Zcash web wallet: what actually exists in 2026, and what is a trap

Search for "Zcash web wallet" and you will find a mix of developer experiments, browser extensions with a few dozen users, exchange accounts and outright phishing pages. This guide sorts them out. It reflects the state of things on 24 October 2026, three months after the Ironwood upgrade changed which wallets can use Zcash's newest shielded pool.

The short answer

A browser-based Zcash wallet is technically possible, and a few now exist. None of them is yet the combination most people want: shielded by default, Ironwood-ready, audited, widely used and simple. If you want private ZEC today, install a mobile or desktop wallet from our best Zcash wallets list. If you want to experiment in the browser, use a small amount and read the checklist below first.

One rule covers every case: never type your recovery phrase into a website. No legitimate Zcash wallet asks you to "restore" or "import" your seed in a browser tab you reached from a search result or a link.

Why Zcash in a browser is hard

A Bitcoin-style web wallet can ask a server "what is the balance of this address?" A shielded Zcash wallet cannot do that without giving the privacy away. Shielded amounts and recipients are encrypted on-chain, so the wallet has to download compact blocks and try to decrypt every output with your keys on your own device. It also has to build zero-knowledge proofs locally when you send.

ChainSafe, which built the WebZjs library, explained the trade-off in its research: if detection were moved to the server, you would have to hand over your viewing key or reveal which notes are yours. Doing the work inside a browser tab means WebAssembly, web workers and a gRPC-web proxy in front of the light-wallet server, because browsers cannot speak the server's normal protocol directly. That is why browser wallets have arrived slowly and why several still lag behind mobile apps.

Every browser-based option, October 2026

Status below is based on the ZecHub wallet directory, the projects' own pages and store listings, checked in October 2026. "Ironwood-ready" means the wallet can use the shielded pool that replaced Orchard on 28 July 2026.

MetaMask Snap and WebZjs

ChainSafe's Zcash Shielded Wallet Snap brings shielded ZEC into MetaMask using the WebZjs WebAssembly library. It launched in July 2025 and the Snap itself was audited by Hacken in May 2025. It works with the Sapling pool only, needs a gRPC-web proxy (ChainSafe's or your own) and can take a long time to sync an older wallet. ZecHub lists it as not Ironwood-ready. Sapling is still a working shielded pool, so the Snap is not broken, but it cannot use Ironwood, the pool most current wallets now default to. The separate WebZjs web wallet is a developer demo; its own documentation says the libraries are still under development and unaudited. Treat it as a proof of concept, not a place for savings.

Brave Wallet

Brave added shielded ZEC buying, sending and receiving to its built-in desktop wallet in version 1.77, announced on 2 April 2025. It is the most polished browser option and needs no extension. As of October 2026 ZecHub lists Brave's Ironwood support as "In Progress", and mobile shielded support had been promised rather than shipped. If you use it, keep the browser updated and check its release notes for Ironwood before relying on it.

Zafu, Zucchini, Noir and Nozy

Zafu is a Chrome extension for Zcash and Penumbra with client-side proving, cold signing and FROST multisig. ZecHub lists it as Ironwood-ready, but it is a beta with roughly 52 users on its store listing. Zucchini is more widely installed, at about 3,000 users, but supports Sapling only and is not Ironwood-ready; some of its swap routes deliver to a transparent receiver before shielding. Noir and Nozy appear in the ZecHub directory as Ironwood-ready, but we could not confirm basic details such as who runs them or whether the code is open. Small user numbers are not proof of a problem, but they mean few people have tested the code with real money.

LeoDex and ShapeShift

These are web apps built around swapping. LeoDex is a non-custodial aggregator that routes through THORChain, Chainflip, MAYAChain, Relay and NEAR Intents, and can deliver ZEC straight to a shielded address you control. Its fee is 0.45%, falling for very large swaps. Its built-in wallet is listed as Ironwood "Ready (Beta)". ShapeShift added shielded ZEC in October 2025 and made Zcash its default privacy rail in version 4 (December 2025); we could not verify its Ironwood status. Both are useful for getting ZEC into a wallet you already own, which is a safer pattern than keeping it in the web app.

