In this guide you learn to set up a high security Bitcoin storage system for generational wealth.

Want to go deeper on long-term storage and inheritance? Advanced CoursesPremium.

If you have questions feel free to contact us at: contact@btcguides.de

To support the website scan the QR code to send Sats via ⚡ lightning network: ruddywall05@walletofsatoshi.com

QR code for lightning donation

In the following table you will see that, when it comes to cold wallets, there is a wide range of choices available to the cultivated HODLER.
It is imperative to make a good choice here.

Maximum security should be chosen if avoiding loss is the most important criteria. If ease of use is also important, the less secure options could be considered for smaller percentages of ones wealth.

The best choice is qualified by reigning supreme in the comparison table.

Go deeper on seed security with Advanced: Seed StoragePremium.

A less secure cold wallet with great ease of use features could still be a good choice to replace a hot wallet for daily use.

Having different wallets is also great to introduce the concept of Decoy-Wallets to your security system.

If you just want to use the device without understanding the reason behind using it, you may skip to Stage 1.2

Let's get started!

Take a look at the following table and compare the wallets. Look for the best option as well as one that you might want to use for its features.

First let us talk about the categories you might judge a device on:

Security Features:

Users will evaluate a hardware wallet or signing device on multiple securrity features. Not all of them are of equal importance. Here is a list of features that might be of interest to a user.

• Secure Element (SE) Chip: Protects private keys in tamper-resistant hardware.
• Open-Source Firmware: Allows public auditing for transparency and trust.
• Firmware Signing & Secure Boot: Ensures only verified firmware runs on the device.
• Air-Gapped Operation: Enables signing transactions without network or USB connection.
• Passphrase Support (25th Word): Adds an extra layer of protection to the seed phrase.
• On-Device Transaction Verification: Confirms amount and address on the wallet’s screen before signing.
• Physical Tamper Resistance: Makes it hard to modify or inspect the device unnoticed.
• Secure Backup & Recovery: Offline seed generation, Shamir backup options.
• Multi-Signature Compatibility: Works in multisig setups to distribute trust.
• Supply Chain Protection: Tamper-evident packaging and authenticity checks.

Supported Cryptocurrencies:

If you are a Bitcoin Maxi, ignore this. There is no other technology like Bitcoin. If you plan on using any "cryptos" or "shitcoins" as they are known among experienced Bitcoiners, make sure not to handle them on the same device as you handle your Bitcoin. This introduces complexity and with it more attack-vectors which might be avoided easily if assets were kept seperately. For identifying the best device in this table, a higher amount of points should be awarded to a device, if only Bitcoin is supported.

Ease of Use:

To properly evaluate this category, you should be very clear on what your purpose is. If you are looking to max out on security, then ease of use is not high up on the list. Think of it like a gigantic high security vault in a bank. You'd be laughed out of the house if you said: "Look, security is good and all, but what if we had a door without a lock right next to the big iron door, just so I can get in quicker." Of course the system should not invite mistakes by being extremely complicated to use, but things such as bluetooth options have no place when it comes to putting full focus on security matters. Less is better.
However if you are working on a wallet for a smaller amount of money which you'd like to use on the fly and do not care too much about if it were to be compromised, then go ahead and choose accordingly.

Compatibility:

In our table you can ignore this category, as all of the devices are compatible with the same operating systems. Namely Windows, Linux, and MacOS.

Price:

Considering you are buying to protect your wealth, price should not be a very highly weighted factor. However, the best option is one of the cheapest as well.

Backup and recovery:

In this category you will usually see a seedphrase private-key backup. Which means your private key displayed as a seedphrase is used to backup your private-key and thus your funds. Some devices offer a "backup file" which is just a file that in some form or another holds you private-key. At first you might think "that's great, less to worry about" but that's wrong as it also poses an added attack vector. This backup file is now the target of any attacker that wants your funds. Private-key storage is an important part of being a Bitcoiner. In the previous guide Basic Utility Level 1: Hot Wallets we made two copies of a paper backup and placed them in different places however in this level we will increase our defenses against the elements. This is one of the most important but also fun parts of being a Bitcoiner. You get to be creative in a setting that demands your utmost attention. This will be mentioned again at the end of this guide, so you do not need to do it now.

Community Trust and reputation:

This category is an interesting one. While reputation is a good pointer when it comes to finding a starting point, it ultimately doesn't hold any weight in the evaluation, if the system that is being sold is not air tight.

Ask yourself:

What good is an amazing reputation if there has been one or more data breaches identifying customers?

Is there a CEO who might be pressured to reveal information on the project?

Is there a secure element which upon loss of the device might compromise my private-key?

Am I buying the device from a single company, pre assembled unsure of what is actually in it?

