Most crypto losses come from a short list of failures: a seed phrase photographed into the cloud, a fake wallet app, SMS 2FA on an exchange account, an address copied from history, an unlimited approval signed on a phishing site. The checklist walks through 25 concrete habits in six groups, weights the critical ones higher and shows the five open items to fix first. Your ticks stay in this browser only.
Security score: 0%
Still open, most important first:
The seed phrase exists only offline: on paper or metal, never in photos, cloud notes, e-mail, password managers synced online or chats.
I have checked the backup: restored the wallet from it (or verified the words on the device) before putting real money in.
Savings sit on a hardware wallet or another offline-key setup; the phone hot wallet holds spending money only.
Wallet apps were installed from the official site or store link published by the developer; downloads were checked against published hashes.
Exchange accounts use an authenticator app or security key for 2FA, not SMS.
Ticks are stored only in this browser (localStorage).
How the score works
Each item carries a weight: 3 for critical items whose failure usually means losing everything (seed phrase stored online, no tested backup, SMS 2FA, copying addresses from history, blind signing), 2 for important ones, 1 for good practice. The score is the share of weight you have ticked. A high score with one critical item open is still a problem, which is why the open list is sorted by weight.
The groups and why they matter
Seed phrase and backups โ the backup is the wallet. Offline, tested by a restore, stored away from the device, passphrase backed up separately.
Devices and software โ savings on a hardware wallet or other offline keys, apps installed from the developer's official links, verified downloads, updated systems.
Exchange and e-mail accounts โ authenticator or security-key 2FA, a protected e-mail, withdrawal whitelists, a carrier PIN against SIM swaps.
Sending habits โ addresses from the source, full comparison, test transactions, the right network and memo.
Signatures and approvals โ read before signing, revoke old approvals, a separate wallet for new dApps.
Social engineering โ nobody legitimate asks for a seed phrase; bookmarks instead of links; silence about holdings; ignore unsolicited tokens.
What to do with the result
Fix the critical items first, one per day if needed: move the seed phrase off any online service, restore from the backup on a spare device to prove it works, switch exchange 2FA to an authenticator app. Then repeat the review every few months and after buying a new phone or computer โ most setups decay rather than break.
If you suspect a seed phrase was exposed, do not 'clean' the wallet: create a new wallet with a new seed on a trusted device and move everything there. The old seed stays compromised forever.
Frequently asked questions
+Are my answers stored or sent anywhere?
Ticks are saved in your browser's localStorage so they survive a reload. Nothing is sent to KOT.CASH; clear them with the Reset button.
+Is a password manager OK for a seed phrase?
We count it as online storage if it syncs to the cloud. An encrypted offline copy is a judgment call; paper or metal kept safely is the common baseline.
+Why is SMS 2FA marked critical?
SIM-swap attacks move your number to an attacker's SIM, after which SMS codes and password resets go to them. Authenticator apps and security keys do not depend on the phone number.
+Do I need a hardware wallet for small amounts?
No. For spending money a reputable mobile wallet is fine. The item is about savings โ the amount you could not afford to lose.
+Does a 100% score mean I am safe?
It means the common failure points are covered. New scams appear constantly; the habit of slowing down before sending or signing matters more than any score.
Calculations run entirely in your browser; nothing you type is sent to KOT.CASH. Results are estimates for information only and are not financial, tax or legal advice.