SeedSigner wallet simulator

This is device firmware, not a re-creation of it. The actual Python that runs on a SeedSigner runs here, executed by Pyodide (CPython compiled to WebAssembly) in a Web Worker. The wallet's own code is untouched: nothing in it is patched, and the pinned release it is built from is rebuilt below rather than pasted in. Two builds are on offer, stock SeedSigner and the 3rdIteration smartcard fork, and the control under the device says which is running and switches between them.

What a browser cannot provide is replaced at the four points where the firmware reaches for hardware, and each is replaced from outside it:

• Display: the device's own driver renders the frames and hands them to the page, which paints them at its native 320×240, pixel for pixel.
• Buttons: the worker sits blocked inside the wallet's main loop and can never answer a message, so keys cross on a SharedArrayBuffer and wake it with Atomics.
• Camera: your webcam, through getUserMedia. SeedSigner reads QR codes with pyzbar, a C library with no WebAssembly build, so the decode happens in the browser and the bytes reach the unmodified decoder exactly as pyzbar would have returned them.
• Smartcard: simulated SeedKeeper and Satochip cards answering real APDUs, because browsers have no smartcard API at all. The fork only; stock has no card code to answer.

Driving it. Click the device's own buttons, or use the keyboard: the arrows move, Enter selects, and 1, 2 and 3 are the three side buttons.

Nothing leaves your browser. The wallet has no network of any kind, and this page's content security policy names exactly one other origin it may reach: signet.bitsaga.be, the faucet and chain endpoints of Bitsaga Signet, which nothing asks anything until you open the simulator wallet or start the multisig tutorial.

That one origin is mine. Bitsaga Signet is a Bitcoin test network I run, and it exists so that the simulator wallet and the multisig tutorial can finish:

• What it is: a signet with Testnet address prefixes, a faucet, and a block every thirty seconds, so a wallet can be funded and a spend can be watched into a block in about a minute rather than whenever a public test network gets round to it. Its coins exist only there, cannot be sold or sent to anyone, and are worth nothing.
• What this page asks it: only the two things a browser cannot do for itself, which are seeing the chain and reaching the network. The wallet is built, the addresses derived, the PSBT assembled and the transaction finalised here in the tab; Signet is asked for the faucet payment, for what a list of addresses holds, for whether a transaction has made it into a block, and to relay the finished one. No key, xpub or descriptor is ever sent to it, and the device's own firmware never talks to it at all.

It is still a simulator, running in a tab on an ordinary computer, with no secure element and no air gap. Treat every key it shows as public and never type a seed phrase you rely on. Mainnet works here exactly as it does on hardware, and that is the danger rather than a feature: on Mainnet this page derives the real mainnet account keys and produces valid mainnet signatures. It sits in the device's own Settings and Advanced menus where it always has, neither hidden nor recommended, and the multisig tutorial has no use for it, because Bitsaga Signet does the whole thing.