Partially Signed Bitcoin Transactions (PSBT): The Cypherpunk Standard for Collaborative Bitcoin Security

If you run your own Bitcoin node, operate a multisig wallet, or mine solo with a Bitaxe, you already understand a fundamental truth: trusting third parties is a security hole. Partially Signed Bitcoin Transactions — PSBTs — exist because Bitcoiners demanded a way to collaboratively build and sign transactions without ever exposing private keys to the internet or to each other.

PSBT is not some obscure developer tool. It is the standard that makes hardware wallets interoperable, multisig practical, and air-gapped signing possible. If you care about sovereignty over your bitcoin, you need to understand PSBTs. This guide breaks down exactly how they work, why they matter, and how they fit into the broader architecture of Bitcoin self-custody in 2026.

What Is a Partially Signed Bitcoin Transaction?

A Partially Signed Bitcoin Transaction (PSBT) is a standardized data format defined in BIP 174 (and extended by BIP 370 for PSBTv2) that allows a Bitcoin transaction to be constructed, passed between multiple parties, and signed incrementally — without any single party needing to hold all the private keys or trust any other participant.

In practical terms, a PSBT is a container. It holds:

• The unsigned (or partially signed) Bitcoin transaction itself
• The UTXOs being spent, including full previous transaction data
• Public keys, derivation paths, and redeem/witness scripts needed for signing
• Any signatures collected so far
• Metadata that helps signers validate what they are signing

This container can be passed around — via USB drive, QR code, NFC, SD card, or even printed text — allowing each signer to independently verify the transaction, apply their signature, and pass it along. Once all required signatures are collected, the PSBT is “finalized” into a standard Bitcoin transaction and broadcast to the network.

The Problem PSBT Solves

Before BIP 174, there was no standard way to hand an unsigned transaction between different Bitcoin software. If you wanted to sign a transaction on a hardware wallet, construct a multisig spend, or participate in a CoinJoin, each wallet implemented its own proprietary format. This created a nightmare of incompatibility:

• Hardware wallets could not easily receive transactions from arbitrary software wallets
• Multisig setups required all cosigners to use the same software stack
• Air-gapped signing involved fragile, ad-hoc data transfer methods
• CoinJoin coordinators had to build custom protocols for each wallet they supported

PSBT solved this by creating one universal format. Andrew Chow proposed BIP 174 in 2017, and it was merged into Bitcoin Core in 2019. Since then, it has become the de facto standard adopted by virtually every serious Bitcoin wallet: Sparrow, Specter, Coldcard, BitBox, Jade, Electrum, Bitcoin Core, and dozens more.

How PSBTs Work: The Technical Flow

The PSBT workflow involves distinct roles that can be performed by the same entity or distributed across multiple parties:

1. Creator

The Creator constructs the base unsigned transaction — selecting which UTXOs to spend, setting outputs (destination addresses and amounts), and establishing the fee. The Creator does not need any private keys. This role can be performed by a watch-only wallet, a coordinator service, or any software that understands UTXO selection.

2. Updater

The Updater adds the metadata that signers need: previous transaction outputs (so signers can verify amounts), public keys, BIP32 derivation paths, redeem scripts for P2SH inputs, witness scripts for SegWit inputs, and sighash types. Multiple Updaters can contribute information — for example, in a multisig scenario, each cosigner’s wallet might add its own derivation paths.

3. Signer

The Signer examines the PSBT, verifies the transaction details (amounts, destinations, fees), and applies their signature to the relevant inputs. Critically, the Signer can do this on an air-gapped device — a hardware wallet, an offline laptop, or even a dedicated signing device. The Signer never needs to be connected to the internet.

4. Combiner

If multiple Signers produce separate PSBTs with their respective signatures, the Combiner merges them into a single PSBT containing all signatures. This is purely a data operation — no keys are involved.

5. Finalizer

The Finalizer checks that all required signatures are present and constructs the final scriptSig and witness data for each input. At this point, the transaction is ready to be broadcast.

6. Extractor

The Extractor pulls the finalized, fully-signed raw transaction out of the PSBT container, producing a standard Bitcoin transaction that can be broadcast to the network via any node.

Why PSBTs Matter for Bitcoin Miners

If you are mining Bitcoin — whether you are running a fleet of Antminers in a Canadian hosting facility or solo mining with a Bitaxe at home — PSBTs are directly relevant to how you manage your mining rewards.

