HazeWallet gives websites and web apps a sleek self-custody wallet with one script tag, optional theming, a built-in launcher pill, a JavaScript API, and an optional buy flow for funding the wallet.
Drop in the script, optionally set a few theme variables, and HazeWallet is live.
<script src="https://hazewallet.com/embed.js?v=commerce-097" async defer></script>window.HazeWallet.open() / close() for custom integrations.Configure the launcher label and open behavior before the script loads.
<script src="https://hazewallet.com/embed.js?v=commerce-097"
data-position="right"
data-label="HazeWallet"
data-accent="#2ecfff"
data-accent-deep="#7750ff"
data-bg="#07112b"
data-radius="18px"
async defer></script>Choose right, left, top, or bottom. HazeWallet stays a compact vertical wallet panel while the host page remains visible behind it.
Use the script attributes generated by the Add Widget page, or CSS variables if you prefer to theme manually.
:root {
--haze-accent: #2ecfff;
--haze-accent-deep: #7750ff;
--haze-bg: #07112b;
--haze-radius: 18px;
}Primary brand color used in buttons, highlights, and selection states.
Secondary gradient color that gives the wallet the HazeWallet glow.
Controls the roundness of the pill launcher and wallet surfaces.
The default launcher is designed to feel polished, obvious, and clickable.
HazeWallet automatically injects the launcher into the page so the wallet is immediately usable with no extra work.
<!-- Prefer your own custom CTA? -->
<button id="wallet-button">Open Wallet</button>
<script>
document.getElementById("wallet-button")
.addEventListener("click", () => window.HazeWallet.open());
</script>Control the embedded wallet programmatically from your own site or app.
window.HazeWallet.open();window.HazeWallet.close();HazeWallet is built around practical self-custody flows that are simple for users and clear for builders.
Choose a password with at least 12 characters, download an encrypted backup file, and confirm you have saved it before opening your wallet.
Restore an encrypted HazeWallet backup with its password, or import a supported WIF private key. Your file and key stay on this device. Seed phrases are not supported.
Choose an asset and its supported network to see the receiving address and QR code. Only send that asset on the network shown. Tokens with the same name on different networks are distinct assets.
Review the full destination, amount, network fee, and total. Confirm with your password, then the wallet signs locally and submits through the relay.
Practical protection for everyday self-custody.
HazeWallet is a self-custody web wallet: you control the keys that authorize your transactions. Every way of holding crypto carries risk, and no wallet is 100% safe. We work to protect the wallet; your choices about your device, keys and recovery details also make a difference.
We recommend keeping your private key or encrypted recovery backup offline. Save the encrypted Haze backup on offline storage and keep its password separately. Never share a private key or give anyone your backup and password together. Haze support will never ask for them.
Use a long, unique wallet password, keep your browser and operating system updated, and limit browser extensions. Check the exact HazeWallet website address before unlocking. Choose Strict automatic locking in Settings → Backup & security when it suits how you use your wallet.
Review the full receiving address, asset, network and fees before confirming. For a new recipient, consider a small test payment first. Unexpected tokens, a familiar logo or a listed market price do not establish that an asset is trustworthy.
An offline backup helps you recover your wallet. Using this web wallet still unlocks signing keys in your device's memory. Keeping signing keys offline requires a compatible hardware wallet or offline signer; those account types are not currently available in HazeWallet.
The current wallet encrypts stored keys, signs transactions locally and offers automatic locking. These protections reduce specific risks; they cannot guarantee protection against a compromised browser, device or website. Hardware signing, independent security reviews and isolation of signing from checkout and other website features are priorities for further protection.
Read more about browser cryptography and its security limits and how hardware signing keeps keys off the connected computer.
Stripe Embedded Components is the planned funding method, with Link sign-in and stablecoin delivery. Activation is pending Stripe account setup. Until an eligible provider is enabled, use Receive to fund your wallet.
Choose an amount, connect with Link, complete Stripe’s identity checks, select a payment method and review the destination, fees and total before paying. Prepared web funding includes USDC, USDT and Open USD on specific supported networks for eligible US residents outside New York. Unsupported direct purchases are hidden.
Stripe is merchant of record for its purchase and handles its payment, identity checks and delivery. HazeWallet remains self-custodial. Payment success and crypto delivery are separate stages; a confirmed balance requires network confirmation.
Identity details and payment information go directly to Stripe through its SDK. Haze temporarily holds a server-side Link authorization connection and keeps minimal purchase receipts containing the public receiving address, amount, network and status; it does not store card details, identity documents or your private keys. Stripe and Link may email purchase confirmations.
