Is the Arqma web wallet safe?
Short answer: safe enough for small amounts, not safe enough for savings. Here’s exactly why, and what to do instead for larger balances.
What the web wallet is
A browser-based version of Arqma Wallet served from a URL. There’s nothing to install — you open the page, the wallet code loads, and you can create or restore a wallet that runs entirely inside the browser tab. Your keys stay on your device (still non-custodial); the wallet’s code is what travels.
Why it’s convenient
- Works on any computer with a modern browser.
- No install, no admin rights needed.
- Great for quickly checking a balance or making a small payment on a borrowed machine.
Why it’s inherently less safe
The web wallet inherits every weakness of the browser environment:
- Code is delivered fresh every time you load the page. A desktop install pins the binary you audited (via SHA-256). A web app can change between visits — usually for legitimate reasons, but you have no way to verify the bundle you just received.
- Browser extensions can read your page. A malicious extension installed for unrelated reasons (a coupon helper, a screenshot tool) can in theory observe what’s in the wallet tab.
- Phishing is easier. A URL bar is harder to recognise than an icon on your desktop. Look-alike domains (arqrna.com, arqma-wallet.app, etc.) are an evergreen attack surface.
- Local storage is more exposed. If you tick “remember this wallet,” the wallet persists in browser storage that’s accessible to anyone with the device.
Right use cases
- A small spending balance you can afford to lose.
- Receiving a one-off payment that you’ll move to a desktop wallet right after.
- Looking up a balance on a borrowed computer (don’t restore a serious wallet — use view-only or scan a fresh address).
What NOT to do
- Don’t restore a wallet that holds significant funds into the web wallet. Use the desktop or mobile install instead.
- Don’t use the web wallet on a public computer. Cached pages, autofill, and shoulder-surfing all conspire against you.
- Don’t paste your seed phrase into anything that looks like “a recovery tool” the web wallet didn’t generate itself.
- Don’t bookmark a search result. Type the URL or use the link on our download page.
If you do use it: best practices
- Always navigate from our /download page or type the URL by hand. Don’t click web wallet links from chat apps.
- Use a dedicated browser profile with no other extensions installed.
- Never tick “remember on this device” on a computer you don’t own.
- Treat the web wallet as throwaway: keep its balance low and don’t leave more than a few transactions’ worth in it.
Safer alternatives
- Mobile wallet — install once, runs as a native app, much smaller attack surface than a browser tab. See mobile setup.
- Desktop GUI — best for any non-trivial balance. See Windows, macOS, or Linux install guides.
The cost of not owning a non-custodial alternative
Web wallets are convenient but they live in someone else's tab. For anything beyond walking-around money, install the desktop or mobile build — same seed, same coins, no browser surface.
- $2.2Bstolen from crypto services and custodial wallets in 2024 alone (Chainalysis). Almost none of it was held in self-custodial wallets like Arqma.
- #1cause of consumer crypto losses, year after year, is a fake wallet or cloned download page — not a protocol exploit. The official build is the fix.
- 25words is all you need to restore an Arqma Wallet on any device, in under five minutes. No support ticket, no waiting on a custodian to respond.
- $5.6Breported lost to crypto investment fraud in the US in 2023 (FBI IC3). Nearly all of it sat in third-party accounts the victim didn’t actually control.
Download Arqma Wallet
Free, open source, non-custodial. Your keys, your coins, your privacy — on Windows, macOS, Linux, Android and iOS. Install in two minutes.
Always download from the official page. Verified builds, signed releases, open-source code.