Securing Mining Payouts with Multisig

With the block reward at 3.125 BTC post-halving and network hashrate exceeding 800 EH/s in 2026, every satoshi of mining revenue matters. Serious miners do not send their payouts to a single-key hot wallet. They use multisig — a 2-of-3 or 3-of-5 setup where spending requires multiple independent signatures.

PSBTs make multisig practical. Your mining pool payout address can be a multisig address. When you want to spend those funds, you create a PSBT, sign it on one device, transfer it to a second device for the cosignature, and broadcast. At no point does any single device hold enough keys to spend your bitcoin unilaterally.

Air-Gapped Treasury Management

For miners running a small operation — even a single Bitcoin Space Heater generating heat and sats — the principle is the same. Your mining rewards should flow to cold storage. PSBT enables you to construct a spending transaction on your online computer, transfer it to your air-gapped signing device via SD card or QR code, sign it offline, and bring it back online for broadcast. Your private keys never touch a networked device.

Collaborative Mining Operations

If you run a mining operation with partners, PSBTs enable clean financial governance. Mining revenue can be directed to a multisig wallet requiring agreement from multiple partners before any withdrawal. The PSBT format ensures each partner can independently verify the transaction on their own hardware before signing — no need to trust a shared computer or a single operator.

PSBT Use Cases Beyond Basic Transactions

CoinJoin for Privacy

CoinJoin is a technique where multiple users combine their transaction inputs and outputs into a single transaction, making it difficult for blockchain surveillance firms to trace individual payment flows. PSBT is the backbone of modern CoinJoin implementations. Each participant creates their inputs and outputs, the coordinator combines them into a single PSBT, each participant signs only their inputs (verifying the outputs are correct), and the finalized transaction is broadcast.

Without PSBT, CoinJoin would require each participant to trust the coordinator with their transaction data in a proprietary format. PSBT standardizes this process and keeps it trustless.

PayJoin (P2EP)

PayJoin — also called Pay-to-EndPoint (P2EP) — is a privacy technique where both the sender and receiver contribute inputs to a transaction. This breaks the common-input-ownership heuristic that chain analysis companies rely on. PSBT makes PayJoin feasible by allowing the receiver to add their input to the sender’s partially-constructed transaction before the sender finalizes and signs.

Lightning Channel Opens

Opening Lightning Network channels involves funding transactions that can benefit from PSBT workflows. Dual-funded channels — where both parties contribute to the channel capacity — use PSBT to coordinate the construction and signing of the funding transaction. This is especially relevant as Lightning adoption grows and miners increasingly use Lightning for faster payout settlement.

Atomic Swaps

Cross-chain atomic swaps — exchanging bitcoin for another asset without a trusted intermediary — rely on coordinated transaction signing. PSBTs provide the standard format for constructing and partially signing the Bitcoin side of the swap, ensuring interoperability between different wallet software on both chains.

Transaction Batching for Mining Pools and Businesses

Mining pools processing thousands of payouts, or businesses making multiple vendor payments, can use PSBTs for transaction batching. A batch transaction with dozens of outputs can be constructed by the pool’s treasury system, reviewed and signed by authorized signers using their hardware wallets, and broadcast as a single transaction — saving on fees and reducing on-chain footprint.

PSBTv2: The Evolution (BIP 370)

The original BIP 174 PSBT format has one significant limitation: the entire global transaction must be constructed before any role can begin work. This means the Creator must finalize all inputs, outputs, and the transaction structure upfront.

BIP 370 introduces PSBTv2, which decouples the inputs and outputs from the global transaction. Key improvements include:

• Construction-time modifications: Inputs and outputs can be added or removed after the initial PSBT is created, enabling interactive protocols like dual-funded Lightning channels
• Reduced global data: Version, locktime, and other global fields are stored as key-value pairs rather than embedded in a serialized transaction
• Better role separation: The Constructor role (new in v2) can modify the transaction structure, while Signers only sign finalized inputs
• Improved hardware wallet UX: Signers receive inputs and outputs as separate, self-contained records, making verification on small screens more practical

PSBTv2 is being adopted by newer wallet software and is particularly important for interactive protocols where the final transaction structure is not known when the PSBT is first created.