If I'm buying a device like this, am I also identifying myself as a HODLER and also where I hold Bitcoin in?

If I'm buying a device like this, am I also identifying myself as a HODLER and also where I hold Bitcoin in?

Would I be able to source the parts from multiple shops and is the software FULLY FOSS (Free open source software) without any exeptions?

Reputation can be highly affected by marketing campaigns, negatively and positively. What a marketing campaign can not change is what the software and hardware components actually are and we need to look at reality to figure out the best possible path forward.

Additional Features:

More features, more complexity. Keep in mind that every component added to your device is a new component you optimally learn to understand to decide for yourself whether it poses a risk. This is time consuming. Remember that for maximum security bluetooth is generally not a good idea to have, but bluetooth, a touchscreen or ease of use features might come in handy for smaller amounts of money you are willing to expose to a little more risk in exchange for having a smoother experience.

Open Source:

This one is crucial. If a device runs software in which even just a small part is not FOSS, then rate it as a massive security risk and consider the device only for ease of use and small amounts you are willing to expose to more risk than necessary.

Customer Support:

This can be a good thing, depending on how it's implemented. If it involves giving up control of your private key or disclosing personal information like your name or address, then avoid the device. However, if it is a community-driven initiative where users and creators help each other identify and solve issues, then rate it positively.

Firmware Updates:

Firmware updates can be useful, provided they remain transparent and fully open-source (FOSS) in nature. As a general best practice, only update a device like this when you understand the purpose of the update and have determined that it is necessary or sensible. Any downloaded update should also include a way to verify the authenticity of both the manufacturer and the software.

Data Breaches:

Not every data breach means a loss of private-keys, but it does mean an information leak of some sort. This could be customer data, information on the code, which is especially interesting if there is a part of the code that isn't FOSS or information compromising the secure element. Fact is, if there has been a data breach, users have to rely on the company to tell them what happened and then trust nothing else happened. When it comes to security of large sums of money this should ring an alarm bell.

Here's a question to consider:

What is better than using the product of a company that has had no data breaches?

Simple answer:

Using a product where data breaches simply can not happen as there is no company that holds any information on you whatsoever.

In this stage we will order the device parts. This guide assumes you've chosen the Seedsigner.

Here you will have to make a choice again. If you are aiming at best practice only, then you should buy all the parts of the Seedsigner using cash.
The second best option is buying at different online stores while using a VPN to hide your traces.
Another good option would be to have different people buy the parts for you.

If you buy parts online consider using our affiliate links which will help us keep the website running.

For an assembly without soldering, make sure to order a Raspberry Pi with presoldered hammer heads as the one in the link. If it is out of stock, simply order elsewhere.

Here's a shopping list:

• Raspberry Pi Zero
• SD Card 64GB
• Display
• Camera

Assembly: Seedsigner Assembly Only Tutorial

Seedsigner OS (Operating System):

This is the operating system that will run on the Raspberry Pi. This will add all the programs necessary to create private-keys and sign transactions as well as other things, listed on the Seedsigner Github Page. If you'd like to take a deeper dive into what an OS is, here is a list of links with analogies to understand its function.

Analogy 1

Analogy 2

Stage 2.2.1: Download Seedsigner OS

Use the Github page, if it is down, use the second link.

Seedsigner Github Page

Seedsigner website

There are four different Seedsigner OS versions for different Raspberry Pi models. For the Raspberry Pi Zero W you can download either of the marked files, as both Pi models use the same file.

"seedsigner_os.0.8.6.pi0.img" - For Raspberry Pi Zero v1.3 & Raspberry Pi Zero W

Note: the W"H" in the Raspberry model you bought stands for the presoldered hammer head pins. Do not be discouraged by the file name being Zero W.

Stage 2.2.2: Downloading the manifest and signature files

While you are on that website, also download the files marked in red on the picture:

You will use these two files in the next step, when you verify the authenticity of the Seedsigner OS file you downloaded.

Remember: Don't trust, verify.

Verify the software (Seedsigner OS) you downloaded is not malware.

Click here to open the Apple/Mac guide

On Mac

You will need GPG Suite to verify the integrity of the files downloaded. For this you need to have GPG installed.

To check wether GPG is installed:

Step 1: On your mac open the program "terminal".

To open "terminal" type "terminal" into your search bar.

Step 2: Type

gpg --version

- If you see version information (e.g. gpg (GnuPG) 2.4.x), you already have it.
- If you get command not found, continue with the installation steps below.

If it is installed proceed at Step 4.

If it isn't installed go to Step 3.

Step 3:

Go to GPG Suite

Download the latest GPG Suite version, open the .dmg file and follow the installer.

You will have command line tools and a graphical interface for managing keys.

Step 4:

In the terminal type:

cd Downloads/

to navigate into your downloads folder.

