Reference
Compare with the ecosystem
Bitcoin Witness is one layer among several. It should not be the only tool in your setup.
| What you are comparing | Bitcoin Witness | Hardware wallet with Secure Element | A SECOND HARDWARE WALLET, WITHOUT SECURE ELEMENT | DIY signing devices | DIY air-gapped laptop (Tails) |
|---|---|---|---|---|---|
| How it is built | |||||
| No binaries, no firmware, no black boxes in the code the vendor supplies | full | partial | partial | partial | partial |
| Generic hardware you choose and source. No home address exposure | full | no | no | full | full |
| The code that runs on your device is plain text you can read in place or verify with AI | full | partial | partial | full | partial |
| Bundled open source software (Electrum, Sparrow, Ian Coleman etc) | full | no | no | no | partial |
| The station | |||||
| Air-gap hardening (see the threat model) | full | full | full | full | full |
| LUKS, GPG or similar encryption included | full | full | full | full | full |
| Seeds handled in RAM only. Written to disk and encrypted only by users, not by main software | full | no | no | full | full |
| What it does | |||||
| Independent verification layer for your self-custody setup | full | no | partial | partial | partial |
| Secret generation | full | full | full | full | full |
| PSBT privacy heuristics review | full | no | no | no | no |
| Dark Skippy nonce verification, offline, with no trusted host | full | partial | partial | no | no |
| Ready-made packages to hand to an heir, a cosigner or a third party | full | no | no | no | no |
| Outside of our scope | |||||
| Everyday spending wallet | no | full | full | partial | partial |
| Tamper-resistant secure element | no | full | no | no | no |
| Signs over a live USB connection | no | full | full | no | partial |
full · partial · no
A second hardware wallet gives only a partial second source: it signs, but it likely runs vendor firmware you cannot read, on hardware the vendor shipped you. It neither audits its own signing nonce nor assembles a package a third party can check.
The seven layers
Seven layers of a self-custody setup.
Six of the seven layers have mature tools. See our case for the verification layer.
| Layer | Function | Tools at this layer | Verification layer outputs |
|---|---|---|---|
| Buy | Acquisition | Exchanges, P2P | not this layer |
| Store | Hot / cold custody | Hardware wallets, multisig | Accompanying detailed reports about the stored setup |
| Backup | Seed preservation | Steel plates, paper | Independent re-derivation for singlesig, multisig and Liana setups |
| Access | Spending, signing | Wallets, PSBT tooling | Privacy and exfiltration audits and reports |
| Verify | Independent validation and attestation of self-custody setups. See examples. | Few, most are in-house | See the complete preview |
| Inherit | Estate transfer | Specialized companies and attorneys | The Confidence Reports and included package assembly (inheritance, multisig, proof of control, other) |
| Recover | Disaster recovery | Seed restore | Independent verification confirms recovery possibility in advance |
FAQ
Common questions
Can this replace my Coldcard / Ledger / Trezor?
It's not designed to and we do not recommend using it as a wallet. Bitcoin Witness is a verification layer and an independent opinion for your self-custody stack. It's independent software on independent generic hardware. See why you may need one. With that in mind, if the user chooses to, we bundle the encryption and signing tools with it.
How is this different from Ian Coleman's BIP39 tool?
Ian Coleman's tool runs in a browser and requires you to know which derivation paths to check. Bitcoin Witness bundles Ian Coleman's tool on air-gapped hardware alongside a guided workflow that produces a timestamped Confidence Report. The math is the same. The operational security is not.
How is this different from Unchained or Casa?
Collaborative custody (Unchained, Casa) solves who can sign. Bitcoin Witness answers does the backup work? They complement each other. We verify the seed layer, they manage the signing layer. For the millions of single-sig holders, a Confidence Report serves a similar trust function.
I am an attorney or a CPA. How does this help me?
See the executor and professional walkthrough and the packages in the product preview.
You are usually handed a phrase, a device or a folder and asked to act on it, with no way to test any of it. A Confidence Report and the Packages Bitcoin Witness produces are usually the missing documents. They state on the first page what was checked and what they do not prove, every line can be re-checked with any watch-only wallet, and recomputing one SHA-256 tells you the page in your hand is the page that was written. No seed material appears in it by design, so it is safe to email, print and put in a file. There is no vendor to call and no account to open. The client keeps their keys, and you keep a record you can defend.
What's in the Confidence Report?
A timestamped proof showing your seed fingerprint, derived addresses across all standard paths (BIP44/49/84/86), and air-gap status, with a SHA-256 hash for integrity. It also states in plain words what the check does not prove. It contains zero seed material and is safe to print or share.
Is this open source?
Bitcoin Witness is source-available: 100% auditable plaintext scripts you can read before running. The free companion tool xpubverify.py is MIT-licensed on GitHub.
What do I need to buy?
A supported Raspberry Pi (Pi Zero 2W, Pi 4, or Pi 5) running Raspberry Pi OS Bookworm 64-bit, a microSD card (8 GB minimum, 32 GB recommended), a power supply, a display adapter, and a USB keyboard. Modest, one-time hardware, much of which you may already own.
The Pi Zero 2W has WiFi. Is it really air-gapped?
We disable WiFi at 4 layers: hardware dtoverlays, kernel module blacklist, firmware deletion, and active rfkill enforcement. Every workflow runs the air-gap check before it does anything else. It asks nine questions of the running machine: no interfaces up, no routes, no nameservers, no listening sockets, no wireless devices, no wireless modules, radios rfkill-blocked, no surveillance daemons, and no wireless firmware left on disk. It won't move past a failure without showing you exactly what tripped. See the Security page for the full threat model.
What if I need help setting up?
Join the waitlist to be notified when guided setup options are available. Community support is available via GitHub Discussions.
Keep reading
Seen how it compares?
Five workflows, each ending in a Confidence Report you can hand to someone else.