PSBT and Hardware Wallets: The Security Foundation

Hardware wallets are the most common consumer application of PSBTs. When you use a Coldcard, Trezor, Ledger, BitBox, or Jade to sign a transaction, you are using PSBT — even if the wallet software abstracts this away.

The workflow is straightforward:

1. Your watch-only wallet (Sparrow, Specter, Electrum) constructs a PSBT with the transaction details
2. The PSBT is transferred to your hardware wallet via USB, SD card, QR code, or NFC
3. The hardware wallet displays the transaction details for verification: destination address, amount, fee
4. You confirm on the device, and it signs the PSBT using the private keys stored in its secure element
5. The signed PSBT is transferred back to the watch-only wallet
6. The wallet finalizes and broadcasts the transaction

The critical security property: your private keys never leave the hardware wallet. They never touch a computer connected to the internet. PSBT is what makes this possible — it carries all the information the hardware wallet needs to verify and sign the transaction, without requiring the hardware wallet to have network access or trust the host computer.

How to Use PSBTs: Practical Guide

Using Bitcoin Core CLI

For node operators, Bitcoin Core provides full PSBT support via the command line:

createpsbt — Creates a raw PSBT from specified inputs and outputs

walletcreatefundedpsbt — Creates a PSBT and automatically selects UTXOs and calculates fees

walletprocesspsbt — Signs a PSBT with the wallet’s keys

combinepsbt — Merges multiple PSBTs with partial signatures

finalizepsbt — Completes the PSBT and produces the raw transaction

analyzepsbt — Reports the status and next steps for a PSBT

Using Sparrow Wallet (GUI)

Sparrow is the go-to desktop wallet for PSBT-based workflows. It provides native support for creating multisig wallets, constructing PSBTs, transferring them to hardware wallets via USB/QR/SD card, and managing the full signing lifecycle. If you run your own Bitcoin node, Sparrow connects directly to it, giving you full sovereignty over transaction construction and broadcast.

QR Code Transfer

For maximum air-gap security, PSBTs can be encoded as animated QR codes (using the UR standard from Blockchain Commons). The watch-only wallet displays the PSBT as a series of QR frames, the hardware wallet scans them with its camera, signs the transaction, and displays the signed PSBT as another series of QR codes for the watch-only wallet to scan. No USB cable, no SD card, no physical connection whatsoever.

PSBT Security Considerations

PSBTs are a powerful tool, but like any tool, they must be used correctly:

• Always verify on the signing device. Never blindly sign a PSBT. Check the destination address, amount, and fee on your hardware wallet’s screen. A compromised host computer could modify the PSBT before sending it to your signing device.
• Verify change outputs. A sophisticated attack involves modifying the change output to an attacker’s address. Your signing device should verify that the change output belongs to your wallet by checking the derivation path.
• Understand fee implications. With Bitcoin network difficulty above 110T and fees fluctuating, always verify the fee displayed by your signing device matches your expectations.
• Use multisig for high-value storage. Single-key PSBTs still rely on a single point of failure (one key). For significant holdings — including accumulated mining rewards — multisig with geographically distributed keys provides superior security.
• Keep PSBT data confidential. While a PSBT without signatures cannot be used to steal funds, it does reveal transaction details (addresses, amounts, UTXOs) that could compromise your privacy.

PSBT in the Context of Decentralized Mining

At D-Central Technologies, we advocate for decentralization at every layer of Bitcoin mining — from hash rate distribution to transaction sovereignty. PSBTs fit directly into this philosophy.

When you mine with hardware from D-Central — whether it is a Bitaxe solo miner, an Antminer Slim Edition for efficient home mining, or a full-scale operation in our Quebec hosting facility — your mining rewards are your bitcoin. How you manage those rewards matters. Using PSBTs with a multisig setup, signing on air-gapped hardware, and broadcasting through your own node: that is the full sovereignty stack.

This is what separates Bitcoiners from crypto tourists. We do not hand our keys to an exchange and hope for the best. We verify, we sign, and we broadcast on our own terms. PSBT is one of the tools that makes this possible.

If you need help setting up your mining operation, optimizing your hardware, or getting your ASICs back online, D-Central’s ASIC repair service and mining consulting team have been serving Canadian miners since 2016. We are the Bitcoin Mining Hackers — institutional-grade technology, hacked for the home miner.

Frequently Asked Questions