.online is a **digital cash envelope** for the internet—a Web3 utility built on a **seedless, disposable wallet** framework. We do not provide investment, tax, or legal advice, and nothing on this site recommends buying, selling, or holding any cryptocurrency. The Service is provided "as is" and "as available", without warranties of any kind. The code is open-source under the [MIT License](/more/license). We do not guarantee uninterrupted operation, accuracy, or freedom from vulnerabilities. The Service is intended for micro-transactions and gifting—as a **digital cash envelope**, not a fortress wallet. It is not designed for long-term storage of high-value assets, dApp interaction, DeFi trading, or NFT marketplaces. You assume greater risk if you use it to hold large balances or primary wealth. #### Self-Custody You alone control your passphrase, PIN, and private keys. There is no account recovery. If you lose your credentials, access to the wallet and its funds is permanent. We do not store credentials and cannot reset them for you. Security depends on the strength of your passphrase and PIN. We recommend using the auto-fill feature for machine-generated credentials and avoiding reuse of passwords from email, banking, or exchanges. When signing in, select the correct wallet version (Legacy or Default). Legacy exists for backward compatibility but is deprecated; new wallets should use Default. See the [Security Notice](/user-guide/security-notice) and [Security Deep Dive](/concept/security-consideration/security-deep-dive) for more detail. #### Transfer via URL The Transfer via URL feature encodes your passphrase and PIN into a link so a recipient can open a wallet instantly. The credentials are Base64-encoded, not encrypted, and anyone with the full URL can recover them. Hash fragments (`#wallet=...`) are not sent to Mybucks.online servers, but may remain in browser history, device cache, or messaging apps. Use unique, temporary credentials for gift wallets. The first person to open the link may claim the funds. See [Transfer via URL](/user-guide/transfer-a-wallet-via-url). #### Risks Cryptocurrency transactions are generally irreversible. Prices are volatile, gas fees can be high, and supported networks may experience congestion, forks, or outages. The Wallet App runs in your browser, so malware, phishing sites, and compromised devices pose real risk. Verify you are on app.mybucks.online before entering credentials. The app may call third-party providers such as Infura, Moralis, and TronGrid, which can be unavailable or return incomplete data. Token balances shown in the app may be filtered using lists such as the Uniswap default token list. Not every token in your wallet may appear. #### Audits and Liability Mybucks.online has received third-party security review and community testing, as described in [Security Audits](/more/security-audits). Audits and challenges do not guarantee that the Service is free from future bugs or exploits. To the fullest extent permitted by law, Mybucks.online and its contributors are not liable for losses from your use of the Service, including lost credentials, intercepted links, user error, market volatility, third-party failures, or continued use of Legacy mode. The full limitation of liability is in [Terms of Use §5](https://docs.mybucks.online/more/pages/HNUvb8RsQVz6LZz5zy47#id-5.-limitation-of-liability). #### Other We may modify, suspend, or discontinue the public Service at any time. You may self-host the open-source code subject to the MIT License. p2p.gifts is a related site on a separate domain with its own [Terms of Use](/p2p.gifts/terms-of-use), [Privacy Policy](/p2p.gifts/privacy-policy) and FAQ disclaimer. See also the [Privacy Policy](/more/privacy-policy) and [Whitepaper](/more/whitepaper). You use Mybucks.online at your own risk. You are solely responsible for your credentials, shared links, and assets in each digital cash envelope you create. # About us We are Web3 and Blockchain enthusiasts dedicated to being in favor of decentralization. Join us and build together! Website: Wallet: Github: [https://github.com/mybucks-online](https://github.com/mybucks-online/app) Docs: [https://docs.mybucks.online](https://app.mybucks.online) Whitepaper: X: Farcaster: TG: Email: We strive for transparency and will share all information. However, you