Security

Nobody from Plaxswap will ask for your recovery phrase or your wallet PIN. Anyone who has them can take your coins, so anyone asking is trying to. Our website is plaxswap.com. plaxswap.io is a separate project that we don't run, so check the address before you connect a wallet.

Your recovery phrase stays in your browser, encrypted with AES-256-GCM. The encryption key comes from your PIN through PBKDF2 with 600,000 rounds, and the encrypted copy never goes to our servers. That also means we can't recover the phrase for you.

A browser protects a PIN less than a phone can. A 6-digit PIN has one million combinations, and someone who copied your whole browser profile could try them all offline. Use the wallet only on a device you trust. The wallet page lists the safety limits you can turn on.

• Your paying, receiving and refund addresses are checked against the US sanctions (OFAC) list before a route is built. A match stops the swap.
• When you connect a wallet, you approve each swap in that wallet.
• What you send on a network can't be reversed by us, so check the address and the network first.

• You sign in with Google or Telegram.
• With 2-step approval on, withdrawals and account changes ask for a fresh 6-digit code.
• An emergency lock freezes all withdrawals and swaps at once and signs every device out. Only Plaxswap support can unlock it, after checking it is really you.

• Every page is served over HTTPS, and a content security policy limits which scripts can run.
• Google Analytics runs only on public pages and only if you allow it. It doesn't run on wallet, order, payment, account or admin pages. You can change your choice on the privacy page.
• Reserves compares the coins we hold with the order payouts waiting to go out.

Email support@plaxswap.com with the steps to reproduce it, and please don't test against other people's accounts or funds. Our security.txt has the same contact.