Step 5:

Type in:

ls -l

This will list all the files in your download folder. It is recommended, to not have too many files in there so it isn't cluttered.

Step 6:

Type in:

curl https://keybase.io/seedsigner/pgp_keys.asc | gpg --import

This will import the SeedSigner projects public key from the popular online keyserver called Keybase.io into your computers keychain.

Step 7: Verify the file

Type:

gpg --verify seedsigner.0.7.*.sha256.txt.sig

into your console. The terminal should now output the following:

You can ignore the warning message under it since we will now match the fingerprint/ID output against the proofs at Keybase.io/SeedSigner, and thereby confirm who the pubkey really belongs to.

Step 8: Determine who the public key belongs to by going to Keybase.io/SeedSigner

For this you have to manually compare the "primary key fingerprint" output from your terminal to the key displayed on keybase.io/SeedSigner.
The last 16 digits of your output must match exactly with the key.

Once you have confirmed they match exactly you have now confirmed that the .sig file we downloaded is authentically from the SeedSigner project.

Click here to open the Windows guide

On Windows

To verify the download on Windows you must have GPG installed. If it isn't installed already, follow the guide below to do so.

GPG install

To install GPG it is advised to again check the integrity of the software you downloaded.

Step 1: Go to gpg4win.org/download.html

Download:

GPG4win 4.3.1

The version number may vary depending on updates. Make sure the signature file is for the same version as the GPG file itself. See the image if you aren't sure where to click.

Step 2: Verify the given hash using SHA256

To verify the SHA256 hash given below the download button you have multiple options. If you do not want to install any additional programs you can simply use windows powershell. This is the option we will use.

Open windows powershell and type:

Get-FileHash YOUR/FILE/PATH/HERE

Make sure that the YOUR/FILE/PATH/HERE is actually the file path to your downloaded file. It will likely be your Downloads folder.

It is important to have the space after the command and then input the path to your file. You can do this either by typing or dragging and dropping the file into the powershell window, which will automatically fill in the path file for you.
Press enter and you will get a SHA256 hash.

Step 3: Now compare this hash to the one provided under the download button of GPG4win

If they match exactly you know the file is provided by the owner of the site.

Step 4: Install GPG4win

Leave the check marks as they are.

Step 5: Verify Seedsigner OS integrity on windows

Now that you have installed GPG the verification process is simple.

1. Open Powershell and type:

cd downloads

to navigate into your downloads folder. If you have placed the Seedsigner files in another folder, go there.

2. Paste:

gpg --fetch-keys https://keybase.io/seedsigner/pgp_keys.asc

into powershell to get the Seedsigner Projects public key from the keybase.io key server.

3. From inside the same folder run the command

gpg --verify seedsigner.0.7.*.sha256.txt.sig

This should result in you receiving the following output:

The result MUST show "Good signature" for you to proceed safely. If this is not the case, stop here and try again or after confirming multiple times, get the Seedsigner OS from another source, the website might have been compromised.

You can ignore the warning within the output as we will now verify whether the signature fits.

Bonus information about the verify comamnd

The verify command will attempt to decrypt the signature file (sha256.sig) by trying each public key already imported into your computer.

If the public key we just imported (via fetch-keys), manages to:
(a) successfully decrypt the .sig file , and
(b), that result matches exactly to the clear-text equivalent (.sha256) of the .sig file, then its "a good signature"!

Crucially, we must still manually check who exactly owns the Key ID which gave us that "Good signature". Thats what the warning message means- Who does the matching key really belong to?

We will start by looking at keybase.io to see if it is "The SeedSigner project"'s public Key or not.

Note that it is the file hashes of .sig and .sha256 that verify compares, not their raw contents.

4. On the last output line, look at your rightmost 16 characters (the 4 blocks of 4). We must now check who that Primary key fingerprint /ID belongs to.

The underlined Primary Key Fingerprint in the example output above is: C7EF 7090 0726 0119

5. Now you have to manually compare the primary key fingerprint output from your terminal to the key displayed on keybase.io/SeedSigner. The last 16 digits of your output must match exactly with the key.

Go to Keybase.io/SeedSigner

Once you have confirmed they match exactly you have now confirmed that the .sig file we downloaded is authentically from the SeedSigner project.

A wallet software allows you to view the contents of your private-key. Understand a wallet like a control room outside the vault where you store your wealth. There are multiple possible setups and clearances this control room could have. Some are allowed to view the private-key, some aren't. We will talk about UTXO management in another post.

Stage 3.1: Download and verification for Sparrow Wallet on Windows

Click to open Windows Guide (Stage 3.1)

Step 1.

Download the Sparrow Wallet "Windows Installer (10+)" file from:

sparrowwallet.com.

