Mobile and the Ghostdex wallet
Ghostdex runs on a phone as an app: from the home screen on iPhone, or installed on Android. Phones have no wallet extension, so the site carries its own self-custody wallet, the Ghostdex wallet. It lives on your device and signs only after you confirm.
Install it
- 1iPhone
Open ghosdex.app in Safari, tap the Share button, then Add to Home Screen. Ghostdex opens full screen from the home screen.
- 2Android
Open ghosdex.app in Chrome and choose Install app from the menu. Ghostdex opens from the home screen or the app drawer.
- 3Create or import a wallet
On the Wallet tab, create a new wallet or import a recovery phrase or a private key, then choose a passcode.
Ghostdex is not on the App Store or Google Play. Install it only from ghosdex.app.
How the wallet keeps your key
A new wallet is a standard 12-word recovery phrase (BIP-39), the same kind other wallets use, so you can import it elsewhere later. Ghostdex shows it once and asks you to type two of the words back, to be sure your copy is right.
- The phrase, or an imported private key, is encrypted in the browser with AES-GCM-256. The key comes from your passcode through PBKDF2-SHA256 with 600,000 iterations and a random salt.
- Only the encrypted copy and the public address are stored, under
ghostdex:vaultin this device's storage. Nothing is sent to Ghostdex or to anyone else. - When you unlock, the decrypted key lives in memory only. The wallet locks itself after 15 minutes without a tap, or after the app has been in the background for 5 minutes. You can lock it at any time.
- Showing the phrase again, or removing the wallet from your device, asks for the passcode every time.
The Ghostdex wallet and your ghosts
The Ghostdex wallet can own ghosts like any other wallet. It signs deterministically, so the same recovery phrase opens the same ghosts on any device. Ghost keys are never stored with the encrypted wallet: only the root they come from is kept, in the session storage of the tab that opened them, until that tab closes.
What you confirm
Every transaction and every signature, from the Ghostdex wallet or from a ghost, opens a sheet before anything is signed. It shows the network, the contract with its name when Ghostdex knows it (Universal Router, Permit2, LI.FI, Morpho, Doppler, USDG, a stock token), what the call does, the amount, and the most it can cost in gas. If the chain expects the transaction to fail, the sheet says why and Confirm stays off. Reject returns you to the order with nothing sent.
The one exception is an agent on autopilot: its own ghost signs the orders your rules allow without a sheet. Every other address still asks. See Agents.
Risks
Ghostdex cannot see or recover your recovery phrase. Anyone who has it can take everything in the wallet, and open every ghost it owns. If you lose both the phrase and the passcode, or the phrase and your device, the funds cannot be recovered by anyone.
- A wallet in a browser is as safe as your device: keep it updated, locked, and free of apps you do not trust.
- Clearing this site's data, or uninstalling the app, erases the encrypted wallet from your device. The funds stay on the chain; the phrase brings them back.
- A short passcode is easier to guess if someone copies your device's storage. Use one you do not use elsewhere.
- For large amounts, a hardware wallet connected to Ghostdex on a computer keeps the main key off the internet. Ghost keys are always derived and used in the browser, whatever wallet owns them.