can contact us with your preferences or any feedback. # How it works **p2p.gifts** is a browser-only **P2P crypto gifting wizard**—gift crypto to anyone with no signup, no app install, and nothing stored on a server. Everything runs in your browser. ### The idea You create a temporary **digital cash envelope** (a one-time wallet), send funds to it, and share a branded gift card (with a QR code) to the person you're gifting. They scan the QR and claim the funds instantly. **p2p.gifts** is part of the [mybucks.online](https://mybucks.online) project and uses the same **digital cash envelope** (**seedless, disposable wallet** framework) and key-derivation technology, tailored for a simple gifting flow. ### Step by step #### 1. Create a gift wallet Click **Start Gifting** on the welcome screen. The wizard **auto-fills** a strong random passphrase and PIN. Together, these derive a one-time wallet address — no seed phrase, no private key file. You can edit either field or tap the **refresh** icon next to it to generate new random values (the new value is copied to your clipboard). **We encourage you to keep the auto-generated credentials** rather than typing your own — they are designed for one-time gift wallets and meet the app's strength checks. If you do customise them, they must still pass the strength meter before you can continue. > The passphrase and PIN exist only in your browser tab. If you close or refresh the page before saving the gift card, they are gone forever. #### 2. Fund the wallet Pick a network (Ethereum, Polygon, Arbitrum, Optimism, BNB Chain, Avalanche, or Base) and send crypto to the displayed address. You can scan the QR code or copy the address. **Tip:** Include a small amount of native tokens (ETH, MATIC, etc.) for gas fees when sending other tokens, so the receiver can claim without extra steps. #### 3. Design the gift card Choose a card style: * **Classic** — clean design with colour themes (Modern Blue, Elegant Purple, Festive Gold, Minimalist Dark, Crypto Gradient) * **Custom** — upload your own background image (PNG/JPG, up to 8 MB) or use a preset Add an optional gift note with Markdown formatting — bold, italic, headings, and line breaks all work. #### 4. Share Download the gift card as a PNG or copy the gifting link. Send it however you like — DM, email, print it out, or slip it into a greeting card. ### How the receiver claims The receiver scans the QR code on the gift card (or opens the gifting link). This takes them to [app.mybucks.online](https://app.mybucks.online), where they can access the wallet and transfer the funds to their own address — no signup, no app install. ### What's under the hood * Wallet keys are derived client-side from the passphrase + PIN using [mybucks.online](https://mybucks.online) core library * No backend, no database, no API keys — the app is a static site hosted on GitHub Pages * The gift card is rendered in-browser and exported as a PNG using `html-to-image` * The gifting link encodes a token (not the raw passphrase) that the claim app can decode ### Related * [Disclaimers](/p2p.gifts/disclaimers) * [Terms of Use](/p2p.gifts/terms-of-use) * [Privacy Policy](/p2p.gifts/privacy-policy) * [FAQ](/p2p.gifts/faq-and-safety) * [License](/p2p.gifts/license) * [Mybucks.online Terms of Use (claiming on app.mybucks.online)](/more/terms-of-use) # FAQ & Safety Common questions about using p2p.gifts — how gifting works, what's supported, and how to stay safe. ### Frequently asked questions
What is p2p.gifts? p2p.gifts is a browser-only **P2P crypto gifting wizard** built on the [mybucks.online](https://mybucks.online) **digital cash envelope** (seedless, disposable wallet) framework. You create a one-time wallet, fund it, and share a branded gift card with a QR code. The receiver scans and claims — no signup, no app install on either side.
Which networks are supported? Ethereum, Polygon, Arbitrum, Optimism, BNB Chain, Avalanche, Base, and Monad.
Can I send any token? You can send any native coin or ERC-20 token on the supported networks. When the receiver claims on [app.mybucks.online](https://app.mybucks.online), token balances are filtered based on the [Uniswap default token list](https://tokenlists.org) to prevent scam or fake tokens from appearing. Just make sure to include some native tokens for gas so the receiver can claim.