Step 2.

From the same page download the files "Manifest Signature" and "Manifest".

Step 3.

Open Power Shell and type

cd downloads

or whatever location you saved your files to.

Step 4.

Type

ls

to list all the files in said location.

Step 5.

Type:

Get-FileHash

(the space after the "Get-FileHash" command is important!)

Either type the path to your file in or drag and drop your file into power shell. This will result in

Get-FileHash pathname

The file is called "Sparrow-2.1.3" or one with varying numbers at the end. Simply choose the one you downloaded.

Press enter to run the command.

Step 6.

Now compare the hash output to the hash in the "Manifest" text document. For this you will have to look at the hash corresponding to the exact Sparrow Wallet file you downloaded. In this tutorial it is "Sparrow-2.1.3" and is an .exe file.

Step 7.

Either manually compare the hashes by eye or do so through a utility program such as MD5 & SHA Checksum Utility 2.1.

Step 8.

Next you will compare the public key of the creator to the files you downloaded. For this type

gpg --fetch-keys https://keybase.io/craigraw/pgp_keys.asc

in Power Shell.

The result should look like this:

PS C:\Users\"yourusername"\Downloads> gpg --fetch-keys https://keybase.io/craigraw/pgp_keys.asc
        gpg: requesting key from 'https://keybase.io/craigraw/pgp_keys.asc'
        gpg: key E94618334C674B40: public key "Craig Raw " imported
        gpg: Total number processed: 1
        gpg:               imported: 1

Step 9.

Now type

gpg --verify sparrow-2.1.3-manifest.txt.asc

The result should look like this (version number varies depending on update what is now 2.1.3 used to be 1.9.0):

PS C:\Users\danie\Downloads> gpg --verify sparrow-1.9.0-manifest.txt.asc
        gpg: assuming signed data in 'sparrow-1.9.0-manifest.txt'
        gpg: Signature made 04/25/24 16:49:44 W. Europe Daylight Time
        gpg:                using RSA key D4D0D3202FC06849A257B38DE94618334C674B40
        gpg: Good signature from "Craig Raw " [unknown]
        gpg: WARNING: This key is not certified with a trusted signature!
        gpg:          There is no indication that the signature belongs to the owner.
        Primary key fingerprint: D4D0 D320 2FC0 6849 A257  B38D E946 1833 4C67 4B40

The result must display "Good signature". Ignore any email addresses - only matching Key fingerprints count here. Stop immediately if it displays "Bad signature"!

Step 10.

On the last output line, look at your rightmost 16 characters (the 4 blocks of 4). Crucially, we must now check WHO that Primary key fingerprint/ID belongs to. We will start by looking at Keybase.io to see if it is the SeedSigner project 's public key or not.

More info on the warning:

Since you are about to match the outputted fingerprint/ID against the proofs at Keybase.io/SeedSigner, and thereby confirm who the pubkey really belongs to-, you can safely ignore this warning message:

         WARNING: This key is not certified with a trusted signature!
         There is no indication that the signature belongs to the owner.
        

Skippable info on the "verify" command:

The verify command will attempt to decrypt the signature file (sha256.sig) by trying each public key already imported into your computer. If the public key we just imported (via fetch-keys), manages to: (a) successfully decrypt the .sig file , and (b), that result matches exactly to the clear-text equivalent (.sha256) of the .sig file, then its "a good signature"!

Crucially, we must still manually check who exactly owns the Key ID which gave us that "Good signature". Thats what the warning message means- Who does the matching key really belong to? We will start by looking at keybase.io to see if it is "The SeedSigner project"'s public Key or not. Note that it is the file hashes of .sig and .sha256 that verify compares, not their raw contents.

Step 11.

Determine who the public key belongs to by going to Keybase.io/craigraw

For this you have to manually compare the "primary key fingerprint" output from your terminal to the key displayed on keybase.io/SeedSigner. The last 16 digits of your output must match exactly with the key.

Once you have confirmed they match exactly you have now confirmed that the .sig file we downloaded is authentically from the craigraw/thesparrowwallet team.

Step 12.

Open the file location where you saved Sparrow Wallet to and run the .exe as administrator by left clicking and choosing "run as administrator" to install.

Stage 3.2: Download and verification for Sparrow Wallet on Mac

Click to open Mac Guide (Stage 3.2)

Step 1.

Depending on your Mac, Download the Sparrow Wallet "macOS (Intel) (11+)" or the "macOS (Apple M-series)" file from:

sparrowwallet.com.

Step 2.

From the same page download the files "Manifest Signature" and "Manifest".

Step 3.

In the Mac search type "terminal" and open it.

In the terminal type:

cd ~cd /Downloads

This navigates you to the Downloads folder, where the files you downloaded should be, unless you chose a different location.

