Security alert · Oct 9, 2026: Ledger devices bought from a reseller in Southeast Asia were drained. Buy hardware wallets only from the maker. What to do →

Multisig Setup

Checklist

SeedSigner multisig with Sparrow: a stateless signer

Last reviewed: October 2026

TL;DR

SeedSigner is a do-it-yourself signing device built from a Raspberry Pi Zero, a small screen and a camera. It stores nothing: you load the seed every time you sign, it talks to Sparrow only by QR code, and it forgets everything when you pull the power. It can be one key in a 2-of-3, and it can check multisig addresses once you scan your wallet descriptor into it.

I haven’t used a SeedSigner myself. This page follows the SeedSigner project’s own documentation and source code (version 0.8.7) and Sparrow’s, checked October 10, 2026.

What SeedSigner is

An open-source project (MIT license) that turns cheap, generic parts into an air-gapped bitcoin signer. The project describes the goal as making multisig cheaper and simpler. A few things make it different from the devices in the setup guide:

  • Stateless. Seeds live only in memory while it’s powered. The project says all memory is wiped when power is removed, and the microSD card can be taken out after boot, so nothing secret can be written to it.
  • No PIN, no secure element. There’s nothing on the device to protect. The secret is your seed backup, and you bring it out each time.
  • QR only. It reads Sparrow’s screen with its camera and shows its answers as QR codes. No USB data connection.
  • SeedQR. It can show your seed as a QR code that you copy by hand onto a paper grid. Scanning that grid loads the seed in seconds instead of entering 24 words with a tiny joystick.

In a 2-of-3 it replaces one of the three devices, like a Jade or Keystone would. Its code has nothing in common with Trezor, BitBox or Ledger, which is what you want from three brands.

What you need

  • A Raspberry Pi Zero. The project prefers version 1.3, which has no Wi-Fi or Bluetooth; other Zero, 2, 3 and 4 models also work.
  • A Waveshare 1.3-inch LCD HAT with 240×240 pixels. The project stresses the pixel count: other versions look the same.
  • A Pi Zero camera with an OV5647 sensor, and 40 header pins (soldered, or solderless “hammer” headers).
  • A microSD card (64 MB or larger) and a USB power source. A 3D-printed case is optional.
  • Your signing computer from step 2, with Gpg4win and Raspberry Pi Imager (or Balena Etcher), and Sparrow with a working webcam (step 3).
  • A regular six-sided die if you want to make the seed with dice.

The project says the parts cost under $50. They’re generic electronics; there’s no SeedSigner shop and no affiliate link here. Ready-built SeedSigners are sold by third parties. I’d build it yourself: a pre-assembled signer from a stranger is the kind of supply-chain risk this site warns about (supply chain attacks).

Steps

1. Verify and flash the software

  1. Go to the SeedSigner releases page on GitHub (github.com/SeedSigner/seedsigner, type it yourself). Download the image for your board (pi0.img for a Pi Zero 1.3 or Zero W), plus seedsigner.0.8.7.sha256.txt and its .sig file.
  2. Check the signature and the hash before you open or mount the image. The project warns that some systems change the file when mounted.
  3. Write the image to the microSD card with Raspberry Pi Imager or Balena Etcher. Put the card in the SeedSigner and power it up; boot can take up to a minute.
gpg --fetch-keys https://keybase.io/seedsigner/pgp_keys.asc
gpg --verify seedsigner.0.8.7.sha256.txt.sig
CertUtil -hashfile seedsigner_os.0.8.7.pi0.img SHA256

You want “Good signature”. The README says to compare the last 16 characters of the key fingerprint with the one shown at keybase.io/seedsigner. Also compare it with the fingerprint published on the SeedSigner project’s GitHub page, so you have two independent sources. Then compare the CertUtil result with the line for your image in the .sha256.txt file. Any mismatch: stop.

2. Create the seed

  1. Under Tools, create a new seed. With dice, SeedSigner asks for 99 rolls for 24 words. Roll a real die, in private, and enter every roll. Never use a dice app on a phone. The camera (image entropy) is the other option.
  2. Write the 24 words on paper, never in a photo or a file, and later on metal (step 5).
  3. If you want a SeedQR, choose Export as SeedQR and copy the grid by hand. SeedSigner then scans your copy to confirm it matches. Never print or photograph it.

3. Add it to the wallet in Sparrow

  1. On the SeedSigner: Seeds → your seed → Export Xpub → Multisig → Native Segwit, then the QR format (Animated is the default).
  2. In Sparrow, in one of the three keystore tabs of step 6, click Airgapped Hardware Wallet, find SeedSigner and click Scan. Hold the SeedSigner in front of the webcam.
  3. Check that the derivation path reads m/48’/0’/0’/2′ and write down the master fingerprint next to the device letter.

4. Check an address

A SeedSigner can’t remember your multisig, so you give it the wallet each session.

  1. In Sparrow, open the wallet’s Settings tab, click Export, choose Output Descriptor and show the QR code.
  2. On the SeedSigner, go to Tools → Address explorer → Scan wallet descriptor. It shows the policy (2 of 3) and the three fingerprints. Compare every fingerprint with your notes. One you don’t recognize means stop.
  3. Compare the receive addresses it lists with Sparrow’s, every character, as in step 8. You can also scan an address QR from Sparrow’s Receive tab; for a multisig it asks for the descriptor first.

5. Sign

  1. In Sparrow, click Finalize Transaction for Signing, then Show QR.
  2. On the SeedSigner choose Scan, scan the transaction, then load the seed from your SeedQR or by entering the words on the device.
  3. Check the amount, address and fee. For the change, choose Verify multisig change and scan the descriptor, unless it’s already loaded. Then Approve transaction.
  4. The SeedSigner shows the signed transaction as a QR code; click Scan QR in Sparrow to read it back. Start with a small amount (step 9).
  5. Pull the power when you’re done. That wipes the seed from memory.

Risks to weigh

  • Your seed comes out every time you sign. With the other devices the backup stays in its box. Here, the SeedQR or the words are on your desk at each signing. Anyone who sees or copies them has that key.
  • A SeedQR is a second copy of the seed. Keep it with that key’s metal backup, not with the SeedSigner, and protect it the same way (where to store seed backups).
  • Dice need care. A biased die, a skipped roll or rolls someone else saw weaken the seed. The July 2026 Coldcard incident showed what weak randomness costs.
  • DIY hardware. The parts are generic, which makes a targeted attack harder, but you’re the one checking the software and the build.
  • No address check without the descriptor. Skip scanning it and the SeedSigner can’t tell your change address from someone else’s.

Common mistakes

  • Flashing an image without checking the signature and hash.
  • Exporting the single-sig xpub instead of Multisig, Native Segwit.
  • Accepting a descriptor without comparing the fingerprints.
  • Storing the SeedQR card next to the device.
  • Taking a photo of the SeedQR “as a backup”.

Related