Should I use the auto-generated passphrase and PIN? **Yes — that is the recommended default.** When you open the create-wallet step, p2p.gifts auto-fills a random passphrase and PIN that meet strength requirements. Tap the refresh icon beside either field to generate a new random value. You *can* edit the credentials, but we **strongly encourage keeping the auto-generated values** (or refreshing until you are happy with them). Do not reuse passwords from email, banking, or your main crypto wallet. Gift wallets are one-time and unguarded — weak or memorable credentials are easier to guess. If you choose custom values, they must still pass the on-screen strength meter before you can create the wallet.
Does p2p.gifts store my passphrase or PIN? No. The passphrase and PIN exist only in your browser tab while the page is open. Nothing is sent to a server or saved in local storage.
What if I close the browser before saving the gift card? The passphrase and PIN are lost. There is no recovery. Always download the gift card or copy the gifting link before closing the page.
Can I reuse a gift wallet? Technically yes — if you kept the passphrase and PIN, you can access it again through [app.mybucks.online](https://app.mybucks.online). But gift wallets are designed to be disposable: create, fund, gift, done.
Is there a limit on how much I can send? No technical limit, but p2p.gifts is designed for **micro-gifts**. Do not fund gift wallets with large amounts.
Can I customise the gift card? Yes. You can choose from built-in themes, upload a custom background image, and add a gift note with Markdown formatting (bold, italic, headings, line breaks).
How does the receiver claim? They scan the QR code or open the gifting link, which takes them to [app.mybucks.online](https://app.mybucks.online). From there they can view the balance and transfer funds to their own wallet.
Is p2p.gifts open source? Yes — [github.com/mybucks-online/p2p.gifts](https://github.com/mybucks-online/p2p.gifts), [MIT licensed](/p2p.gifts/license).
### Safety guidelines 1. **Save before you close.** Download the gift card PNG or copy the gifting link before closing or refreshing the page. There is no undo. 2. **Use strong, random credentials.** Keep the auto-filled passphrase and PIN, or use the refresh control to generate new ones. Avoid personal passwords, short PINs, or easy-to-guess phrases — gift wallets are one-time and unguarded. 3. **Treat the gift card like cash.** Anyone who has the QR code or gifting link can access the wallet. Share it privately — DM, email, or in person. 4. **Keep amounts small.** This is built for micro-gifts, not large transfers. 5. **Include gas tokens.** When sending ERC-20 tokens, also send a small amount of native tokens (ETH, MATIC, BNB, etc.) so the receiver can pay transaction fees when claiming. 6. **Tell the receiver to claim promptly.** The wallet is unguarded — first person to scan the QR gets the funds. 7. **Don't post gift cards publicly.** Bots and strangers will sweep the wallet before your intended recipient sees it. # License **p2p.gifts** is open-source software licensed under the **MIT License**. Source code: [github.com/mybucks-online/p2p.gifts](https://github.com/mybucks-online/p2p.gifts) The **p2p.gifts** and **mybucks.online** names, logos, and branding are protected intellectual property. Gift card designs and default themes are provided for personal gifting use. ``` MIT License Copyright (c) 2026 p2p.gifts Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. ``` ### Related * [Terms of Use](/p2p.gifts/terms-of-use) * [FAQ](/p2p.gifts/faq-and-safety#frequently-asked-questions) * [Mybucks.online License](/more/license) # Terms of Use **Last updated:** June 2026 #### 1. Acceptance of Terms By accessing or using **p2p.gifts** at ("the Service", "we", "us", or "our"), you agree to these Terms of Use ("Terms"). If you do not agree, you must not use the Service. p2p.gifts is part of the [mybucks.online](https://mybucks.online) project. Claiming funds from a gifting link is handled by [app.mybucks.online](https://app.mybucks.online), which is governed by the [Mybucks.online Terms of Use](/more/terms-of-use). #### 2. Description of Service p2p.gifts is a browser-only **P2P crypto gifting wizard** built on the mybucks.online **digital cash envelope** (**seedless, disposable wallet** framework), tailored for a simple create → fund → share flow. The Service lets you: * Generate a one-time wallet