Quantus mainnet · Security desk · 100% client-side
The address book with a built-in poisoning alarm
Every contact you save gets a human checkphrase — five words derived from the address by the real upstream Quantus algorithm. Paste an address anywhere and this desk instantly tells you whether it matches someone you trust. One swapped character screams through the words long before your eyes catch it. Nothing here moves funds; your vault never leaves this browser.
📇Add contact
The address is checksum-validated (SS58, prefix 189) and its checkphrase is derived with the upstream algorithm before anything is stored.
Only well-formed Quantus mainnet addresses are accepted. A valid checksum does not prove who owns the address — it proves the string wasn't corrupted.
🗄Your vault
🔍Verify on paste
Paste any address — from a chat, an invoice, your clipboard — and this desk derives its checkphrase and checks it against your vault. If it matches a saved contact, you get a name. If it doesn't, you get the words to read back.
🗣Spoken checkphrase
On a call and they read you five words? Type the words below and the address they claim to belong to. The desk compares them word-by-word — no trust in your ears required.
Separate the words with spaces or hyphens — order matters, case doesn't.
🎓How address poisoning works
1 · Dust from a doppelgänger
On account-based chains like Quantus, anyone can send a tiny transaction from any address they control. An attacker grinds a keypair until the address shares the first and last few characters with yours, then sends your wallet dust. Their lookalike now sits in your transaction history — and when you next copy "your" address from history instead of your vault, you copy theirs.
2 · Clipboard hijackers
Malware watches the clipboard for anything shaped like an address and silently swaps in the attacker's lookalike between your copy and your paste. You pasted qz… — but is it the qz… you copied?
3 · Why five words beat two eyes
Humans check the start and end of an address and skim the middle — exactly the parts an attacker keeps identical. A checkphrase is different: it is a 55-bit checksum, so any change anywhere in the address avalanches into completely different words. There are 255 — about 36 quadrillion — possible five-word combinations.
"Each of the words has 2048 (2^11) choices so if we choose 5 words, we have a total set of 2^55 ~ 36 quadrillion possible combinations… With PBKDF2 (40,000 iterations)… a rainbow table would take 2^55 * 14ms ≈ 16 million years. A high-end GPU… Even then: 2^55 * 1.4ms ≈ 1.6 million years per GPU. With a cluster of 1,000 GPUs working in parallel: ~1,600 years." — Quantus-Network/qp-human-checkphrase README, Security Analysis (quoted verbatim)
Be honest with yourself: attackers can grind similar-looking prefixes — grinding is cheap for a few characters. That is exactly why you verify words, not prefixes. A matching prefix proves nothing; matching words prove the exact address.
🧪Poisoning simulator
Pick a saved contact. The desk grinds real, valid Quantus addresses (fresh random keys, encoded locally — nothing leaves this page) that share the contact's visible prefix, exactly like an attacker's doppelgänger. Watch how identical they look — and how the checkphrases refuse to match.
⚡One-character avalanche
The smallest possible tamper: a single character in the middle of the address is changed. The checksum still validates as a string — but all five words change.
📋Batch verify
One address per line — an airdrop list, a payout sheet, a CSV column. Each row gets checksum validation, its checkphrase, and a verdict against your vault.
| # | Address | Checksum | Checkphrase | Verdict |
|---|
📤Export
Take your vault with you. Plain JSON for convenience, or a password-encrypted backup (PBKDF2-SHA256, 200,000 iterations → AES-GCM-256) for anything that leaves this machine.
Encrypted backup
Lose the password and the encrypted backup is unrecoverable — by design. Pick something a password manager remembers for you.
📥Import
Paste a backup below. Every address is re-validated (checksum + prefix 189) and every stored checkphrase is recomputed and compared before anything enters your vault. Duplicates are skipped.
Danger zone
Wipe every contact from this browser. Export first if you want them back.
📜Honest scope
What this desk can and cannot do for you — no fine print anywhere else.
- DOES — detect swapped or mistyped addressesA checkphrase is a checksum rendered as words. If the address you pasted isn't byte-identical to the one you saved, the words change. That is the whole alarm.
- DOES NOT — prove who owns an addressA checkphrase is public: anyone can compute the five words for any address — that is the point. Matching words prove the address is the one you saved, not that the label you gave it is true. Verify ownership out-of-band.
- DOES — keep your vault on this machineContacts live in this browser's localStorage. No account, no sync, no server ever sees them. Clear site data and the vault is gone — keep an encrypted backup.
- DOES NOT — secure your keysThis tool never asks for, sees, or touches private keys or seed phrases. If any page claiming to be this desk asks for them, it is a scam.
- DOES NOT — make you invincibleMalware that can read your screen can read the words too. The desk raises the cost of fooling you enormously; pair it with a clean machine and out-of-band confirmation for large transfers.