@mybucks.online/core

Core library for mybucks.online—a digital cash envelope for the internet. It provides hash and key derivation, address generation, and gifting-link token encode/decode for the seedless, disposable wallet framework.

Quick start

1. Install

npm install @mybucks.online/core

2. Generate hash, private-key and wallet address

Passphrase and PIN are validated with zxcvbn before hashing. Weak passphrase or PIN will yield an empty hash or null token.

import { 
  getEvmPrivateKey, 
  getEvmWalletAddress, 
  getTronWalletAddress,
  generateHash
} from "@mybucks.online/core";

const showProgress = (p) => {
  console.log(`progress: ${p * 100}%`);
};

const hash = await generateHash(passphrase, pin, showProgress);

const privateKey = getEvmPrivateKey(hash);
console.log("Private key: ", privateKey);

const address1 = getEvmWalletAddress(hash);
console.log("EVM Address: ", address1);

const address2 = getTronWalletAddress(hash);
console.log("TRON Address: ", address2);

3. Generate and parse gifting-link token

import { generateToken } from "@mybucks.online/core";
const token = generateToken(passphrase, pin, network);

console.log("https://app.mybucks.online/#wallet=" + token);

import { parseToken } from "@mybucks.online/core";
const { passphrase, pin, network, legacy } = parseToken(token);
console.log("Account credentials are: ", passphrase, pin);
console.log("Network: ", network);
console.log("Legacy token: ", legacy); // true if token was in legacy format

4. Generate random credentials

randomPassphrase and randomPIN generate cryptographically random credentials that are guaranteed to pass the zxcvbn strength thresholds required by generateHash (PASSPHRASE_MIN_ZXCVBN_SCORE = 3, PIN_MIN_ZXCVBN_SCORE = 1).

import { randomPassphrase, randomPIN } from "@mybucks.online/core";

const passphrase = randomPassphrase(); // e.g. "Ax3!-bQ2#-mK7@-zP1$"
const pin = randomPIN();               // e.g. "k4r9w2"

const hash = await generateHash(passphrase, pin, showProgress);

Changes (default vs legacy)

To make the wallet more secure and resilient against attacks, and to meet standards and follow best practices (e.g. NIST SP 800-132, OWASP, RFC 7914), we introduced a new version that is now the default. A legacy flag is available for backward compatibility with existing wallets and tokens.

Scrypt parameters (default)

• N is increased from 2^15 to 2^17 to raise the memory cost and make GPU/ASIC brute-force attacks much harder.
• p is reduced from 5 to 1 so hashing time stays the same or lower for users while resistance to brute-force is improved.

Salt generation (default)

• Legacy used only the last 4 characters of the passphrase plus the pin, which discarded most of the passphrase entropy.
• The default now derives the salt from the full passphrase and pin via a structured encoding and adds a domain separator so hashes are bound to this KDF and not reusable in other protocols or versions.

Token generation (default)

• Legacy encoded the gifting-link token by concatenating passphrase, pin and network with a delimiter, which is ambiguous for some inputs.
• The default uses a compact length-prefixed payload (version byte + lengths + UTF-8 bytes) so there is no concatenation ambiguity and the URL fragment stays short.
• parseToken accepts both legacy and default token formats automatically and returns { passphrase, pin, network, legacy }, where legacy is true if the token was in legacy format.

Use generateHash(passphrase, pin, cb, true) or generateToken(passphrase, pin, network, true) only when you need to match existing legacy wallets or tokens.

Test

npm run test

Docs

Find the docs here.

Live example

• https://github.com/mybucks-online/app
• https://app.mybucks.online
  passphrase: DemoAccount5&
  PIN: 112324
• https://app.mybucks.online/#wallet=Db1zfXAg1EZW1vQWNjb3VudDUmBjExMjMyNAhvcHRpbWlzbQ==mlUEbO (default)
• https://app.mybucks.online/#wallet=VWnsSGRGVtb0FjY291bnQ1JgIxMTIzMjQCb3B0aW1pc20=_wNovT (legacy)
• https://codesandbox.io/p/sandbox/mybucks-online-key-generation-sandbox-default-7jktdl

⚠️ Disclaimers & User Responsibility

Important:

• mybucks.online is intended for micro-transactions and gifting, not long-term storage of high-value assets.
• There is no reset/recovery for the passphrase + PIN. If lost, funds will be permanently inaccessible.
• User-created credentials often have lower entropy than expected. For stronger security, users are encouraged to use auto-filled credentials generated by randomPassphrase and randomPIN.

mybucks.online

Mybucks.online is a digital cash envelope for the internet—a Web3 utility for one-time use, gifting, and easy onboarding. Technically, it implements a seedless, disposable wallet framework. Keys are derived from passphrase + PIN using Scrypt, with no server-side key storage.

You can send cryptocurrency—and even the envelope itself—via a URL. Create a one-time account, fund it, and share full ownership through a link. Perfect for micro-gifting, airdrops, creator tipping, and bulk distribution.

Zero Footprint

• No servers, no databases, no storage and no tracking.
• 100% browser-based.
• Your credentials never leave your device.
• Your account is generated whenever you open it. Closing or refreshing your browser erases all traces/history.

Fast and Easy

• No app installs, no browser extensions, no registration and no KYC.
• Create or open an envelope in seconds with only your browser.

1-Click Gifting

• Send a wallet as a URL, not just coins.
• Recipients open the link and take ownership instantly.