Exchange web apps

Coinbase, Gemini, Kraken and other exchanges let you hold ZEC in a browser tab, but that is an account, not a wallet: the exchange holds the keys. Coinbase accepts deposits from shielded addresses but sends to transparent addresses only. Gemini added unified-address withdrawals in August 2025 and routed them to Orchard from November 2025; how it behaves after Ironwood is unverified. See how to buy Zcash and how to shield ZEC for moving coins off an exchange.

Light-wallet servers: what they learn about you

Almost every Zcash wallet that is not a full node, browser or mobile, gets its data from a light-wallet server: lightwalletd, or its newer Rust replacement Zaino, which runs on a Zebra node. Browser wallets add a gRPC-web proxy in front of it.

Because your wallet decrypts blocks locally, the server does not learn your balance or which shielded notes are yours. It can still see:

• Your IP address, unless you use Tor or a similar network layer.
• When you sync and how often.
• When you broadcast a transaction, since your wallet sends it through the server.

That matters more than usual in 2026. Amounts leaving the old Orchard pool through the Ironwood turnstile are public, so an exposed IP address could be linked to a migration amount. Zodl and Zkool offer Tor, and Zkool also supports Nym. A browser wallet adds another party, the proxy operator, who sees the same metadata. If network privacy matters to you, prefer a wallet that lets you choose the server or route through Tor. Our Orchard to Ironwood guide covers migration privacy in detail.

Phishing sites posing as Zcash web wallets

"Zcash web wallet" is an active scam keyword. Known examples:

• myzodl.com was titled "Zcash Web Wallet (ZEC) - Private Shielded Transactions | Zodl" and asked visitors to restore or import their wallet, which hands the attacker your seed. It was flagged on 8 August 2026 and had gone offline by 11 September 2026 (PhishDestroy). Zodl has no web version; it is a mobile app.
• zcash-foundation.com was registered in October 2025 and flagged as a wallet drainer on 29 October 2025. It was still serving content on 24 October 2026 (PhishDestroy). It is not the Zcash Foundation.
• Several free site-builder pages with names like "auth", "login" or "access" plus "zcash-wallet" have ranked in search results. They show generic wallet text and no real download. We have not seen them collect seeds, so treat them as suspicious rather than confirmed scams.

Copycats appear faster than lists can track them. Type a wallet's official address yourself or use a bookmark, rather than clicking ads or search results. More patterns are in our Zcash scams guide.

Checklist before you use any browser wallet

1. Find it from a trusted directory, such as the wallet lists on z.cash or zechub.wiki, typed into the address bar yourself. Check the extension publisher's name in the store.
2. Never enter a seed on a page you reached from a link, ad, message or search result. Create new wallets inside the extension or app itself.
3. Check Ironwood status. If the wallet is Sapling-only, know that it cannot use the newest pool.
4. Look for an audit and open code. An audited Snap is not the same as audited libraries; read what was actually reviewed.
5. Use a separate browser profile with no other extensions, so a malicious add-on cannot read the page.
6. Start with a small amount and do a test send and restore before you trust it.
7. Write down the recovery phrase and birthday height offline. See restoring a Zcash wallet.
8. Never share a viewing key unless you mean to give permanent read access; it cannot be revoked. See viewing keys.
9. Keep it updated. NU7 is planned for block 3,543,405, around 5 November 2026; developers say it should not significantly affect wallets, but the date could slip.

Our privacy checklist walks through the same points interactively.

What to use instead

Avoid YWallet, which dropped Zcash after Ironwood (its successor is Zkool; see moving from YWallet), and remember that Trezor, Exodus, Trust Wallet and most multi-coin wallets handle transparent ZEC only.

If you already typed your seed into a website

Assume the wallet is compromised. Install a trusted wallet, create a new seed, and send everything you can to the new wallet straight away. Do not restore the old seed anywhere else, and do not pay anyone who offers to "recover" funds; recovery offers are a common second scam.

Frequently asked questions