from a passphrase and PIN (client-side only) * Choose a supported EVM network and fund the wallet address * Design a branded gift card (classic themes or custom background) * Download a PNG and/or copy a **gifting link** for the recipient Recipients claim funds on **app.mybucks.online** by scanning the QR code or opening the gifting link. p2p.gifts does not execute claims or hold user accounts. The Service is for **micro-gifting and onboarding**, not fortress-wallet daily use, dApp interaction, DeFi, or long-term storage of high-value assets. #### 3. Browser-Only Session — Save Before You Close During a gifting session, your passphrase, PIN, and derived wallet data exist **only in your open browser tab**. The Service does not send credentials to our servers and does not persist them in local storage. **IMPORTANT**: If you close or refresh the page before downloading the gift card or copying the gifting link, your credentials may be **lost permanently**. There is no recovery. You are solely responsible for saving the gift card image and/or gifting link before ending your session. **3.1 Credentials — use auto-generated values** When you start the create-wallet step, the Service **auto-fills** a random passphrase and PIN designed to meet strength requirements. You may edit these fields or use the **refresh** control beside each field to generate new random values. **We strongly encourage you to keep the auto-generated credentials** (or refresh until you are satisfied) rather than substituting personal passwords, short PINs, or memorable phrases. Gift wallets are **one-time and unguarded** — weak credentials are easier to guess or attack. If you choose custom credentials, they must still meet the on-screen strength requirements before you can continue. #### 4. Gift Cards and Gifting Links **4.1 Gift cards** Gift cards may include a QR code, optional gift note, and branding. Anyone who possesses the gift card image or QR code may be able to access the associated gifting link or wallet credentials. Do not post gift cards publicly unless you intend for anyone to claim the funds. **4.2 Gifting links** Gifting links encode wallet access for [app.mybucks.online](https://app.mybucks.online) using the [@mybucks.online/core](https://www.npmjs.com/package/@mybucks.online/core) token format. By creating or sharing a link, you acknowledge that: * Anyone with the link may be able to access the gift wallet * Links should be shared through private, trusted channels * You should use **strong, random, auto-generated** passphrase and PIN values (or refresh to new ones)—not passwords reused from email, banking, or your primary crypto wallet See Transfer via URL and p2p.gifts FAQ — Safety. **4.3 Custom content** If you upload a custom background image or enter a gift note, you represent that you have the right to use that content and that it does not violate applicable law or third-party rights. #### 5. Self-Custody and User Responsibility You acknowledge that: * You are solely responsible for your passphrase, PIN, and gift wallet * You should prefer **auto-generated** passphrase and PIN values over weak or reused personal passwords * We do not store, access, or recover credentials * You choose the network and assets you send to the gift address * You should include native tokens for gas when gifting ERC-20 tokens so the receiver can claim * Gift wallets are **unguarded**—the first person to use the link or QR may claim the funds There is **no account recovery**. Lost credentials mean permanent loss of access to the gift wallet. #### 6. Risks and Disclaimers A consolidated summary is in [p2p.gifts Disclaimers](/p2p.gifts/disclaimers). Project-wide warnings are in [Disclaimers](/more/disclaimers). You acknowledge: A summary of project-wide disclaimers is in Disclaimers. You acknowledge: * Cryptocurrency transactions are irreversible and prices are volatile * Blockchain networks may be congested or unavailable; fees vary * Browser-based tools carry device, malware, and phishing risks * Supported networks and features may change without notice THE SERVICE IS PROVIDED **"AS IS"** AND **"AS AVAILABLE"** WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED. #### 7. Limitation of Liability TO THE MAXIMUM EXTENT PERMITTED BY LAW, P2P.GIFTS, MYBUCKS.ONLINE, AND THEIR DEVELOPERS, CONTRIBUTORS, AND AFFILIATES SHALL NOT BE LIABLE FOR ANY LOSS OF CRYPTOCURRENCY OR OTHER DAMAGES ARISING FROM: * Closing the browser before