HashPack is non-custodial. How your keys are stored depends on the account type. The HashPack app password, device PIN, or biometric unlock only unlocks the app on that device. They are not your 24-word recovery phrase.
HashPack cannot decrypt your phrase from a password reset and cannot reverse a send.
Advanced (phrase / private key) accounts
Wallet data for these accounts is stored in the browser or mobile app’s local storage on your device.
- Keys stored on your device are protected with authenticated encryption, unlocked by the app password, PIN, or biometrics you set on that device.
- Account IDs, nicknames, and address-book entries on the device are stored with the same local protection.
- While you are logged in, HashPack keeps material it needs to sign in session memory. Log out of HashPack when you leave a shared computer.
The app password is unique on each browser or phone. If you forget it, you re-import with your 24-word phrase or private key and set a new password. See What is the password used for when creating a new wallet?.
If you lose the phrase and the private key, HashPack cannot rebuild the account.
Email (Magic) accounts
Email accounts are different. Login is a Magic Link or one-time code to your inbox. Key material is handled by Magic, not stored in HashPack the same way as an Advanced account.
HashPack does not see your raw email-account key in the same way it holds a locally encrypted phrase. Signing happens through Magic’s infrastructure. HashPack still cannot spend your funds without your login, and HashPack support cannot reset a mailbox you no longer control.
Protect this path with:
- Inbox security (and 2FA on the mail provider)
- HashPack 2FA on the Magic account — How to add 2-factor authentication
- An exported 24-word backup stored offline — How to export your recovery phrase for email created accounts
If you lose the email and have not exported a phrase, HashPack cannot recover the wallet.
Hardware wallets
Ledger and D’CENT keep the private key on the device. HashPack stores a public-key handle so it can build transactions; you approve them on the hardware screen. Never enter the device recovery phrase into HashPack. See Set up your Ledger with HashPack.
What this does not mean
- Encryption on your device is not the same as HashPack being able to reset an account.
- Email login is convenient; it is not “nothing ever leaves your device.”
- HashPack has been independently audited (see hashpack.app/security). An audit does not replace your backups.