Step 4.

Type:

ls

This will list all files in the directory you are in.

Step 5.

Type:

shasum -a 256 /path/to/your/file

You can either type your file path or drag and drop the file into terminal, which will write out the file path for you.

Step 6.

Now compare the hash output to the hash in the "sparrow-2.2.3-manifest.txt" text document by opening it.

Look at the hash corresponding to the exact Sparrow Wallet file you downloaded. In this tutorial it is "Sparrow-2.2.3" and is an .exe file.

Step 7.

Either manually compare the hashes by eye or do so through a utility program such as MD5 & SHA Checksum Utility 2.1.

Step 8.

Next you will compare the public key of the creator to the files you downloaded. For this type "curl -0 https://keybase.io/craigraw/pgp_keys.asc gpg --import pgp_keys.asc" in the terminal.

THe result should look like this:

Step 9.

Now type:

gpg --verify sparrow-2.1.3-manifest.txt.asc

The result should look like this (version number varies depending on update what is now 2.2.3 used to be 1.9.0):

PS C:\Users\danie\Downloads> gpg --verify sparrow-1.9.0-manifest.txt.asc
        gpg: assuming signed data in 'sparrow-1.9.0-manifest.txt'
        gpg: Signature made 04/25/24 16:49:44 W. Europe Daylight Time
        gpg:                using RSA key D4D0D3202FC06849A257B38DE94618334C674B40
        gpg: Good signature from "Craig Raw " [unknown]
        gpg: WARNING: This key is not certified with a trusted signature!
        gpg:          There is no indication that the signature belongs to the owner.
        Primary key fingerprint: D4D0 D320 2FC0 6849 A257  B38D E946 1833 4C67 4B40

The result must display "Good signature". Ignore any email addresses - only matching Key fingerprints count here. Stop immediately if it displays "Bad signature"!

Step 10.

On the last output line, look at your rightmost 16 characters (the 4 blocks of 4). Crucially, we must now check WHO that Primary key fingerprint/ID belongs to. We will start by looking at Keybase.io to see if it is the SeedSigner project 's public key or not.

More info on the warning:

Since you are about to match the outputted fingerprint/ID against the proofs at Keybase.io/SeedSigner, and thereby confirm who the pubkey really belongs to-, you can safely ignore this warning message:

         WARNING: This key is not certified with a trusted signature!
         There is no indication that the signature belongs to the owner.
        

Skippable info on the "verify" command:

The verify command will attempt to decrypt the signature file (sha256.sig) by trying each public key already imported into your computer. If the public key we just imported (via fetch-keys), manages to: (a) successfully decrypt the .sig file , and (b), that result matches exactly to the clear-text equivalent (.sha256) of the .sig file, then its "a good signature"!

Crucially, we must still manually check who exactly owns the Key ID which gave us that "Good signature". Thats what the warning message means- Who does the matching key really belong to? We will start by looking at keybase.io to see if it is "The SeedSigner project"'s public Key or not. Note that it is the file hashes of .sig and .sha256 that verify compares, not their raw contents.

Step 11.

Determine who the public key belongs to by going to Keybase.io/craigraw

For this you have to manually compare the "primary key fingerprint" output from your terminal to the key displayed on keybase.io/SeedSigner. The last 16 digits of your output must match exactly with the key.

Once you have confirmed they match exactly you have now confirmed that the .sig file we downloaded is authentically from the craigraw/thesparrowwallet team.

Step 12.

Open the file location where you saved Sparrow Wallet to and double click the .dmg file to install Sparrow Wallet.

Make your own secret private-key in the form of a QR code and a seedphrase

To create a private-key we need entropy or to put it simply: randomness.

The Seedsigner gives you a few options here. You could have the device take a picture and use the randomness in it to create a private key, or you could use dice or a coin to create your very own entropy taken directly from the universe.

Picture Method

Dice/Coin Method

For the picture key creation you start up the Seedsigner by plugging it into a powerbank. Then navigate to "🔧 Tools" and choose "📷 New seed". Proceed from there and make sure to note the Seedphrase and fingerprint down diligently. If you want to add a 25th word as a password, you can.

You might choose to skip ahead to Stage 4.2: Backing up the private key as a seedphrase or QR code

We recommend creating your own entropy in keeping with the Bitcoin principle of reducing trust in third parties.

Stage 4.1.1: Creating your own entropy using a coin or dice

This will take some time. You will flip a coin, or roll dice 256 times.

Step 1:

Make sure there are no cameras or microphones around.

Step 2:

Get:

• paper
• pen
• dice or coin

As for the paper you can also download and print this PDF template we prepared and write your digits in the binary rows.