saving the gift card or link * Sharing gift cards or links insecurely or publicly * Interception by third parties on messaging or social platforms * User error (wrong network, wrong address, insufficient gas) * Third-party hosting, analytics, or claim-app availability The Service is intended for **low-value micro-gifts** ("pocket money"). Use of large amounts is at your sole risk. #### 8. Prohibited Uses You agree not to use the Service for illegal activity, money laundering, terrorist financing, fraud, or any purpose that violates applicable law. You agree not to attempt to disrupt, scrape, or abuse the Service. #### 9. Intellectual Property The Service is open-source software under the [MIT License](/p2p.gifts/license). The **p2p.gifts** and **mybucks.online** names, logos, and branding are protected. Gift card designs and default themes are provided for personal gifting use. #### 10. Privacy Our privacy practices are described in the [p2p.gifts Privacy Policy](/p2p.gifts/privacy-policy). In summary: * No registration or personal information is required to use the wizard. * Passphrases, PINs, and private keys are **not** stored on our servers during gifting. * The Service may use **privacy-focused page analytics** (Umami) in production for aggregated visit counts only—not for in-session wallet activity or credentials. * Google Fonts may be loaded for typography. Claiming on app.mybucks.online is covered by the [Mybucks.online Privacy Policy](/more/privacy-policy). #### 11. Third-Party Services The Service may link to or depend on: * **app.mybucks.online** — claiming gifted funds * **Blockchain networks and explorers** — funding addresses * **GitHub Pages** — hosting * **Google Fonts** — typography We are not responsible for third-party availability, accuracy, or practices. Token display when claiming follows rules on the claim app (e.g. Uniswap default token list filtering). #### 12. Service Changes and Open Source We may modify, suspend, or discontinue p2p.gifts at any time. The source code is available on [GitHub](https://github.com/mybucks-online/p2p.gifts); you may self-host subject to the [MIT License](/p2p.gifts/license). #### 13. Governing Law, Contact, and Entire Agreement These Terms are governed by applicable law. Questions: . These Terms, together with the linked mybucks.online documents where referenced, constitute the agreement between you and us regarding **p2p.gifts**. They supersede prior understandings for this Service. #### 14. Acknowledgment BY USING P2P.GIFTS, YOU ACKNOWLEDGE THAT: * YOU HAVE READ AND AGREE TO THESE TERMS; * YOU WILL SAVE THE GIFT CARD OR LINK BEFORE CLOSING YOUR BROWSER; * YOU UNDERSTAND GIFT WALLETS ARE FOR MICRO-GIFTING AND ARE NOT A FORTRESS WALLET OR LONG-TERM VAULT; * YOU USE THE SERVICE AT YOUR OWN RISK. *** **IMPORTANT REMINDER**: p2p.gifts is a **P2P crypto gifting wizard**—create, fund, share, and move on. Save your gift card or link before closing the tab. Share privately. We cannot recover lost credentials. # Privacy Policy **Last updated:** June 2026 #### 1. Scope This Privacy Policy describes how **p2p.gifts** at ("the Service", "we", "us", or "our") handles information when you use the **P2P crypto gifting wizard**. p2p.gifts is part of the [mybucks.online](https://mybucks.online) project. It does **not** cover: * **mybucks.online**, **app.mybucks.online**, or **docs.mybucks.online** — see the Mybucks.online Privacy Policy * Claiming funds on **app.mybucks.online** after you follow a gifting link or QR code #### 2. Privacy by Design p2p.gifts is a browser-only **P2P crypto gifting wizard** built on the mybucks.online **digital cash envelope** (**seedless, disposable wallet** framework). It does not require registration, accounts, or email addresses. Passphrases, PINs, and private keys are **not stored on our servers** and are **not transmitted to p2p.gifts infrastructure** during normal use. Wallet keys are derived **entirely in your browser**. When you close or refresh the tab, session secrets are cleared from memory. We do not operate a backend database of gift wallets or credentials. #### 3. Information We Do Not Collect On p2p.gifts, we do **not**: * Require or store your name, email, phone number, or government ID * Store passphrase, PIN, private keys, or gift-card content on our servers * Log wallet credentials or key-generation inputs on p2p.gifts servers * Track in-wizard wallet activity for advertising There is no account system and