QSDM
Self-Custody · Browser-Generated

QSDM Wallet

Generate a quantum-secure (ML-DSA-87, NIST FIPS 204) wallet entirely inside this browser tab. The private key is created locally, encrypted with AES-256-GCM under a passphrase you choose, and offered as a downloadable JSON keystore. Nothing about the keypair touches the QSDM validators, this site's web server, or any third party. Compatible byte-for-byte with qsdmcli wallet.

QSDM audit score (live)
This wallet's trust surface is itself audited. ML-DSA-87 CSPRNG keygen, AES-256-GCM encryption, HMAC fallback entropy, JWT verification and mTLS are pinned by 5 rows in the cryptography category of the public audit checklist, all passing. The REST/JSON contract for the endpoints the wallet calls is pinned by 6 rows under api. See audit.html?category=cryptography for the live view.

Read this before clicking anything

1) The QSDM wallet is the only thing standing between you and your coins. If you lose the JSON keystore file or forget the passphrase, the address is permanently unrecoverable — no support team, no reset email, no validator override. Back up the file. Pick a passphrase you will not forget.

2) Verify you are on qsdm.tech (look at the address bar) before generating. A phishing clone of this page could replace the WASM binary and exfiltrate the private key the moment it's generated. Even with HTTPS, treat the wallet page like a hardware-wallet recovery screen.

3) The same keystore format is produced by the offline CLI: qsdmcli wallet new. If you'd rather not trust a webpage, use the CLI on a machine you control — the keystore opens here either way.

Game account linking (Sky Fang)

Sky Fang is the play-to-earn MMORPG experience. The earn-only CELL path is the wallet-link flow: players link their Sky Fang account to QSDM Hive so CELL eligibility can be proven without selling combat power.

The normal player flow uses QSDM Hive, not manual public-key or signature copy-paste. Sky Fang opens qsdm-hive://skyfang-link; Hive shows the exact challenge, signs it locally with your QSDM ML-DSA-87 wallet, and returns the proof to Sky Fang. Your private key never leaves Hive.

Download QSDM Hive Open Sky Fang QSDM page

The Advanced → Sign message tab below is kept for developer and emergency diagnostics. It is not the recommended Sky Fang player flow.

Advanced (legacy tab UI)

The original five tabs. Useful for: generating a keystore without storing it in this browser, signing an arbitrary message, inspecting a third-party keystore, or doing an address-only balance lookup. The persistent wallet panel above reuses the same cryptographic primitives.

Generate a fresh wallet

Choose a strong passphrase (12+ characters, mix of types). The wallet page never sees the passphrase in network traffic: it is fed to PBKDF2-HMAC-SHA-256 (600 000 iterations) inside this browser tab, the derived key encrypts the private key under AES-256-GCM, and the resulting JSON keystore is yours to download.

Waiting for WASM module…

Open an existing keystore

Drop in a wallet.json file (produced here, or by qsdmcli wallet new). The browser will decrypt it locally to confirm the passphrase is correct and the file isn't tampered with. Nothing is uploaded.

Sign a message

Decrypt the keystore and produce a ML-DSA-87 signature over an arbitrary message. The decrypted private key is held only inside the WASM call; the browser zeros the JS reference as soon as the signature is returned.

Check an address balance

Unlike the other three tabs, this one talks to the network. It sends a single GET https://api.qsdm.tech/api/v1/wallet/balance?address=<addr> and renders the response. An address is public information — it's already on chain — so the request leaks no private material, but it does correlate this browser with this address at the validator's HTTP log layer. If you want to avoid that correlation, ask a friend's node, run your own validator, or skip this tab entirely.

Address goes in → balance comes back.

Send a transaction (self-custody)

This is the only tab that spends from your wallet. Decrypt your keystore with the passphrase, fill in the recipient and amount, click Send. The transaction is built and signed inside this browser tab with your ML-DSA-87 private key — the private key never leaves the tab — and only the already-signed envelope is POSTed to api.qsdm.tech/api/v1/wallet/submit-signed. The validator verifies the signature against the embedded public key and enforces sender == hex(sha256(public_key)), so the validator can never spend on your behalf.

v0.4.1 replay protection: every send carries a per-account nonce that the validator atomically bumps inside the same transaction as the balance debit. Replays (same envelope, same nonce, twice) return HTTP 409 nonce_replay rather than double-spending. The Nonce field below auto-resolves from the validator before sign-time; you can override it manually for off-line ceremonies.

Recipient + amount + passphrase → signed envelope → validator POST.

How this works

Or do it from the CLI

Identical keystore format, but offline. Useful for cold-storage flows where you don't want even a static webpage in the trust chain. Consumers should import the keystore into QSDM Hive and run eligible tasks there. Advanced operators can use qsdmminer-console --protocol=v2 against the live NVIDIA-locked mainnet; no separate consumer GUI miner is shipped, and the legacy CPU qsdmminer binary is no longer a public release artefact (mainnet rejects its v1 proofs at consensus — see MINER_QUICKSTART). 

# Build once
git clone https://github.com/blackbeardONE/QSDM
cd QSDM/QSDM/source
go build -o qsdmcli         ./cmd/qsdmcli
go build -o qsdmminer-console ./cmd/qsdmminer-console

# Wallet: generate (passphrase prompted, address printed to stdout)
./qsdmcli wallet new --out ~/.qsdm/wallet.json
ADDR=$(./qsdmcli wallet show | awk '/^address/{print $2}')

# Mining (v2): generate the HMAC key, enroll on-chain (10 CELL bond),
# then start the live miner against the mainnet validator.
./qsdmminer-console --gen-hmac-key=$HOME/.qsdm/hmac.key
./qsdmcli enroll --sender=$ADDR \
            --node-id=rig-77 \
            --gpu-uuid=$(nvidia-smi --query-gpu=uuid --format=csv,noheader | head -1) \
            --hmac-key=$(cat $HOME/.qsdm/hmac.key) \
            --nonce=<your-account-nonce>
./qsdmminer-console --protocol=v2 \
            --validator=https://api.qsdm.tech \
            --address=$ADDR \
            --hmac-key-path=$HOME/.qsdm/hmac.key \
            --node-id=rig-77 \
            --gpu-uuid=$(nvidia-smi --query-gpu=uuid --format=csv,noheader | head -1) \
            --gpu-arch=ada