Wallets
Web Wallet

Web Wallet (wallet.superhero.com)

wallet.superhero.com is Superhero Wallet running as an ordinary web page. Nothing to install, nothing to update, works on any browser including ones that cannot run extensions. It is also the fallback superhero.com opens when it cannot find a wallet any other way, so you may meet it without having chosen it.

Which build this is

It is the web build of Superhero Wallet: the same wallet as the browser extension and the native apps, served differently. Three consequences of "it is a web page":

  • Its storage is localStorage on the wallet.superhero.com origin, with the seed phrase encrypted under a key derived from your wallet password. Clearing site data for that origin removes the wallet from this browser; your seed phrase brings it back.
  • It is installable as a PWA. Installing it does not change what it can do. An installed PWA is still the web build.
  • It is the deep-link endpoint every other Superhero surface points at.

When superhero.com sends you there

  • You pressed Connect and no extension answered. After the detection window expires, if the page is not framed inside a wallet, the app opens the web wallet in a new window.
  • You are on mobile and the native app did not take over. The app tries the superhero:// deep link first and falls back to the web wallet after about 1.5 seconds.

Either way the app passes the action plus x-success and x-cancel callback URLs, so the wallet can return the result to the tab that asked. Signed results come back through /tx-queue/:id, described in Connecting a Wallet.

What you can do there

Multi-chain support is identical across all three surfaces: bitcoin, ethereum, æternity, solana, bnb, avalanche, polygonPos and dogecoin. In particular you can:

  • Create a new wallet, or import one from a seed phrase.
  • Hold and send AE and AEX-9 tokens, including adding a token by pasting its ct_ contract address.
  • Sign transactions requested by superhero.com.
  • Claim additional .chain names, bid in name auctions, set pointers and transfer names. Superhero sponsors one free name claim per address; further names are claimed here or in any other Superhero Wallet surface.
  • Import a Ledger's æternity accounts over WebUSB, and sign with the device.
  • Pair an AirGap Vault and sign offline.

What the web build can and cannot do

CapabilityExtensionWeb buildMobile apps
Announce itself to any æpp page automaticallyYes, via a content scriptNoNo
Be embedded by an æpp in an iframeNot applicableYesNo
Be addressed by an æpp over the x-success deep-link APINo, an extension has no public URLYes, this is the canonical endpointYes, via superhero:// and universal links
Ledger over WebUSBChromium onlyYes (Chromium only in practice)No
AirGap Vault pairing and signingYesYesYes
Unlock with biometricsNoNoYes
In-app dæpp browserNoNoYes
Chrome side panel / Firefox sidebarYesn/an/a
StorageExtension-origin localStorage, encryptedSite localStorage, encryptedOS keychain

The first row is the one that matters. A hosted page cannot inject itself into someone else's site. The extension runs a content script on every page that proxies AEX-2 messages between the æpp and the wallet, so an æpp finds the extension by listening. The web build can only be reached two ways:

  • Embedded as an iframe. When it detects a parent window, it opens a message connection to the parent and re-announces the wallet every three seconds. Confirmation prompts then open as separate popup windows.
  • By deep link. Four routes, each taking x-success and x-cancel callback URLs: /address (connect), /sign-transaction, /sign-message and /sign-jwt. This is the path superhero.com uses.

Biometric unlock and the dæpp browser are native-only features.

AirGap works here

Cold signing from an AirGap Vault is available in the web build as well as in the installed surfaces. Pairing and signing are QR-based, and every screen that shows a QR code also accepts the airgap-wallet://?ur=… string pasted by hand, so it works in a browser with no camera. Set AirGap Vault to QR code V3; V2 payloads will not deserialize. AirGap accounts can sign transactions but not messages.

What you trade for "no install"

ExtensionWeb wallet
Code deliveryInstalled once, updated through a reviewed store channelFetched from the server on every visit
Compromise of the hostDoes not change code already installedServes you new code immediately
Phishing resistanceYou open a pinned browser controlYou open a URL, which can be typosquatted
Works without an installNoYes

A hosted wallet is only as trustworthy as the origin serving it, and that trust is re-established on every load rather than once at install time. So:

  • Type the domain or use a bookmark. wallet.superhero.com, exactly. Do not reach it from a link in a message.
  • Check the URL before you enter a seed phrase, not after.
  • Prefer the extension on desktop and the native app on mobile for accounts holding real value. Use the web wallet for convenience, for browsers that cannot run extensions, and for one-off actions.
  • Nobody legitimate ever asks for your seed phrase, and the phrase is the only thing that restores the account. See Wallet Security and Backup & Recovery.

Web wallet or built-in wallet?

Both need no install:

  • The web wallet is Superhero Wallet on another origin. It holds a multi-chain account and signs for superhero.com across a callback, and its portable backup is a seed phrase.
  • The built-in wallet is part of the Superhero app itself, æternity-only, with its encrypted vault in your browser's storage for the superhero.com origin, unlocked by a passkey or passphrase on every signature.

If you want one wallet used by several æpps, take the web wallet. If you want the shortest path into Superhero on a device you will keep using, take the built-in wallet, after reading what its storage does and does not survive in The Built-In Wallet.

Related

Mobile AppThe Built-In Wallet