Air-Gapped Signing

Air-gapped signing is the practice of signing Bitcoin transactions on a device that has no network connection of any kind, no USB data link, Wi-Fi, Bluetooth, or cellular. Instead, the unsigned transaction is carried to the signer across an air gap using QR codes, a microSD card, or NFC, signed there, and carried back out the same way. Because the signing device is never reachable over any network, remote attackers have no channel to it even while it holds your keys.

PSBT makes it interoperable

The data passed across the gap is a Partially Signed Bitcoin Transaction, standardized in BIP174. A PSBT carries the unsigned transaction plus everything the offline signer needs to verify amounts and fees and apply its signature, without access to the live UTXO set. Any BIP174-compliant coordinator can hand a PSBT to any compliant signer, so air-gapped workflows are portable across wallets and devices rather than locked to one brand.

Verify on the trusted screen

The security of an air gap collapses if you sign blindly. The signer displays the destination, amount, and fee on its own screen, and you confirm those match what you intended before approving. This defends against malware on the online coordinator that might swap an address. The air gap stops remote key extraction; on-device verification stops you from signing a tampered transaction.

The unsigned transaction is usually drafted in a Watch-Only Wallet; D-Central covers the full standard in our guide to Partially Signed Bitcoin Transactions.

Transport Trade-Offs: QR, microSD, and NFC

Each way of carrying a PSBT across the gap has a different attack surface. QR codes are the most transparent — the data is visible, cannot carry hidden filesystem payloads, and the channel is strictly one-way by construction — but a single QR holds limited data, so larger transactions (many inputs, multisig) require animated QR sequences. microSD cards carry any size easily but introduce a filesystem and card controller into the trust boundary, which is a genuine, if exotic, attack surface on both devices that touch the card. NFC is convenient and short-range but is a radio, which some users exclude on principle. None of these choices changes the cryptography; they change how much incidental machinery sits between your coordinator and your keys.

What the Air Gap Does Not Protect

An air gap removes one class of attack — remote compromise of the signer — and leaves every other class intact. If the device generated its seed with weak entropy, the gap is irrelevant. If the receive address you verified came from a compromised watch-only coordinator, you can sign a perfectly authentic transaction to a thief. Supply-chain tampering, a malicious firmware update applied over that same SD card, and plain physical theft of the signer all sit outside what the gap addresses. Air-gapped signing is one strong layer in a stack that still needs verified receive addresses, firmware you trust, and a full node confirming what the chain actually says.

Fitting It Into a Sovereign Workflow

The mature pattern is three roles: an online node that watches the chain, a watch-only coordinator that drafts PSBTs and tracks balances with public keys only, and the offline signer that alone holds private keys. Day to day, coins arrive and are watched with zero exposure of secrets; on the rare occasion you spend, the PSBT makes its round trip across the gap. This division of labor is what makes cold funds usable without ever making them hot, and it composes cleanly with multisig — several air-gapped signers, one coordinator — for holdings that justify the ceremony. Rehearse the full round trip with a small amount before trusting it with a large one; the time to discover a workflow gap is not during your first real spend.