SeedSigner wallet simulator

This is device firmware, not a re-creation of it: the actual Python that runs on a SeedSigner, in this tab. Two builds are on offer, stock SeedSigner and the 3rdIteration smartcard fork; the control under the device says which one is running and switches between them.

Its Python is executed by Pyodide (CPython compiled to WebAssembly) inside a Web Worker. The wallet code itself is unmodified; only the places it reaches for hardware are replaced.

• Display: the driver hands raw RGB frames to the page, which paints them into the canvas above.
• Buttons: the worker blocks on the wallet's main loop and can never answer a message, so keys cross on a SharedArrayBuffer and wake it with Atomics.
• Camera: your webcam via getUserMedia. SeedSigner reads QR codes with pyzbar, a C library with no WebAssembly build, so decoding is done by the browser's BarcodeDetector or by jsQR and the bytes are handed to the unmodified decoder.
• Smartcard: simulated SeedKeeper and Satochip cards that answer real APDUs, because browsers have no smartcard API at all. The smartcard fork only: stock SeedSigner has no card code for them to answer.

Nothing leaves your browser. The wallet has no network of any kind, and the page's content security policy names exactly one other origin it may reach: signet.bitsaga.be, the faucet and proof endpoints of Bitsaga Signet, which nothing asks anything unless you start the multisig tutorial.

It is a simulator. Treat every key it shows as public and never type a seed phrase you rely on. Mainnet works here exactly as on hardware, and that is the danger: on Mainnet this page exports the correct mainnet account keys and produces real, valid mainnet signatures. It sits in the device's own Settings and Advanced menus where it always has, neither hidden nor recommended, and the multisig tutorial has no use for it: Bitsaga Signet does the whole thing.

Source, and a build script that rebuilds this wallet from a pinned upstream commit so you can check the claim above yourself: seedsigner-sim. Technical details, beside this, has the pin, both published hashes and everything the wallet zip carries. The device firmware lives in seedsigner-os.

Firmware

…

Upstream

Tag

Commit

Interpreter

Pyodide , CPython compiled to WebAssembly

The wallet zip this page loaded,

published sha256

what arrived here

published contents

The page is checking itself, so this is a convenience and not proof: only rebuilding the zip and comparing the hash is a check that does not depend on this page being honest.

What is in it

The upstream tree at the commit above, this repository's stand-ins for the hardware a browser does not have, and these pinned dependencies. Nothing else.

Check it yourself: rebuild the zip · the same rebuild on a clean runner · tests · upstream's own tests · source · latest release