No stick,
no signature.
A browser wallet that will not sign until your paired USB drive is in the port. Pull the stick and signing latches shut, with every balance still on screen.
- 01Inserthasp.key readable
- 02Padlockvault opens in memory
- 03Reviewchecks, then your call
- 04Signone signature, broadcast
- 05Pullsigner wiped in 1.5 s
01Mechanism
Two halves, one key.
The vault that wraps your recovery phrase is sealed with a key no single thing can produce. Your password is stretched into one half. A 32-byte secret written on your USB drive is the other. Only when both are present in the same tab can the vault open, and only an open vault can sign.
That is the whole trick. There is no custom hardware, no firmware, no driver. A plain flash drive becomes the hasp of the lock, and the padlock lives in your head.
| Password stretch | PBKDF2-SHA256 · 600,000 rounds |
|---|---|
| USB share | 32 random bytes · KEYHASP/hasp.key |
| Key derivation | HKDF-SHA256 over both halves |
| Vault cipher | AES-256-GCM · 96-bit nonce |
| Accounts | BIP-39 phrase · secp256k1 · m/44'/60'/0'/0/i |
| Where it runs | WebCrypto in your tab · nothing leaves it |
02Habit
A habit, not a ritual.
Five motions. They take about eight seconds and they happen the same way every time, which is the point: the one day a page tries to make you sign something strange, your hand already knows the pause.
hasp.key readable03Review desk
Every transaction stops at the desk.
Before anything is signed, KEYHASP lays the transaction out flat: who is sending, on which network, to whom, how much, and what the fee will likely be. Then it runs its checks and tells you what it found. The checks surface problems; the decision stays yours.
- Burn and null addressesblock
- Recipients you have never paidflag
- Recipient is a contractflag
- Unlimited token approvalsflag
- The node answers with the chain ID you expectedverify
- Not enough native balance for gasblock
- Address format—
- Burn / null address—
- Contract at address—
- Paid before?—
- Node reports chain—
Live against a public Ethereum node from your browser. Nothing is signed here.
04Networks
One vault, eleven networks.
Same accounts, same addresses, every network below. Switch at the top of the app; balances, Receive and the Review desk follow.
05Trust
Where it sits.
A browser extension signs the moment you click. A hardware wallet signs inside a sealed chip. KEYHASP sits between them: software you can read, gated by an object you can pull.
Browser extension
- Keys
- Encrypted in the browser profile
- Gate
- Password only
- Unplug to stop
- No
- Install
- Extension
- Cost
- Free
KEYHASP
- Keys
- Vault in your tab, openable only with password + USB share
- Gate
- Password and a physical stick
- Unplug to stop
- Yes — signer wiped within 1.5 s
- Install
- None
- Cost
- Free
Hardware wallet
- Keys
- Sealed secure element
- Gate
- PIN + button on the device
- Unplug to stop
- Yes
- Install
- Device + companion app
- Cost
- $60–$250
Enforced by code
- The vault key is derived from both halves; neither half is ever written to disk in usable form.
- Signing is impossible while
hasp.keyis unreadable — there is no signer object to call. - Every send passes the Review desk; the checks cannot be skipped by a page.
- The node's chain ID is read and compared before the fee is estimated.
- No request ever carries your phrase, password or share — there is no KEYHASP server to carry it to.
Still requires trust
- Your computer. A compromised machine can read what an open vault holds while it is open.
- The public RPC nodes that answer balance and fee queries, and the price feed used for USD figures.
- Your recovery phrase. It rebuilds everything, including a wallet whose stick was lost — guard it like the keys themselves.
- Your browser's File System Access support. Without it, the stick is read manually and auto-latching is off.
06Token
$HASP
The token is the project's public stake. It launches on a public launchpad at 14:00 UTC on 29 October 2026, and the contract address is posted on this page first, then on X. Holding it is never required to use the wallet, and the wallet never asks for it.
- No presale, no allowlist — the address you see here is the only one.
- Buy and Chart buttons activate the moment the contract is live.
- Verify the address against this page before trading; copies on other sites are not ours.
07Questions
Plain answers.
- Is this a hardware wallet?
- No. It is software that runs in your browser. The USB drive stores a secret share, not a chip that signs. The signing happens in your tab, and only while the share can be read.
- Are my coins on the USB?
- No. Coins live on their blockchains. The stick holds 32 bytes that, together with your password, open the vault. Nothing on it is useful alone.
- What if I lose the stick?
- Pair a fresh drive, pick a new password, and restore from your recovery phrase — the accounts come back exactly as they were. The stick is the daily gate; the phrase is the way back in.
- Can a website make me sign?
- Not while the stick is out. With the stick in and the vault open, every request still stops at the Review desk, where you read it and decide.
- Which browsers?
- Chrome, Edge, Brave and other Chromium browsers get the full experience, including auto-latching when the stick is pulled. Firefox and Safari work in manual mode: you pick the file on the stick each time you unlatch.
- Does the token do anything inside the wallet?
- No. $HASP is the project's public stake, not a key, a fee or a feature. The wallet is free and stays free.
No stick,
no signature.
Pair a drive you already own. Open the app. Keep the habit.