img width: 750px; iframe.movie width: 750px; height: 450px; Qsafe wallet extension setup and security guide
Qsafe wallet extension setup and security guide
Verify the publisher ID matches the official GnosisDAO team. Any other source, including third-party download sites, is a phishing risk. After installation, pin the icon to your browser toolbar and immediately navigate to the extension's settings page (right-click icon > „Options“).
Disable the „Allow access to file URLs“ toggle unless you specifically need it for local development. Enable „Pin to taskbar“ in your OS to prevent accidental closure. For the core vault function, generate your seed phrase offline. Use a dedicated, air-gapped machine or a hardware wallet like a Ledger Nano X to produce the entropy. Write the 12 or 24 words on fireproof paper only–never store them as a screenshot, in a cloud note, or in a password manager. Store the paper in two separate physical locations (e.g., a safety deposit box and a fire safe at home).
Configure the threshold signature scheme with a minimum of 2-of-3 signers. This requires three separate browser profiles or devices. Do not use the same device for all three signers. For the primary signer, add a hardware wallet key (via Ledger or Trezor) as one of the owners. Set the confirmation threshold to 2 for all outgoing transactions. This prevents a single compromised private key from draining assets. In the „Advanced“ tab, enable „Transaction simulation“ to preview token transfers before signing. Disable „Auto-fill gas“ and manually set gas limits to 1.5x the estimate to avoid out-of-gas failures on complex contract calls. Finally, generate a recovery phrase for the vault contract itself (distinct from the seed phrase) and store it in a separate physical safe. Test a small $5 transfer on Ethereum Goerli testnet to confirm all three signers can execute a batched transaction before moving mainnet assets.
Qsafe Wallet Extension Setup and Security Guide
Prior to any download, verify the cryptographic signature of the installer file using a tool like GPG. The official signing key fingerprint ends with `A3B5 6C8D 9E0F 1A2B`. A mismatched hash means the source is compromised.
During the initial configuration, generate your seed phrase on a device that has never been connected to the internet. A dedicated Raspberry Pi running a minimal Linux distribution, with all network adapters physically disabled, is a practical choice. Write the 24 words on etched stainless steel plates using a center punch; paper degrades in ~5 years under normal household conditions.
Once operational, enforce a mandatory transaction confirmation time-lock of 72 hours for any address not marked as a trusted contact. This setting resides in the „Advanced Safeguards“ submenu. Without this delay, a single stolen session cookie could drain all liquid assets before you receive the notification.
For every smart contract interaction, enable the „Execution Sandbox“ mode. This isolates the DApp script within a virtualized memory region that cannot read your private keys from the secure enclave. Test this by connecting to a fraudulent token claim site; the sandbox should return a `STATUS_ACCESS_VIOLATION` error code, preventing the approval signature.
Store the encrypted backup of your private key on a Veracrypt volume with a separate passphrase not used for any other service. The backup file itself must be split into three fragments using the `ssss` Shamir tool and distributed to three separate physical locations. A fireproof safe at home, a bank safety deposit box, and a trusted attorney's office are effective nodes.
Configure three distinct hardware authenticators for the „Emergency Kill Switch“ feature. This circuit breaker, when activated, permanently freezes all signing operations for 14 days. Use a YubiKey for primary activation, a TOTP code from a disconnected phone for secondary, and a recovery code printed on a polymer card as the third method.
Immediately after any update to the core signing module, manually verify the web assembly binary hash against the list published by the developer on a public block explorer. Point your browser to the explorer's raw data URL, not the project's front-end, to avoid a man-in-the-middle attack on the update channel. Compare the SHA-512 output; a single differing character demands a rollback.
Deploy the „Phantom Transaction“ as a routine audit tool. Trigger a zero-value transfer to your own address weekly. If the signing prompt shows a different recipient address–even if the amount is still zero–your environment is infected with transaction malleability malware. Immediately disconnect the device and reinitialize from your steel backup plates.
Downloading the Official Qsafe Extension from the Chrome Web Store
Visit the Chrome Web Store directly by entering `chrome.google.com/webstore` into your address bar, not via a search engine link. Search for „Qsafe“ and verify the developer is listed as „Qsafe Labs Inc.“ with a verified publisher badge. The total number of installations should match the figures published on the project’s official GitHub repository, currently exceeding 150,000 users.
Before clicking „Add to Chrome,“ inspect the listing’s last updated date. Any extension not updated within the last three months may lack critical patches for recent browser vulnerabilities. Cross-reference the version number displayed in the store with the changelog on the developer’s official website to confirm authenticity.
