Mobile and the Kabudex wallet
Kabudex runs on a phone as an app: an APK on Android, or a home-screen app from Safari on iPhone. Because phones have no wallet extension, it carries its own self-custody wallet, the Kabudex wallet, which lives on the phone and signs only after you confirm.
Install it
- 1Android
Open kabudex.app/app/download on the phone and download the APK. Android asks to allow installs from your browser the first time; allow it, then tap Install. The page lists the version and the SHA-256 of the file if you want to check it.
- 2iPhone
Open kabudex.app in Safari, tap the Share button, then Add to Home Screen. Kabudex opens full screen from the home screen, like any app.
- 3Create or import a wallet
On the Wallet tab, create a new wallet or import a recovery phrase or a private key, then choose a passcode.
Kabudex is not on the App Store or Google Play. Install it only from kabudex.app.
How the wallet keeps your key
A new wallet is a standard 12-word recovery phrase (BIP-39), the same kind other wallets use, so you can import it elsewhere later. Kabudex shows it once and asks you to type two of the words back, to be sure your copy is right.
- The phrase, or an imported private key, is encrypted in the browser with AES-GCM-256. The key comes from your passcode through PBKDF2-SHA256 with 600,000 iterations and a random salt.
- Only the encrypted copy and the public address are stored, under
kabudex:vaultin this device's storage. Nothing is sent to Kabudex or to anyone else. - When you unlock, the decrypted key lives in memory only. The wallet locks itself after 15 minutes without a tap, or after the app has been in the background for 5 minutes. You can lock it at any time.
- Showing the phrase again, or removing the wallet from the phone, asks for the passcode every time.
What you confirm
Every transaction and every signature opens a sheet before anything is signed. It shows the network, the contract with its name when Kabudex knows it (Universal Router, Permit2, LI.FI, Morpho, Doppler, USDG, a stock token), what the call does, the amount, and the most it can cost in gas. If the chain expects the transaction to fail, the sheet says why and Confirm stays off. Reject returns you to the order with nothing sent.
Risks
Kabudex cannot see or recover your recovery phrase. Anyone who has it can take everything in the wallet. If you lose both the phrase and the passcode, or the phrase and the phone, the funds cannot be recovered by anyone.
- A wallet in a browser is as safe as the phone: keep the phone updated, locked, and free of apps you do not trust.
- Clearing this site's data, or uninstalling the app, erases the encrypted wallet from the phone. The funds stay on the chain; the phrase brings them back.
- A short passcode is easier to guess if someone copies the phone's storage. Use one you do not use elsewhere.
- For large amounts, a hardware wallet connected to Kabudex on a computer keeps the key off the internet entirely.