Security alert · Oct 9, 2026: Ledger devices bought from a reseller in Southeast Asia were drained. Buy hardware wallets only from the maker. What to do →

Multisig Setup

Checklist

Watch-only multisig wallet: see your balance safely

Last reviewed: October 2026

TL;DR

A watch-only wallet is your multisig without any keys: it’s built from the descriptor (the three xpubs and the 2-of-3 rule), so it shows your balance and addresses but can’t sign. That makes it safe for your funds but not for your privacy: anyone who gets it sees everything. Use a second Sparrow, Nunchuk in guest mode or BlueWallet, and check any address for a large amount on the BitBox02 or the Ledger first.

Your signing laptop stays in a drawer most of the time, as it should (see step 2). But you still want to see your balance now and then, or give an exchange a fresh address without unpacking everything. That’s what a watch-only wallet is for.

What watch-only means

A watch-only wallet holds only public information: your descriptor, with the three xpubs, their fingerprints and paths, and the 2-of-3 rule. From that it can calculate every address of your multisig and look up their history. It can’t sign, so it can’t move a single sat. It can prepare an unsigned transaction (a PSBT) that you then sign with two devices.

You already made one: the fresh Sparrow in the recovery rehearsal (step 10) is a watch-only wallet until you connect the devices.

The privacy cost

Watch-only is safe for your coins. It isn’t private. Anyone who opens the watch-only wallet, or copies the descriptor out of it, sees:

  • your total balance and every past transaction,
  • every future address, so they can follow new deposits too.

In a multisig, one xpub alone reveals nothing about your addresses. The descriptor reveals all of it. So treat the device that holds a watch-only copy like a bank statement: a phone with a screen lock, a computer account with a password. If it gets lost or stolen, your funds are safe, but the finder can see what you hold, which may make you a target.

The app also asks a server about your addresses. A public Electrum server sees which addresses belong together, which is the same view of your wallet. Your own node avoids that; Tor at least hides your IP address.

Don’t hand your xpubs to a website

Portfolio trackers, block explorers and tax tools often ask for an xpub or a descriptor. Don’t. You’d give a company a permanent view of your balance, linked to your account, IP address or email. Keep watch-only copies on devices you control.

Option 1: a second Sparrow on an everyday computer

This is the simplest and what I’d pick first. It’s the same app, so the addresses will match by construction.

  1. Install Sparrow on the everyday computer and verify the download, as in step 3.
  2. Choose File → Import Wallet and load the descriptor from the USB stick you made in step 7.
  3. Set a wallet password when Sparrow asks. It encrypts the wallet file, which holds your descriptor and history.
  4. Compare the first few receive addresses and the balance with your real wallet. They should be identical.

The wallet has no keys. If you ever click Sign, Sparrow will look for a hardware wallet. Don’t connect your devices to this computer; signing stays on the signing laptop.

Option 2: Nunchuk on your phone

Nunchuk can open your Sparrow wallet from the descriptor. Choose guest mode: Nunchuk’s own app text says wallets created in guest mode are stored locally on the phone, with no account. The steps are in Nunchuk multisig on your phone. With the guide’s three USB devices the phone can’t sign, so what you get is a watch-only copy. I haven’t used Nunchuk in this setup myself; this follows Nunchuk’s own documentation and app, checked October 2026.

Option 3: BlueWallet

BlueWallet (version 8.0.2, October 6, 2026) has an Import wallet screen that accepts “anything you’ve got”. Its source code shows that a sortedmulti descriptor is recognized and turned into a Multisig Vault, for native SegWit, nested SegWit and legacy. With only xpubs in it, BlueWallet can’t make any signatures, so the vault is watch-only. I haven’t used BlueWallet in this setup myself; this is based on its source code, checked October 2026. Two things to know:

  • By default it connects to a BlueWallet-run Electrum server (electrum1.bluewallet.io). You can set your own in its network settings.
  • Compare its first receive address with Sparrow before you trust it. A wrong import gives different addresses without an error.

Install BlueWallet only through the App Store or Google Play links on its own site, bluewallet.io, not from a search result in the store.

Receiving with a watch-only wallet

A watch-only wallet shows addresses calculated on a device you use for everything else. If that phone or computer is compromised, the address it shows can be swapped for an attacker’s. For small amounts that risk may be acceptable. For anything large, and for the address you give an exchange as your withdrawal address, check it first on a device that has your multisig registered: the BitBox02 or the Ledger, as in step 8. The Trezor only shows what the computer sends, so it’s an extra check. More in wallet registration explained.

Common mistakes

  • Pasting the descriptor into an online tool “just to check the balance”.
  • Leaving a watch-only wallet on a shared family computer without a password.
  • Giving out a receive address for a large deposit straight from the phone, without checking it on a registered device.
  • Importing the descriptor with an app that picks the wrong script type, then thinking the coins are gone. Compare the first address.
  • Thinking watch-only is a backup. It holds the descriptor, but your backup is still the seeds on metal plus the printed descriptor in each box.

Related