PGP before password — non-negotiable

If a page wants your password before you can check a canary, leave.

Clone operators reverse the order on purpose: login form first, “verification later.”

Rule

Phrase / canary first. Password second. Wallet seeds never.

2026-07-10