no server-side user profile. #### 4. Information Processed in Your Browser While you use the wizard, the following stays on **your device** unless you choose to share it (for example, by sending a gift card or gifting link): * Passphrase and PIN inputs * Derived wallet address * Optional gift note text and custom background images you upload * Gift card preview and exported PNG (generated locally) You are responsible for protecting this information, including saved images, clipboard contents, and how you share gifting links. #### 5. Gifting Links and Gift Cards The Service generates **gifting links** that open [app.mybucks.online](https://app.mybucks.online) using a token produced by [@mybucks.online/core](https://www.npmjs.com/package/@mybucks.online/core). Link creation happens in your browser. * Gifting URLs are not sent to p2p.gifts servers when generated * Gift cards may embed QR codes that encode the claim destination * Anyone with the gift card image or link may access the gift wallet See p2p.gifts FAQ — Safety and Transfer via URL. #### 6. Analytics (Umami) In production, p2p.gifts may use [**Umami**](https://umami.is) for privacy-focused, aggregated page analytics (for example, page views and referral sources). This is intended for **site traffic only**, not for in-wizard credential or wallet activity. * Umami is loaded from `cloud.umami.is`; event data may be sent to `gateway.umami.is` * We do not use Google Analytics or advertising trackers on p2p.gifts * Analytics may be disabled in local or non-production builds when no website ID is configured Umami's practices are governed by its own policies. You can limit tracking through browser settings and applicable vendor opt-out tools. #### 7. Third-Party Services The Service may contact or link to: | Provider | Purpose | Data typically involved | | ------------------------ | ------------------------------------------------- | --------------------------------------------------------- | | **Umami** | Aggregated page analytics | Page URL, referrer, browser/device metadata (per Umami) | | **Google Fonts** | Typography | Standard font CDN requests | | **GitHub Pages** | Static hosting | Standard web server logs (IP, user agent, requested path) | | **app.mybucks.online** | Claiming gifted funds (when user follows link/QR) | Governed by Mybucks.online Privacy Policy | | **Blockchain explorers** | Links you open from fund step | Per explorer policies | p2p.gifts does **not** call RPC providers (Infura, Moralis, etc.) during the gifting wizard. Funding happens by you sending assets to the displayed address on-chain outside the app. We do not control third-party data practices. Review their policies if you have concerns. #### 8. Local Storage p2p.gifts may store **non-sensitive preferences** in your browser's local storage — for example, light/dark theme. This does **not** include passphrases, PINs, or private keys. #### 9. Hosting and Infrastructure The Service is a static site hosted on **GitHub Pages** (via GitHub Actions). Hosting providers may process standard access logs. Static hosting does not give us access to wallet secrets generated in your browser. #### 10. Open Source p2p.gifts is open-source software. Anyone may review, fork, or self-host it. If you use another operator's copy, their privacy practices may differ. #### 11. Security We use a **Content Security Policy** to restrict which third-party domains the wizard may contact. No method of transmission or storage is completely secure. You are responsible for your device, browser, and how you share gift cards and links. #### 12. Children The Service is not directed at children under 13 (or the minimum age in your jurisdiction). We do not knowingly collect personal information from children. #### 13. Your Rights Depending on where you live, you may have rights regarding personal information held by a data controller. Because we do not maintain user accounts or store credentials on our servers, we generally **cannot** identify or delete wallet data on your behalf — that data exists in your browser, in files you save, or on public blockchains. For analytics, you may use browser controls and Umami-related opt-out options where available. Questions: . #### 14. International Users The Service may be accessed from many countries. Third-party providers (hosting, analytics, fonts) may process data outside your jurisdiction. By using the Service, you understand such transfers may occur. #### 