Email/password account, optional TOTP 2FA, local browser-encrypted QRX24 vault, balance lookup, and 2FA-gated transfer intent. QRX24 phrase encryption happens in the browser via WebCrypto and is not sent to the server.
Logged in: none
Secret:
This no-third-party build does not call an external QR API with your TOTP secret. Manual secret/otpauth URI is provided until a reviewed local QR encoder is vendored.
Balance lookup only requires password login.
Transfer requires a valid logged-in session and 2FA if enabled. This creates a 2FA-approved transfer intent; final on-chain signed broadcast still requires the production ML-DSA signing backend.