Security

We will never ask for

• Your recovery (seed) phrase
• Your private keys
• A wallet connection or a transaction signature
• Payment to “unlock” or “recover” tokens

We don't send direct messages on social media or chat apps. If someone claiming to be Holder's Watch asks for any of the above, it is a scam. Tell us at security@holderswatch.com.

Why a public address is safe to share

A public address is designed to be shared: anyone can already look up its balance on a block explorer. Adding it to Holder's Watch lets us read that same public data. It gives no one the ability to move your tokens.

Linking an address to your email address does make it personal information, so we treat it that way. See our privacy policy.

How we protect your account

• Passwords are stored only as a salted, memory-hard hash (scrypt). We can't read your password.
• Breached passwords are refused. When you set a password we check it against known data breaches. Only the first five characters of a hash of it leave our servers, so the password itself is never shared.
• Sessions use a secure, HTTP-only cookie that page scripts can't read. Changing or resetting your password signs out every other session, and you can sign out everywhere from settings.
• Sign-in attempts are rate-limited per account and per network, to slow down password guessing.
• Password reset and email confirmation links are single-use and expire, after one hour and 24 hours respectively.
• Our responses don't reveal who has an account. Sign-up and password reset respond the same way whether or not an address is registered.

Reporting a vulnerability

If you think you've found a security issue, email security@holderswatch.com with the details. Please give us a reasonable chance to fix it before telling anyone else.