Step 3:

Learn the rules

1. For the coin: consider heads an output of 0 and tails an output of 1. You could also do it the other way around but you have to decide which way and stick to it.

2. For the dice: consider the numbers 1,2,3 to have an output of 0 and 4,5,6 an output of 1.

3. Decide whether you write and read from right to left or vice versa.

4. You must maintain consistency with the ruleset you decided beforehand.

5. You must make 23 lines of 11 digits. The 24th line will only need 3 digits.

6. For each line, clump digits into groups of 4-4-3 (see image below) for easy reading and calculating. Keep your vertical columns aligned as much as possible and leave space between each row for manual calculations.

Step 4: Start the process

1. Flip the coin or roll the dice

2. Write down the result in your first row

3. Keep flipping and writing to finish your first row in groups of 4, 4 and 3 digits.

4. Make 23 rows and then write down another three digits for row 24.

There are 256 binary digits here — 23 complete sets of 11 binary digits with the 24th row only needing three binary digits.

This will make sense later. For now, understand that every 11 binary digits will be translated to a mnemonic seed word and eventually result in a mnemonic seedphrase.

A note on randomness:

As explained in the article DIY Bitcoin Private Key Project by Arman The Parman from Bitcoin Magazine, a private key generated with all-zero entropy once matched an existing wallet, showing how dangerous bad randomness can be.

"You can make these 256 bits of random data any way you want, as long as it’s actually random. If it’s not random, someone might be able to reproduce the data. They would then be able to recreate your private key and could take all of your bitcoin. For example, if you make 256 bits of all zeroes (clearly not random), then someone will be able to guess your private key. Here’s proof: I generated a private key from that terrible all-zeroes randomness and found someone’s existing wallet. If it hadn’t already been emptied, I could have stolen the funds.

Here's proof: I generated a private key from that terrible all-zeroes randomness and found someone's existing wallet. If it hadn't already been emptied, I could have stolen the funds.

They clearly knew what they were doing because it was a small amount and they didn’t leave any coins there for long. It might have been a demonstration, who knows. But other people have made non-random private keys that were guessable and as a result lost their bitcoin. But don’t worry, if you make a truly random private key, someone would have to exactly repeat your binary dice rolls or coin flips and, thanks to exponential math, that’s not going to happen during the life of the universe."

Quote from Bitcoin Magazine, published April 2021: "DIY Bitcoin Private Key Project"

Stage 4.1.2: Converting our binary digit entropy to decimal

In binary, there are only two digits: 1s and 0s. Each 1 or 0 is called a bit, which is one piece of information. This is the smallest unit of information in computing.

In binary, a set of eleven bits could look like the first one from our example above:

0110 1111 101

and can be converted to a decimal number by multiplying each bit with powers of two descending from 2¹⁰, 2⁹,...,2⁰ and then adding the result up.

(2¹⁰ x 0) + (2⁹ x 1) + (2⁸ x 1) + (2⁷ x 0) + (2⁶ x 1) + (2⁵ x 1) + (2⁴ x 1) + (2³ x 1) + (2² x 1) + (2¹ x 0)+ (2⁰ x 1) = 1833

Decimals are easier to handle than powers of two.

So we will use decimals from here.

The table below shows which decimal can represent which power of two.

We can now take our group of eleven binary digits and multiply them by the decimals from our table above.

1024 x 0 + 512 x 1 + 256 x 1 + 128 x 0 + 64 x 1 + 32 x 1 + 16 x 1 + 8 x 1 + 4 x 1 + 2 x 0 + 1 x 1 = 893

Do this calculation for all of your 23 rows, do so carefully and then double check for errors by recalculating a second time. You can either do this on a sheet of paper you design or download the two PDF files we made. PDF 1 and PDF 2. Below you see part of the table in the PDF and each field explained.

Stage 4.1.3: Matching the decimals to the Bitcoin Wordlist (BIP39)

Warning: Do not use a phone or even have a phone in the room. You can use this PDF cheatsheet to make adding up the decimals faster.

A group of eleven bits (from the highest place value 2¹⁰ down to 2⁰) can represent decimal numbers from 0 up to 2047. Because of this there is the +1 cell in the table, before we get our word, as the wordlist starts from 1-2048 not from 0-2047 and therefore does not have a word corresponding to the result 0.

It is recommended to view this on desktop for more visual clarity.

You can always find the word list here on Github and multiple other pages simply by searching the Bitcoin Wordlist.

Stage 4.1.4: Creating the checksum for row 24 using Seedsigner

After calculating the words for our first 23 rows we now need eight more bits to have enough bits for the 24. row and finish our seed phrase. The last eight bits are called the checksum. We will create this checksum using the Seedsigner we assembled.

