SeedSigner

SeedSigner is an open-source project that provides firmware and assembly instructions for building a do-it-yourself, air-gapped Bitcoin signing device from inexpensive, off-the-shelf components. A typical build uses a Raspberry Pi Zero — a version without WiFi or Bluetooth — plus a small LCD and a camera module. Because the assembled device has no wireless radios and no persistent key storage, it communicates with wallet software exclusively by scanning and displaying QR codes. It is one of the clearest expressions of the DIY ethos in Bitcoin custody: commodity hardware, published designs, nothing to trust that you cannot inspect or build yourself.

Stateless by design

SeedSigner is stateless: it does not retain the wallet seed when powered off. At the start of each session the user re-enters the seed phrase — most conveniently by scanning a SeedQR, the project's compact QR encoding of a seed — signs what needs signing, and everything sensitive vanishes from memory when power is cut. The trade is deliberate: you give up the convenience of a device that is always ready, and in exchange a stolen or seized SeedSigner contains no secrets at all. The device is a calculator for signatures, not a vault; the vault is wherever you keep the seed backup, which makes disciplined storage — ideally a steel seed backup, optionally hardened with a BIP-39 passphrase — the real security perimeter.

Built to make multisig affordable

The project's stated goal is to lower the cost and complexity of multisig setups, where several independent signers each control one key. Commercial hardware wallets multiply cost by quorum size; SeedSigners built from parts costing tens of dollars make a 2-of-3 with genuinely independent devices reachable for ordinary savers. Mixing a DIY signer with commercial devices from different vendors also diversifies supply-chain and firmware risk across the quorum. SeedSigner interoperates with coordinators such as Sparrow, Specter Desktop, and Nunchuk over QR-encoded PSBTs: the coordinator shows animated QR codes, SeedSigner scans, displays what it is signing for on-device verification, and returns the signature as QR.

Verify, then trust

Building one is genuinely approachable. The parts — Pi Zero, camera, display hat, case — assemble without soldering in most configurations, and the project documents each step, including verifying the firmware release signature before flashing the SD card. A few operational notes keep the stateless model honest: generate seeds with the device's dice-roll or camera-entropy options if you prefer not to trust any single randomness source; verify receive addresses on the SeedSigner's screen against your coordinator; and remember that because the device forgets everything, your backup discipline is your custody — a SeedQR printed or stamped without protection is the seed itself, so store it with the same care as words on steel. Some users keep the camera-based seed loading for practiced hands and enter words manually while learning, which is slower but harder to fumble. The whole exercise teaches more about how Bitcoin custody actually works than any sealed product can, which for many builders is half the reason to do it.

The firmware is published openly on GitHub under the SeedSigner organization, with signed releases the builder can verify before flashing. Because the user assembles the device, the usual supply-chain question — what did the factory put in this sealed box? — largely dissolves; the components are generic parts with no idea they will become a signing device. The shoulders-of-giants lineage is worth naming: SeedSigner helped prove that sovereign-grade signing does not require proprietary hardware, a path that projects like Krux and Specter DIY also walk. For the surrounding concepts, see hardware wallet and self-custody.