Don't take our word for it. Check every claim.

Every claim we make below comes with a way to verify it yourself, on your hardware. We will be adding more items in the following months.
Three of the checks need only the public xpubverify.py tool and a computer you already own. The air gap (Claim 3) and the Dark Skippy audit (Claim 5) are the exceptions, because those defenses are only available once you've installed Bitcoin Witness. If a claim can't be independently verified, we shouldn't be making it. If you find one that can't be, tell us.

Claim 1: The derivation is correct

Every release passes all 24 official Trezor BIP39 test vectors and the BIP32 reference vectors before it ships. If it doesn't, it doesn't ship.

How to check it

• The BIP32 reference vectors run in the free tool. Download xpubverify.py and its test_xpubverify.py from github.com/BitcoinWitness/xpubverify and run python3 test_xpubverify.py. It decodes the BIP32 vector 1–3 master keys, checks one vector-1 child derivation and refuses all 16 vector-5 invalid keys, using only the Python standard library, and it's short enough to audit quickly.
• For a real-world check that needs no test suite at all: run xpubverify.py against your own public key and compare the derived addresses to what your hardware wallet shows on its own screen. They should match.

Claim 1a: An independent codebase gets the same answer

Our own tests could be wrong in a way our own tests never catch: if we copied an expected address out of the same spec we implemented, a matching bug in both would pass. So the test suite also hands the derivation to a completely separate library and demands byte-for-byte agreement. When the two disagree, the suite fails.

How to check it

Install any independent BIP32 library, pip install bip32 or embit, and run python3 test_xpubverify.py. With no reference library it reports 405/406 passed, 1 SKIPPED (the SKIP needs an optional reference lib: pip install embit). With one installed, 24 cross-validation checks switch on and the final line becomes ALL 429 CHECKS PASSED. Two codebases written independently, deriving the same Bitcoin addresses down to the last character. It is about as close to 'the math is the math' as you get without doing the elliptic-curve arithmetic by hand. It needs no station and no special hardware, just Python and one pip install.

Claim 2: The code is readable

Bitcoin Witness code is auditable plaintext. Every line of code we ship is plain text, no minification, no obfuscation. What you read is what executes. The upstream tools it can install for you like Sparrow with its Java runtime, KeePassXC, and Electrum's compiled dependencies are third-party binaries we don't author. We pin and GPG-verify them instead (Claim 4).

How to check it

• Read xpubverify.py line by line on GitHub, today.
• Once the product is released, read the full scripts in place.
• Reading in place means no build step, no compiler, no signing key, no toolchain. The file you open in a text editor is the file the station runs when you double-click it.

Claim 3: It is hardened and air-gapped

WiFi and Bluetooth are disabled at four independent layers (a hardware overlay, a kernel-module blacklist, firmware deletion, and rfkill), and every workflow runs an air-gap assertion before doing anything at all.

How to check it

Run the free Air-Gap Security Checklist against your own station. It walks you through confirming each layer independently, on your hardware, with your own eyes. An air gap you haven't personally verified is a promise, not a property.

Claim 4: The supply chain is pinned

Upstream tarballs are GPG-verified against hand-pinned 40-character fingerprints on your preparation machine, before anything reaches the Pi. The Linux packages ride a digest-pinned base image and a SHA-256 manifest rather than a GPG chain, and the Python wheels are version-pinned. Nothing is trusted because a download page said so. The manifest itself is anchored by a composition hash you carry across on paper.

How to check it

Once we ship the final code, read VERIFY.md in the product bundle. It lists every pinned fingerprint and where each came from, and the same 40-character pins are baked into the assemble script for you to read directly. Our own signing key is published at /keys/bitcoinwitness-pub.asc, and its fingerprint is:

Confirm it through more than one channel (this website, GitHub) before you rely on it.

Claim 5: It defends against Dark Skippy

Any signature created on the station carries a nonce the station can rederive (RFC 6979 for ECDSA, BIP 340 for Taproot), and if the rederived value disagrees, that signature does not leave the machine. A failed check renames the file to *.SUSPECT-DO-NOT-BROADCAST.psbt (or *.SUSPECT-DO-NOT-COMBINE.psbt for a multisig) and refuses export. Nothing is deleted, so the evidence survives for your own analysis. A signature made on another device is outside this check's reach and is logged as nonce_audit: n/a (foreign signer). If you find a consumer signer that already ships this check, we want to hear about it.

How to check it

Read sign-psbt.sh and psbt_handler.py in the product bundle. They are auditable plaintext like everything else. This check ships with the station. The nonce recomputation is right there in the code, and you can follow every line of it.

Claim 6: We state our limits

There is no secure element. Here we explain why.
The station is a general-purpose hardware, Raspberry Pi, chosen so that every line it runs is open to your inspection. Bitcoin Witness does not custody funds or coordinate transactions. It produces self-sovereign proof of address control, not proof of reserves. It reads no live balances, because it is air-gapped. Its output is evidence aligned to CCSS controls, not a certification, and none of it is legal advice.

How to check it

Read the full threat model at /security. It lists what the station defends against, what it doesn't, and why, in that order.

Standard, unmodified cryptography sits underneath everything we have built. For the deep version of every boundary above, start with the threat model.