TL;DR
For most households I’d keep it simple: you control all three keys, one backup sits sealed at a relative’s home, and your partner knows the plan through your inheritance letter. Giving your partner a real signing key makes sense when the savings are shared. Never let one person, or one household, hold two keys.
A 2-of-3 can be set up so that only you can spend, or so that two people have to agree. Both are valid. The question is who you want to be able to move the money, and who you want to be able to get to it if something happens to you. Those aren’t always the same person.
Holding a box versus holding a key
Two roles get mixed up here:
- Keeping a box. A relative stores one of your sealed seed backups in their home, as in where to store three seed backups. They don’t know the details and never use it. You still control everything.
- Being a signer. Someone holds a device with its PIN and takes part in payments. Their approval is one of the two signatures.
Be honest about the first role, though. Whoever keeps a box physically has one key. If you store the passphrase with the seed, as I do, that box is a complete key. One key can’t spend, but it’s half the way there. Pick that person as carefully as a signer.
The usual options
| Setup | Who can spend | Good for | Watch out |
|---|---|---|---|
| All three keys yours, backups in three places | You alone | Your own savings; the guide’s setup | Your family depends entirely on your letter |
| You hold two, partner holds one | You alone; partner can’t spend without you | Partner should be able to help in an emergency | Not a shared account: you can still spend alone |
| You one, partner one, third with a relative | Any two of you | Savings that really are shared | Partner and relative together can spend |
Notice the second row. If you hold two keys, you can spend alone. That’s fine, but call it what it is: your partner has a backup role, not a veto.
Trust trade-offs
- Collusion. Any two key holders together can move everything. Ask of every pair: would I be fine with these two acting without me?
- Pressure. Spreading keys over people makes a forced payment harder: someone threatening one of you gets only one key. The flip side is that you can’t move the coins quickly on your own either.
- One household counts as one place. Two keys in the same home fall to one fire or one burglary, whoever they belong to. Your partner’s key and yours shouldn’t both live at home with their backups.
- Relationships change. If someone who holds a key leaves your life, build a new multisig and move the coins, the same way as when a seed backup was exposed. Asking for a device back doesn’t undo a seed they may have seen.
- Skill. A signer has to be able to unlock a device, read an address on its screen and say no. If your partner wouldn’t feel confident doing that, a backup role suits them better.
What each person needs to know
| Person | Needs to know | Doesn’t need |
|---|---|---|
| You | Everything: where each backup is, PINs, passphrase, the descriptor | — |
| Partner as signer | Their device, its PIN, how to sign and check the screen, where your letter is | The other locations, unless they’re also the one who’ll recover |
| Relative keeping a box | That it matters, that it must stay sealed, and who may collect it | What’s inside, or that it’s bitcoin |
| Heirs | That the letter exists and where | Anything else until it’s needed |
Write the full picture once, on paper, in the sealed letter from bitcoin inheritance with multisig. It’s the only place all locations come together. A partner who’ll handle the recovery should also do the recovery rehearsal with you once, so the first time isn’t the day it counts.
Setting it up with a partner
- Agree on which row of the table you want, and write it down in one sentence.
- Follow the setup guide together. Each signer initializes their own device and writes their own seed by hand, as in step 4.
- Give every box and device a letter, and note who holds which.
- Do the test payment with two different people signing, not just two devices.
- Put a copy of the descriptor in every box, as in step 7. Everyone with a key needs it to recover.
Nobody asks for the words
Not your partner’s “helpful” friend, not a support desk, not a relative “just to be safe”. Seeds go on metal and in boxes, never in a message, a photo or a shared note. Read someone asks for your seed words.
Legal side
Who owns the bitcoin, and what happens to it in a divorce or after a death, depends on your country and your situation. Holding a key doesn’t decide ownership. This isn’t legal advice; for that, talk to a lawyer or notary.
Common mistakes
- Giving two keys to one person “because they’re family”.
- Keeping your partner’s backup in the same house as yours.
- Making someone a signer who has never signed a transaction.
- Not rebuilding the multisig after a key holder leaves your life.