diff --git a/tools/test_webui.py b/tools/test_webui.py
index 4a42641..af205aa 100644
--- a/tools/test_webui.py
+++ b/tools/test_webui.py
@@ -137,16 +137,6 @@ class TestFrontEnd(unittest.TestCase):
         for key in webui.KEYS:
             self.assertIn(f'data-key="{key}"', self.body)
 
-    def test_sends_down_and_up_not_just_tap(self):
-        """Real press duration must come from the browser.
-
-        The firmware distinguishes a short press from a held key at 400 ms, so
-        the front end has to send the two edges separately rather than asking the
-        server for a fixed-length tap.
-        """
-        self.assertIn("send(key, 'down')", self.body)
-        self.assertIn("send(key, 'up')", self.body)
-
     def test_binds_pointer_and_keyboard_input(self):
         self.assertIn("pointerdown", self.body)
         self.assertIn("keydown", self.body)
@@ -207,5 +197,28 @@ class TestHoldMs(unittest.TestCase):
         self.assertEqual(resp.get_json()["hold_ms"], 900)
 
 
+class TestFrontEndHoldMs(unittest.TestCase):
+    """The page must send one request per key, carrying a measured duration."""
+
+    def setUp(self):
+        _, http = make_app()
+        self.body = http.get("/").get_data(as_text=True)
+
+    def test_sends_hold_ms(self):
+        self.assertIn("hold_ms", self.body)
+
+    def test_measures_press_duration_in_the_browser(self):
+        self.assertIn("performance.now()", self.body)
+
+    def test_does_not_send_separate_down_and_up_for_taps(self):
+        """Two requests per key double the latency and break at 400 ms RTT."""
+        self.assertNotIn("send(key, 'down')", self.body)
+        self.assertNotIn("send(key, 'up')", self.body)
+
+    def test_enforces_a_minimum_hold(self):
+        """A very fast click still has to clear the 20 ms debounce."""
+        self.assertIn("MIN_HOLD_MS", self.body)
+
+
 if __name__ == "__main__":
     unittest.main()
diff --git a/tools/webui.py b/tools/webui.py
index 9b2885d..0cbba22 100644
--- a/tools/webui.py
+++ b/tools/webui.py
@@ -218,21 +218,23 @@ def render_index(scale: int) -> str:
     <div class="pad">{grid}</div>
   </div>
   <div id="status">connecting...</div>
-  <p class="hint">Hold a key to send a long press: over 400 ms the firmware
+  <p class="hint">How long you hold a key is measured here and sent as a number,
+  so a slow link cannot turn a tap into a long press. Over 400 ms the firmware
   treats it as held, which is a different event. Arrows move, Enter is MENU,
   Esc is EXIT, digits map straight through. No PTT button -- the keypad model
   has no PTT line.</p>
 </div>
 <script>
 const BINDINGS = {json.dumps(KEY_BINDINGS)};
-const held = new Set();
+const MIN_HOLD_MS = {MIN_HOLD_MS};
+const pressedAt = new Map();
 
-async function send(key, action) {{
+async function sendKey(key, holdMs) {{
   try {{
     await fetch('/api/key', {{
       method: 'POST',
       headers: {{'Content-Type': 'application/json'}},
-      body: JSON.stringify({{key: key, action: action}})
+      body: JSON.stringify({{key: key, hold_ms: Math.round(holdMs)}})
     }});
   }} catch (err) {{
     document.getElementById('status').textContent = 'send failed: ' + err;
@@ -244,18 +246,21 @@ function mark(key, on) {{
     .forEach(el => el.classList.toggle('active', on));
 }}
 
-// Press duration is decided by the browser, not the server.
+// One request per key, carrying the duration as a number. Sending 'down' and
+// 'up' as two requests would put the network round trip inside the press: at
+// 400 ms RTT every tap arrived as a ~407 ms hold, which the firmware dispatches
+// as a held key and MAIN_Key_MENU ignores.
 function down(key) {{
-  if (held.has(key)) return;
-  held.add(key);
+  if (pressedAt.has(key)) return;
+  pressedAt.set(key, performance.now());
   mark(key, true);
-  send(key, 'down');
 }}
 function up(key) {{
-  if (!held.has(key)) return;
-  held.delete(key);
+  const started = pressedAt.get(key);
+  if (started === undefined) return;
+  pressedAt.delete(key);
   mark(key, false);
-  send(key, 'up');
+  sendKey(key, Math.max(performance.now() - started, MIN_HOLD_MS));
 }}
 
 document.querySelectorAll('.key').forEach(btn => {{
@@ -281,7 +286,7 @@ addEventListener('keyup', ev => {{
 }});
 // Release on blur, so losing focus mid-press cannot leave a key stuck down.
 addEventListener('blur', () => {{
-  [...held].forEach(up);
+  [...pressedAt.keys()].forEach(up);
   fetch('/api/release-all', {{method: 'POST'}}).catch(() => {{}});
 }});