For this start up the seedsigner and go to "Tools", then choose "Calc 12th/24th word", then choose "24 words" (or 12, if you made a shorter Seedphrase) and type in the 23 words you have.

Once you have input your 23 words, the Seedsigner will ask you how you want to create the last word. You will choose "Coin flip entropy" and input the last 3 digits from your entropy (1s and 0s of row 24).

In the next screen the Seedsigner will show your input again, so you can confirm you didn't make a mistake. Now you will see your checksum as well as your final word. In the image there are seven digits, for us it will be three.

In the next screen you will see your 24th word as well as a fingerprint. Write them both down on your paper. Double check, so it is definitely correct.

In the next screen, the fingerprint is shown again. You should confirm that you wrote it down without any errors.

Now you can either click "Done" to finish the process or add a BIP-39 Passphrase which will add more complexity and security to your setup. You can treat it as the 25. word. Keep in mind that it also poses another threat for human error on your part.

Adding a passphrase in your Seedsigner after having input the 24 words of the mnemonic phrase will results in the creation of a completely new wallet. This means the 24 words are NOT the same wallet as the 24 words + the passphrase. All addresses will be different. Keep this in mind during your setup and when sending BTC.

Stage 4.2: Backing up the private key as a seedphrase or QR code

With your private key loaded in the Seedsigner you can now choose to back up your seed by clicking "Backup Seed" and viewing the Seed Words or Exporting them as a SeedQR (QR Code). This way it can more easily be scanned by Seedsigner later on.

This is useful but not recommended for your deepest cold storage and more suitable for a wallet which you want to send money away from regularly.

You can click on "View Seed Words" to confirm once more that you wrote the words down correctly.

Find the templates at https://github.com/SeedSigner#seedqr-printable-templates, choose the size you prefer. Make sure it matches an option on the Seedsigner and then print it.

To test the QR code, restart the Seedsigner and scan the QR code to see whether the private-key words and the fingerprint match what you wrote down before.

If they match you successfully created your private-key QR code for quick access via Seedsigner.

Remember the Seedsigner is a stateless device. This means whenever you want to sign a transaction you will have to input your private key again. This can be cumbersome when using 24 words.

Choose your backup strategy wisely and balance between accessibility and safety, considering how often you will need to do transaction from this wallet.

Want a full backup architecture? See Advanced: Seed StoragePremium.

A watch-only wallet can be understood as a gigantic window of armored glass which is break-in proof but lets you see the contents of your vault. We are doing this to be able to keep sending to our vault and checking whether our BTC arrives.

Considering the amount of effort we went through to create this setup, the funds we are trying to protect must be significant to us. Keep thinking in percentages of your wealth. Decide on a percentage you wouldn't be willing to lose and would want to do your utmost to protect and place them in your new setup. This setup is not for ease of use or for quick day to day transactions but instead for big moves only. Think buying a car, house or any other big aquisition.

Planning for family access? Advanced: Inheritance SystemPremium.

For more privacy you should build your own Node. If you have done our courses in succession, you have a Node. If you do not own a viable computer, the material cost is between 150€-200€ (year 2025) and highly recommended. If you do not have your own Node you will expose your transaction history to whichever strangers Node you use.

Stage 5.1: Connect Sparrow Wallet to your Bitcoin Node

Step 1:

In Sparrow Wallet, go to "Preferences"

Step 2:

Go to the server tab and click "📝 Edit Existing Connection"

Step 3:

Click on "Private Electrum" and input the IP Address of your Node in the indicated URL field. Next you click on "❔ Test Connection" to see if you can connect to your node.

Step 4:

The result should be positive and display the welcome message of your Electrum server. Version numbers may vary.

Stage 5.2: Create the watch only wallet

Text based guide:

Take note, that you can either click on "Airgapped Hardware Wallet" and choose the Seedsigner device or choose the "Watch Only Wallet", both will result in your private key not being stored on the computer.

Step 1:

Open Sparrow Wallet and go to "File". Click on "New Wallet" and choose a name for the wallet.

Step 2:

Write down the Descriptor diligently. Next you click on "👁 xPub / Watch Only Wallet"

Step 4:

Turn on the Seedsigner, scan your private-key and go to "export xpub as QR".

Step 5:

In Sparrow wallet click on the camera symbol which will activate your computer's camera.

Step 6:

With the computer's camera scan the QR code output on the Seedsigner. Make sure this is the xpub QR code option and not your secret private-key!

This will import a Master fingerprint, derivation path and the xpub.

Step 7:

Take note of the derivation path and the master fingerprint.

Stage 5.3: Testing the wallet

Stage 5.3.1: Test receive

Now we will test whether we can receive BTC. This should be a very small amount which you would be ok with losing if something were to go wrong. If you followed the steps carefully and noted down your private key correctly, there should not be any issue.