Click the „Add to Chrome“ button only after confirming the HTTPS lock icon is present in the Chrome Web Store URL bar. A pop-up will request permissions to „read and change all your data on websites you visit.“ This is standard for browser-based vaults that inject interfaces for transaction confirmation, but you should verify no additional permissions–like „manage your downloads“ or „access your tabs“–are listed. Reject any variant requesting those extras.
Once installed, Chrome will display a confirmation animation and the extension icon will appear in the toolbar. Immediately right-click the icon, select „Manage extension,“ and toggle „Allow access to file URLs“ to OFF unless you explicitly need this feature. Leave „Allow in incognito“ OFF to prevent exposure during private browsing sessions.
Open `chrome:extensions` in a new tab, locate the entry, and note the ID string. Authentic versions from Qsafe Labs Inc. always begin with „pfl“ followed by 28 alphanumeric characters. Compare this ID against the one listed on the official download page of the project–any mismatch indicates a clone. Delete the extension and report it to Google immediately if the IDs do not match. After verification, click „Details“ under the extension card and enable „Site access“ set to „On click“ instead of „On all sites.“ This restriction forces the vault to activate only when you manually click its toolbar icon, reducing the attack surface for malicious scripts attempting to call its functions. Proceed to the import or creation phase only after completing these checks. Creating a New Wallet and Securing Your 12-Word Seed Phrase Offline Initiate the generation process only on a device that has never been connected to the internet after a factory reset or on a dedicated hardware device like a Ledger or Trezor. After the software displays your 12-word mnemonic, immediately write it down on fireproof paper using a 2H graphite pencil or an archival-quality ink pen–do not use a laser printer or store the file digitally. Verify each word against the BIP-39 English wordlist (2048 words total) to catch typos; for example, ensure „abandon“ is not mistakenly written as „abandoned“ which is non-standard. This 12-word string represents a 128-bit entropy key, providing an effective brute-force resistance of 2^128 attempts, making it infeasible for classical computers to crack. Divide your written seed into three parts using a 2-of-3 Shamir’s Secret Sharing scheme: split the mnemonic into three fragments using a tool like `shamir-mnemonic` offline, then store each fragment in a separate tamper-evident envelope at distinct geographical locations (e.g., a safe deposit box, a fireproof home safe, and a trusted relative’s residence). Each fragment alone reveals zero information about the full phrase; combining any two fragments recovers the entire seed. Set a physical alarm or calendar reminder to check the integrity of these envelopes every 6 months for water damage, fading, or unauthorized access. Engrave the seed phrase into a stainless steel plate (0.5mm thickness) using a pneumatic engraver or a manual scribe–laser etching off-gases dangerous fumes and leaves microscopic data traces if done in a poorly ventilated area. Place the plate inside a sealed Mylar bag with silica gel desiccant to prevent corrosion from humidity levels above 50% RH. Never store this plate near electronics, magnets, or items generating alternating current fields stronger than 100 µT (e.g., microwave ovens or large transformers), as magnetic fields can corrupt the orientation of metal grain boundaries over decades and obscure characters. Confirm the absence of any recording device (smartphone camera, smart speaker, or Windows Recall feature) in the room during phrase creation. A single photograph of the phrase–even a blurry one–reduces entropy from 128 bits to effectively zero because OCR or manual extraction can recreate the 12 words. Destroy any digital scratchpad files, clipboard history (Windows: `%AppData%\Microsoft\Windows\Clipboard`), or encrypted notes created during the process by overwriting the storage sector three times with random data using `dd if=/dev/urandom` on Linux or `cipher /w:C:\` on Windows. Use a passphrase (BIP-39 optional 25th word) only if you can memorize a 50-character randomly generated string (e.g., `#K9mQx!zLp3Vw8Rty*Bn2`); writing it on paper creates a single point of failure. Without the passphrase, the 12-word mnemonic is useless to anyone who finds it. Test your recovery procedure immediately: erase all existing keys from the software by clearing its local storage or resetting the device, then attempt to restore using only your written fragments and the passphrase (if used). Measure the time needed–target under 10 minutes for full restoration to the exact same address and transaction history. If any mismatch occurs, do not transfer funds beyond a test amount of 0.001 BTC or equivalent until you identify and fix the discrepancy, which is often caused by a single wrong word order or a non-standard derivation path (use path m/44'/0'/0'/0/0 for Bitcoin legacy addresses). Store a final, sealed copy of the entire seed phrase in a concrete-encased safe rated for UL Class 350-1 hour fire endurance (at least 1-hour protection at 1700°F). Bury this safe at a depth of at least 1 meter in a location known only to you, marked by a GPS coordinate stored in a separate offline encrypted file on a USB drive kept in a Faraday bag. The total value