TL;DR
A multisig wallet needs more than one key to move your bitcoin. In the most common setup, 2-of-3, there are three keys on three hardware wallets and any two of them can sign. Lose one key and you can still spend. A thief with one key can do nothing.
How it works
A normal (single-sig) wallet has one seed, and that one seed can spend everything. A multisig wallet locks your coins behind a rule instead: m signatures out of n specific keys. You write it as m-of-n. In a 2-of-3, three keys exist and any two of them together can move the coins.
That rule isn’t a setting in an app. It’s written into the bitcoin addresses themselves, so the network won’t accept a transaction without enough signatures. No company enforces it, and no company can switch it off.
Each key lives on its own hardware wallet, with its own seed backup. Wallet software such as Sparrow combines the three public keys (the xpubs) into one wallet. It can show your balance and build transactions, but it holds no private keys. To spend, you sign with two devices, one after the other.
Why 2-of-3
2-of-3 is the sweet spot for one person. It survives one lost key and one stolen key, and you only need two devices to spend. Going bigger, such as 3-of-5, gives more margin but means five seeds in five places and three devices for every transaction. I compare the two in 2-of-3 vs 3-of-5.
2-of-2 sounds simpler, but it’s worse than a single seed: lose either key and the coins are locked forever.
What it protects against
- One seed backup found or stolen: one key isn’t enough to spend.
- One device or backup lost, broken or burned: the other two still sign.
- A bug at one manufacturer: with three different brands, it hits one key, not all three. The 2026 Coldcard seed problem is the reason this site insists on three brands.
- A tampered computer swapping addresses: a device that has your multisig registered checks the address itself (step 8).
What it doesn’t protect against
- Losing two of the three keys. Then you’re locked out, just as with a lost single seed.
- Two seeds in one place. One fire or one burglary then takes two keys at once. See where to store three seed backups.
- Losing the wallet descriptor. With only two seeds left, you need it to find your coins. See what is a wallet descriptor.
- You being tricked. If you type your seed words into a website or hand them to “support”, multisig only slows the thief down. See someone asks for your seed words.
What a multisig looks like
Under the hood, your whole wallet fits in one line of text, the output descriptor. A shortened example of the one Sparrow creates in the setup guide:
wsh(sortedmulti(2, [a1b2c3d4/48h/0h/0h/2h]xpub6E…Q3x, [e5f6a7b8/48h/0h/0h/2h]xpub6F…k9L, [c9d0e1f2/48h/0h/0h/2h]xpub6D…m2P))Read it as: a Native SegWit script (wsh) that needs 2 signatures from these three keys. The part in brackets is each device’s master fingerprint and the derivation path m/48’/0’/0’/2′, the standard path for this kind of multisig. Your receive addresses start with bc1q and are 62 characters long.
What it costs
Three hardware wallets instead of one, metal backups for three seeds, a spare laptop and a weekend. Transactions are a bit bigger, so fees are a bit higher. The full breakdown is in how much a multisig setup costs.
What you need
- Three hardware wallets from three different makers. I use a Trezor Safe 5, a BitBox02 and a Ledger Nano S Plus (hardware wallets).
- Three metal seed backups, and three places that can’t disappear in the same event.
- A laptop that does nothing else (step 2) and Sparrow, which is free and open source.
- A weekend, mostly for the backups and the tests.
Buy each device from the maker’s own shop or from Amazon.com itself (“Ships from and sold by Amazon.com”), never from a reseller (why not), and do the tamper check when it arrives.
Is it for you?
If losing the amount would really hurt and you hold for years, yes. For spending money, one hardware wallet is fine, and many people keep both. Read is multisig right for you? and multisig vs single-sig, then start with step 1 of the setup guide.