Security alert · Oct 9, 2026: Ledger devices bought from a reseller in Southeast Asia were drained. Buy hardware wallets only from the maker. What to do →

Multisig Setup

Checklist

Trezor multisig with Sparrow: setup and quirks

Last reviewed: October 2026

TL;DR

The Trezor Safe 5 works well as one key in a Sparrow multisig, over USB, with no extra software. Two things matter. At setup, pick the 24-word backup instead of the 20-word default. And remember that it doesn’t store your multisig: Sparrow sends the whole setup every time, so the Trezor’s address check is an extra check, not the one you rely on.

What the Trezor does in this setup

In my 2-of-3 the Trezor Safe 5 is one of three keys, next to a BitBox02 and a Ledger Nano S Plus. I picked it for its screen: it shows a whole multisig address at once, which makes comparing it with Sparrow easy. The Trezor Safe 5 review has the rest of my view on the device.

What makes the Trezor different from the other two is that it has no memory for your multisig. You can see this in Trezor’s own communication protocol: every request to show an address or sign a transaction carries a field with the full multisig setup (the other keys and the 2-of-3 rule). Sparrow fills that field each time, and the Trezor works with whatever it receives. There’s nothing to register and nothing to remove later.

That’s convenient, but it limits what the Trezor can prove. More on that under address checks below.

What you need

  • A Trezor Safe 5 initialized with a 24-word backup (step 4), firmware updated through Trezor Suite
  • Your signing computer with Sparrow installed and verified (step 3)
  • Trezor Suite closed while you use Sparrow. Only one app can talk to the device at a time

Settings to get right

Backup: 24 words, not 20

Trezor’s own documentation lists a 20-word single-share backup as the default for the Safe 5 (and for the Safe 3 since June 2024). That’s SLIP39, a standard your BitBox02 and Ledger can’t restore. Before you create the wallet, open the backup options and choose the legacy 24-word backup. You can’t convert it later; you’d have to start over with a new wallet and move the funds.

Passphrase (optional)

If you use a passphrase, switch it on in Trezor Suite under Settings → Device → Passphrase. It’s off by default and can be up to 50 ASCII characters. That’s why the guide keeps the shared passphrase within 50 characters.

One quirk to know: with Sparrow, you type the Trezor passphrase on the computer, not on the touchscreen. Sparrow shows the device as Passphrase Required. Click Set Passphrase, type it, click Send Passphrase and confirm on the Trezor. The passphrase passes through the signing computer each time, which is one more reason to use a dedicated laptop that does nothing else (step 2).

Steps

  1. In the new multisig wallet in Sparrow (step 6), open a keystore tab and click Connected Hardware Wallet. If Sparrow doesn’t find the Trezor on Windows, Sparrow’s FAQ describes a driver fix with Zadig.
  2. Unlock the Trezor with its PIN. Using a passphrase? Send it as described above.
  3. Click Import Keystore and confirm on the device. Check that the derivation path reads m/48’/0’/0’/2′ and that the master fingerprint matches what you wrote down for this device.
  4. After the wallet is finished and the descriptor is backed up (step 7), open the Receive tab and click Display Address. The Trezor first warns that you’re receiving to a multisig address, then shows the full address with a label like “Multisig 2 of 3”. Compare every character.
  5. To sign (step 9), click Sign in Sparrow with the Trezor connected and unlocked. Check the address and amount on the screen before you confirm.

Address checks: what the Trezor can and can’t prove

When the Trezor shows an address, it calculates it from its own key plus the two other public keys Sparrow sent along. So a match proves the address fits that setup. It doesn’t prove the setup is yours. A compromised computer could send a setup with an attacker’s key in place of one of yours, and the Trezor would happily show an address that matches the fake one.

The Trezor can show the three public keys of the setup it received, so in theory you could compare them with your descriptor backup. In practice that’s 111 characters per key on a small screen. The stronger check is a device that has your multisig registered: the BitBox02 or the Ledger. That’s how step 8 uses them, with the Trezor as an extra check.

Different address? Don’t send

If the Trezor, Sparrow and your registered devices don’t agree, don’t send anything to any of them. Start with receive address doesn’t match the device screen.

Trezor Safe 3 and Model T

The multisig field is part of Trezor’s shared protocol, so the Safe 3 and the Model T also work without registration, and the same limits apply to their address checks. I haven’t used either in this setup myself. Check the backup type: Trezor lists the 20-word SLIP39 backup as the default on a Safe 3 set up from June 2024, and a 12-word backup as the default on the Model T. Both support a 24-word BIP39 backup, which is what I’d pick so all three keys match (12 or 24 words).

Common mistakes

  • Accepting the 20-word default backup. Your other two devices can’t restore it.
  • Leaving Trezor Suite open, so Sparrow can’t find the device.
  • Treating a matching address on the Trezor as proof. It only proves the address matches what the computer sent.
  • A typo in the passphrase. It opens a different, empty wallet without any error. Check the fingerprint against your notes.

Related