All eight assets in Stripe’s published Embedded Components catalog are listed first in the wallet. Buy appears only for a configured, available onramp on that exact asset and network. Nine routes are prepared: USDC on Ethereum, Base, Solana, Arbitrum, World Chain and Polygon; USDT on Ethereum; and Open USD on Ethereum and Base. Other published routes are labeled as pending wallet integration and cannot receive purchases through Haze yet. Stripe account setup still gates activation.
Leaving checkout cannot cancel a submitted Stripe payment. Abandoned purchases start with a fresh session. Native mobile purchases, EU verification, instant ACH and an automatic USDC-to-Pepecoin conversion are not currently enabled. Haze adds no service fee to this Stripe flow.
Customize the wallet name, logo, background image, colors and launcher in Add Widget. Preview the result and copy your snippet—no payment or account required.
Choose PNG, JPG or WebP files for local resizing, or use public HTTPS image URLs. Selected files are included in the snippet. Remote images are loaded by the visitor’s browser, so their image host receives the request. To avoid remote image requests, choose files instead.
Update your installed snippet when you change branding. Previously activated custom logos remain supported. Network fees and purchase-provider fees still apply where relevant; customization is free.
Short answers to the questions builders usually ask first.
If the HazeWallet widget appears blank, shows a browser "blocked" message, or simply never appears, the cause is almost always your website's headers — a Content-Security-Policy (CSP) and/or X-Frame-Options — not HazeWallet. A browser can only load one site inside an iframe on another site if the host page's CSP allows it. HazeWallet itself sends permissive embedding headers, so the rule you need lives on your domain.
frame-srcThis is what lets your site embed the widget:
frame-src 'self' https://hazewallet.com https://www.hazewallet.com;When the wallet flow shows one of your own pages inside the widget (for example a payment or checkout page), that page must permit itself and HazeWallet in frame-ancestors:
frame-ancestors 'self' https://hazewallet.com https://www.hazewallet.com;frame-ancestors 'none'. It means "never allow framing." A browser drops the whole frame-ancestors directive if 'none' is present, so it must be removed — not combined with allowed domains.X-Frame-Options: DENY on pages that must open inside the wallet — it blocks iframe embedding entirely. Remove it (or don't send it) for those pages.'self'If your site opens a page of its own in an iframe, and that page embeds HazeWallet, then both frame-src and frame-ancestors should include 'self' as well.
default-src 'self';
script-src 'self' 'unsafe-inline' https://static.cloudflareinsights.com;
style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;
font-src https://fonts.gstatic.com;
img-src 'self' data:;
connect-src 'self' https://cloudflareinsights.com;
object-src 'none';
base-uri 'self';
form-action 'self';
frame-src 'self' https://hazewallet.com https://www.hazewallet.com;
frame-ancestors 'self' https://hazewallet.com https://www.hazewallet.com;
upgrade-insecure-requestsContent-Security-Policy header to your merged value above.X-Frame-Options is set to DENY, remove that header for those pages.curl.exe -sI https://YOURDOMAIN.COM/ | findstr /I "content-security-policy x-frame-options"Confirm the returned Content-Security-Policy contains the frame-src / frame-ancestors entries above, and that X-Frame-Options: DENY is not being sent on the pages that must be framed.
A HazeWallet error page, a 502, or a broadcast/API failure is a separate issue and should not be treated as a CSP/embedding problem.
No. The core value proposition is that builders can add the widget without a HazeWallet signup or partner dashboard.
No. The wallet is self-custodial and the private key stays on the user's device.
HazeWallet reads balances through blockchain nodes and indexers. A provider outage or quota limit can stop an account from updating while other networks continue to work. “Your available balance” includes the fresh, priced balances Haze can currently read. Missing amounts are excluded, and retained amounts are labeled “Last known.” An API error is never interpreted as a zero balance. For assets held on several networks, working accounts appear with a Partial label. Open “API status & contacts” to see provider names, failures, retry times and who to contact. Haze tries configured fallback providers and backs off rate-limited endpoints, including Blockchair HTTP 430. A full page reload needs a live balance source; the wallet does not persist a separate unencrypted balance history.
Download an encrypted backup in Settings, keep an offline copy, and store its password separately. Use “Check a backup file” to verify recovery without replacing your wallet. On a new browser, choose “I already have a wallet,” select your backup, and enter its password. Haze does not use a seed phrase and cannot reset a forgotten password.
Unlocked private keys are held only in memory. Refreshing or closing the tab requires your password again. Standard mode also locks after 15 minutes idle, 5 minutes hidden, or 1 minute with the wallet panel closed. Strict mode locks immediately when hidden or closed, after 1 minute idle, and within 15 minutes even while active. Your encrypted wallet remains stored in this browser.
Yes. Use the theme variables to control accents, background tone, and border radius so the pill launcher and wallet feel native.
Yes. Call window.HazeWallet.open() from any interaction in your interface.