Never enter a real seed phrase. On Mainnet this page holds the real mainnet keys for whatever you give it, with no secure element under them: treat anything typed in as public.
Never treat this as secure. Not on a phone, and not on an airgapped laptop with the network unplugged. Making device firmware run in a browser took a great deal of custom wiring, any of which could have introduced a critical bug. Treat every key it shows as public and never enter a seed phrase you rely on.
This is device firmware, not a re-creation of it. The Python that runs on a SeedSigner runs here, under Pyodide (CPython compiled to WebAssembly). Nothing in the wallet is patched, and the release it is built from is rebuilt below.
Each firmware is pinned to the newest release its project has published, by tag and by commit, rather than to a branch. A branch moves and can be rewritten out from under a rebuild; a published tag cannot.
The page is checking itself, so this is a convenience and not proof: only rebuilding the zip and comparing the hash is a check that does not depend on this page being honest.
The upstream tree at the commit above, this repository's stand-ins for the hardware a browser does not have, and these pinned dependencies. Nothing else.
Check it yourself: rebuild the zip · the same rebuild on a clean runner · tests · upstream's own tests · source · latest release · device images · DOOM on it
Four things a browser cannot do, replaced from outside the firmware and never inside it:
Driving it. Press the drawn buttons, or the keyboard: arrows move, Enter selects, 1 to 3 are the side buttons.
Nothing leaves your browser. The wallet has no network at all, and this page may reach one origin: signet.bitsaga.be.
That origin is mine. Bitsaga Signet is a test network I run, asked only to see the chain and relay a transaction. No key, xpub or descriptor is ever sent to it, and the firmware never talks to it at all.
Loading 0.0s
starting…