After we received some BTC we will be able to test whether we can also send it out again. This will confirm that the BTC we send to the watch only wallet is not stuck and therefore lost.

Step 1:

From wherever you hold your current Bitcoin stack, you will send a small amount of money to your new wallet.

On the left side of the wallet interface click on "🢃 Receive".

Step 2:

Scan the QR code displayed in Sparrow Wallet or manually type in the address to the device you hold your Bitcoin on currently. Make sure there are no mistakes. It is always good to double check manually even when scanning a QR code or copy pasting.

Step 3:

Send a small amount of Bitcoin to the address. If there is an option to set the sats/vb(the transaction fee amount) yourself. Make sure it isn't too low to make it into the block and therefore arrive at your address. To check whether your are in the minimum required range of sats/vb go to mempool.space. There you will see "No Priority", "Low Priority", "Medium Priority" and "High Priority". Make sure not to put a sat amount that is in the "No Priority" range.

Step 4:

Wait for a notification in Sparrow Wallet that your transaction has been broadcast and received.

You will then see whether the transaction has also been confirmed. This is important, as an unconfirmed transaction is not usable.

Once you have received the BTC as indicated by the confirmations, you can move on to testing whether you can also recover and send it.

Stage 5.3.2: Wallet - Test recovery

Now that a small amount of BTC is in your wallet, it will be very simple to test whether you can recover the wallet.

Step 1:

Close the Sparrow wallet and turn your Seedsigner off.

Step 2:

Turn the Seedsigner back on and either scan your Private-Key QR code if you made one or input your Private-Key into the Seedsigner again.

Step 3:

In Seedsigner output the xpub (Public-Key) as QR and scan it with Sparrow Wallet

If your wallet shows up with the same fingerprint, addresses and BTC amount, you have successfully confirmed your ability to recover your wallet.

Stage 5.3.3: Wallet - Test send

Step 1: Create a test Transaction

On the left sidebar click on "Send"

Step 2:

Enter the recipient's BTC address in the "Pay to" field. Make sure to double check the address for mistakes.

Step 3:

Add a label for this transaction for easier tracking

Step 4:

Enter a small amount of BTC, since this is to test whether everything works.

Step 5: Set the Transaction Fee

Sparrow Wallet allows you to set the transaction fee (sats/vB). Choose an appropriate fee based on the current network conditions. You can check mempool.space for the latest fee recommendations or let Sparrow Wallet set a fee by using the slider.

Step 6: Review and Create the Unsigned Transaction

Once reviewed, click on "Create Transaction". This will create an unsigned transaction.

Sparrow Wallet will display the unsigned transaction details.

Step 7: Export the Unsigned Transaction

Click on "Export PSBT" (Partially Signed Bitcoin Transaction).

Choose "QR Code" as the export method.

Sparrow Wallet will display a QR code representing the unsigned transaction.

Step 8: Sign the Transaction with SeedSigner

Turn on your SeedSigner device.

Navigate to the "Scan QR" option on your SeedSigner.

Use the SeedSigner camera to scan the unsigned transaction QR code from Sparrow Wallet.

SeedSigner will prompt you to sign the transaction. Confirm the details on the SeedSigner screen.

SeedSigner will then display a QR code of the signed transaction.

Step 9: Import the Signed Transaction into Sparrow Wallet

In Sparrow Wallet, click on "Scan QR" to import the signed transaction.

Use your computer's camera to scan the QR code displayed on the SeedSigner.

Step 10: Broadcast the Signed Transaction

Once the signed transaction is imported into Sparrow Wallet, review the transaction details again to ensure everything is correct.

Click on "Broadcast Transaction" to send the signed transaction to the Bitcoin network.

Step 11: Wait for Confirmation

Sparrow Wallet will notify you once the transaction is broadcast.

You can track the status of your transaction in the "Transactions" tab of your wallet.

Wait for the transaction to be confirmed by the network.

Step 12: Avoiding Dust

If everything went well, send a larger amount or the full amount, depending on your preference to the same address. This is to avoid creating dust which are amounts of Bitcoin that are so low that the transaction cost to send them would be higher than the amount itself therefore making them unspendable. This is a problem we will be faced with as transaction fees rise. Your aim should be to optimally have no utxo smaller than 0.005 BTC or 500.000 sats. If it is not feasible due to your current financial situation, aim for 0.002 BTC or 200.000sats.

Tips for Secure Usage:

• Double-check all addresses and amounts before signing transactions
• Never share your private keys
• Have a comprehensive seed storage strategy

By following these steps, you can securely send BTC using a watch-only wallet in Sparrow Wallet with a SeedSigner.

Click here to go to the next guide: 4. Acquiring Bitcoin

Ready to go deeper? Advanced CoursesPremium.