# gapbit

**Split any secret so that no single piece matters.**

One HTML file. No install, no account, no server, no company.
Free and open source under the MIT licence.

A seed phrase is one object: find it and you own everything, lose it and
everything is gone. gapbit turns it into N pieces. Any M rebuild it; fewer than
M reveal nothing: not less, nothing.

## One file

- **`gapbit-wallet.html`** — the whole app, in a single HTML file. It runs in
  two modes you pick on the first screen:
  - **Online** — one connected device does everything: balances, receive, send
    (build + sign inline), broadcast, encrypt files. For everyday and moderate
    amounts.
  - **Offline** — run the same file on a disconnected device. It makes and uses
    keys there and talks to an Online device only by QR, so your keys never
    touch the network. gapbit checks connectivity on a best effort and locks if
    the device looks online, but keeping the device truly offline is your
    responsibility (turn off Wi-Fi, cellular and Bluetooth).

gapbit is send-only: it signs a plain coin send or a plain ERC-20
`transfer()` and refuses anything else (approvals, arbitrary contract calls) —
the guard against a poisoned transaction is a disabled Sign button, not a
warning you can click past.

---

## What it does

| | |
|---|---|
| **Bitcoin** | native segwit, BIP-84, offline PSBT signing |
| **Ethereum & ERC-20** | BIP-44, EIP-1559, on Ethereum, Base, Arbitrum, Optimism, Polygon |
| **Splitting** | Shamir M-of-N over GF(256), optional passphrase, plain files |
| **Files & secrets** | encrypt any file or text, split the key rather than the file |
| **Entropy** | seeds minted from measured physical sources, certified on screen |
| **Offline gate** | probes the network and disables key creation and signing while one is reachable |

Import any existing BIP-39 seed: keep your hardware wallet, fix the backup
underneath it.

## Running it

**Desktop**: download `gapbit-wallet.html`, disconnect, open it.

**iPhone**: Safari cannot open a downloaded HTML file. Open the hosted page
once, then **Share → Add to Home Screen**. A service worker caches it, so it
launches as an app and runs in airplane mode.

**Android**: the same, or open the file from Files.

Create seeds and sign with the network off. Turn it on only to broadcast; a
signed transaction contains no keys.

## Files

```
index.html               landing page
gapbit-wallet.html       the wallet, the whole product
gapbit-broadcast.html    13 KB page that pushes a signed transaction to a node
b/index.html             the same, served at /b
sw.js                    offline caching
manifest.json            installable app metadata
VERIFY.txt               SHA-256 of every published file
```

## Deploying

Any static host with HTTPS. GitHub Pages works; `.nojekyll` is included.

**HTTPS is required**: camera access and service workers are both blocked on
plain HTTP, so QR scanning and offline install silently fail without it.

**Do not let the host modify the files.** No minification, no analytics, no HTML
optimisation. The value is that it is byte-identical to what anyone can audit.

**Bump `CACHE` in `sw.js` on every release.** Returning visitors are served from
the service-worker cache; if the constant does not change they keep running the
old file no matter what you publish.

**Regenerate `VERIFY.txt` and the hash on the landing page together.** They are
the only claim gapbit makes about itself that a user can check. A stale hash is
worse than no hash: it teaches people that a mismatch is normal.

---

## Design system

All three pages share one stylesheet contract, declared at the top of each file
as `instrument design system v2.0`:

- **Surfaces layer, they do not outline.** `--bg → --surface → --raised →
  --sunken`. Depth comes from value, never from shadow.
- **Hue is a state channel and nothing else.** `--safe`, `--live`, `--warn`.
  Never on a button, never on a heading, never decorative. Every coloured state
  also carries a word and a shape, so it survives colourblindness, greyscale
  printing, and a glance from across the room.
- **Chain identity is border style, never hue**: solid Bitcoin, dashed
  Ethereum, dotted vault.
- **Every padding is a token** on the 4px scale (`--s1`…`--s10`). A number that
  is not on the scale is a bug.
- **Squared corners throughout.** This is an instrument, not an app icon.

To return the product to strict monochrome, point `--safe`, `--live` and
`--warn` at `var(--ink)` in both themes. Nothing else needs to change.

---

## Licence

MIT. Free to use, copy, modify and sell, personally or commercially, at no
cost and with no permission needed. Full text in [`LICENSE`](LICENSE).

Bundled libraries are MIT as well; their notices are intact.

## No warranty

Provided as is, with no warranty, as set out in the MIT licence above. gapbit
holds no keys, has no account to recover, and cannot reverse a transaction:
lose your seed and the funds are gone. You run it at your own risk.