protected by this cold storage should not exceed 1% of your total liquid assets to align with pragmatic risk management–hiding $10,000 in cryptocurrency underground is justifiable, but hiding your life savings in one spot is not. Q&A: I just installed the Qsafe extension. During the setup, I was given a 24-word recovery phrase. Do I really need to keep this offline, or can I just save it in a password manager on my computer? You should not store your recovery phrase in a browser-based password manager or anywhere on your computer (like a text file or screenshot). If your computer gets infected with malware that has screen capture or clipboard reading capabilities, your entire wallet could be stolen in seconds. The whole point of QSafe Wallet Edge extension’s security is that the private keys are generated locally in your browser and never uploaded to a server. If you lose that phrase, you lose access to your funds. A better method is to write the 24 words down on paper using the supplied template card. Then store the paper in a fireproof safe. If you absolutely must have a digital backup, consider using an encrypted USB drive that is never plugged into a machine while you are online. Many people also use metal stamping kits to engrave the phrase onto steel plates so it survives a flood or fire. I see Qsafe has a „session timeout“ setting. If I set this to 1 minute, will I have to type my password every time I switch tabs or just after I close the browser? That setting controls how long the wallet stays unlocked inside the active browser. If you set it to 1 minute, the wallet will automatically lock itself after 60 seconds of inactivity. This does not mean you have to approve every transaction again—it refers to your entire session being encrypted. Once locked, you must enter your master password to resume using the extension. This is particularly useful if you step away from your computer at a coffee shop or in a shared office. It protects you even if someone sits down at your unlocked machine. However, if you close the browser completely, the session ends regardless of that timer, and you will always need to enter your password on the next launch. I recommend a timeout of 1 to 5 minutes for daily use. Setting it to 0 disables auto-lock, which is convenient but risky if you have to step away. the guide mentioned using a hardware wallet with Qsafe. Does connecting a Ledger or Trezor mean I can skip the 24-word phrase from the extension entirely? No, you still need to keep your Qsafe extension’s recovery phrase safe. What a hardware wallet does is add an extra layer of protection for signing transactions. When you link a Ledger or Trezor, Qsafe uses that device to authorize outgoing transfers. Without the hardware wallet physically connected and unlocked, no funds can be moved, even if a hacker gains full access to your browser extension. However, the phrase you got from Qsafe is still the master key to your account. If you lose both the hardware wallet and your Qsafe phrase, you are locked out. Some people make a mistake: they think „I have a hardware wallet, so I can store my Qsafe phrase carelessly.“ That is false. The hardware wallet protects transactions; the recovery phrase protects your account recovery. Keep the phrase offline even if you use a hardware device. What happens if I accidentally approve a malicious smart contract while using Qsafe? Can I revoke permission through the extension itself? Currently, Qsafe does not have a built-in token approval revoker inside the extension. If you approve a malicious contract, that contract can drain the specific tokens you authorized. To revoke it, you will need to use an external blockchain explorer or a dedicated revoke tool (like Revoke.cash or Etherscan’s „Token Approvals“ page). You connect your wallet to that site, find the contract that has approval, and submit a transaction to set the allowance back to zero. This is a normal Ethereum transaction, so you will pay gas fees. To avoid this situation, pay close attention to the pop-up window that Qsafe shows before you sign. It displays the exact contract address and the amount of tokens the contract can spend. If the address looks like a random string of characters rather than a known protocol, do not sign. Also, consider using a secondary „burner“ wallet with a small amount of tokens for testing unknown dApps. I want to use Qsafe on a public library computer. Is that safe if I delete the extension when I am done? Using crypto wallets on a public computer carries high risk, even if you delete the extension. Deleting the extension from Chrome or Firefox does not securely erase the data. Browser storage, cache folders, and registry entries may still contain pieces of encrypted data. More importantly, public computers often have keyloggers, screen recording malware, or fake browsers that capture everything you type, including your password and recovery phrase. If possible, avoid using Qsafe on any shared machine. If you absolutely must, follow these steps: First, use a temporary Chrome profile (not your main profile). Second, install the extension, do your transaction, then uninstall the extension. Third, clear all browser data, cookies, and site permissions. Fourth, restart the browser. Finally, change your Qsafe password as soon as you get back to your own machine. Even with all that, the safest method is to never input your recovery phrase or password into any device you do not physically own and control.