15. Changes to This Policy We may update this Privacy Policy from time to time. The "Last updated" date at the top will change when revisions are published. Continued use after updates constitutes acceptance where permitted by law. #### 16. Related Documents * [Terms of Use](/p2p.gifts/terms-of-use) * [FAQ](/p2p.gifts/faq-and-safety#frequently-asked-questions) * [License](/p2p.gifts/license) * [Mybucks.online Privacy Policy](/more/privacy-policy) * [Disclaimers](/p2p.gifts/disclaimers) *** **Summary:** p2p.gifts keeps gift-wallet secrets in your browser only. We do not run a custodial backend. Production may use Umami for aggregated page views—not for credentials. Claiming on app.mybucks.online is covered separately. # Disclaimers **Last updated:** June 2026 This page summarizes key warnings for **p2p.gifts**. It is not a substitute for the [p2p.gifts Terms of Use](/p2p.gifts/terms-of-use). If anything here conflicts with the Terms, the Terms govern. Project-wide context is in [Disclaimers](/more/disclaimers) (mybucks.online). Claiming funds uses [app.mybucks.online](https://app.mybucks.online), covered by [Mybucks.online Terms](/more/terms-of-use) and [Disclaimers](/more/disclaimers). #### General p2p.gifts is a browser-only **P2P crypto gifting wizard** built on the mybucks.online **digital cash envelope** (**seedless, disposable wallet** framework). It is not a fortress wallet like MetaMask, not for dApps or DeFi, and not for storing large amounts or long-term wealth. We do not provide investment, tax, or legal advice. The Service is provided "as is" without warranties. The code is open-source under the [MIT License](/p2p.gifts/license). #### Credentials The wizard **auto-fills** a random passphrase and PIN when you create a gift wallet. You can edit them or tap **refresh** for new random values. **Keep the auto-generated credentials** unless you have a specific reason not to — do not use personal passwords, short PINs, or guessable phrases. Custom values must pass the strength meter on screen. #### Save Before You Close Your passphrase, PIN, and gift wallet exist **only in your open browser tab** during a session. They are not saved on our servers. If you close or refresh the page before downloading the gift card PNG or copying the gifting link, credentials may be **lost permanently**. There is no recovery. Always save before you leave. #### Gift Cards and QR Codes A gift card is like **cash in an envelope**. Anyone with the image or QR code may access the gift wallet. Share privately—DM, email, or in person—not on public feeds where bots can sweep funds first. Custom backgrounds and gift notes are your responsibility. Only upload content you have the right to use. #### Gifting Links Gifting links open [app.mybucks.online](https://app.mybucks.online) for claiming. Anyone with the link may access the wallet. Use **strong, random, auto-generated** credentials for each gift—not passwords from email, banking, or your main wallet. The first person to scan or open the link may claim the funds. Tell the recipient to claim promptly. #### Funding and Networks You fund the gift address by sending assets on-chain yourself. p2p.gifts does not hold or move funds. Pick the correct network. When gifting ERC-20 tokens, include native tokens (ETH, MATIC, BNB, etc.) so the receiver can pay gas when claiming. Supported networks may change. See [p2p.gifts FAQ](/p2p.gifts/faq-and-safety). #### Risks Cryptocurrency transactions are irreversible. Prices are volatile. Browser-based tools carry phishing, malware, and device-compromise risk. Verify you are on **p2p.gifts** before creating a gift. #### Liability To the fullest extent permitted by law, p2p.gifts, mybucks.online, and their contributors are not liable for losses from closing the browser before saving, public sharing of gift cards, intercepted links, user error, or third-party outages. [Details: Terms §7](https://docs.mybucks.online/p2p.gifts/pages/XPMx8xYexbwkt6XYnpnB#id-7.-limitation-of-liability). #### Other Production may use Umami for aggregated page analytics only—not for credentials. We may change or discontinue the Service. You may self-host the [open-source code](https://github.com/mybucks-online/p2p.gifts) under the [MIT License](/p2p.gifts/license). See also Safety guidelines and [Privacy Policy](/p2p.gifts/privacy-policy). You use p2p.gifts at your own risk. You are solely responsible for saved gift cards, shared links, and funded amounts.