Air-gapped bitcoin signing · five models

The SeedSigner you can checkSimulateVerifyPractiseOwn

Anyone can sell you one of these. We can hand you the device in a browser tab first, check the firmware you flash without a terminal, and give you a Bitcoin network to rehearse a multisig on. Then you pick a model.

Run one in your browser Compare the five models

5 models · from €150.00 · VAT included · free to try first

bitsaga.be/seedsigner-simulator
The SeedSigner simulator running the wallet's home screen in a browser tab
This is a browser tab. The real firmware, running under Pyodide, with your keyboard as the buttons and your webcam as the QR scanner.

Three things no other reseller can hand you

Every shop selling a SeedSigner says the same words about it. These are the parts you can go and check yourself, right now, before you spend anything.

01 The device, in a browser tab

Try one before anyone asks you for money

The real SeedSigner firmware runs in your browser. Not a video, not a re-creation of the menus: the actual Python from the device, running under Pyodide, driven by the wallet's own controller. Walk the menu tree, load a seed, add a passphrase, export an xpub, sign a transaction, back a seed up as a SeedQR.

It is pinned to a published upstream release tag, and the build is reproducible, so you can rebuild the wallet yourself and check that the file this site served you is byte for byte the one the pin describes. Half an hour with it will tell you more than any review.

Run it now How every seam is faked Source on GitHub

What works in the tab

  • The full menu tree, exactly as on the device
  • Seed loading by QR or by hand, and passphrases
  • xpub export, PSBT loading and signing, SeedQR backup
  • Three simulated smartcards, with PINs that stick

What is not there

  • The microSD card, so settings reset on reload
  • Anything animated from a background thread
  • Timers, the screensaver, battery readings
  • Any real security. It is a tab, not a device

02 Firmware verification

Check what you flash, without opening a terminal

A SeedSigner is a Raspberry Pi with a screen. It has no secure boot and no opinion about what you put on the card, so the only thing standing between genuine firmware and tampered firmware is you, checking. The project's own instructions open by assuming you know your way around a terminal, and so most people quietly skip the step.

Drop the file onto verify.bitsaga.be instead. It computes the SHA-256 in your browser and compares it against the hash the project published. Nothing is uploaded, no cookies are set, and there is no tracking code on the page. We host no firmware at all: the download button sends you to SeedSigner's own GitHub.

It has three modes, and the difference between them is one question: who do you have to trust? Easy trusts us. Advanced trusts the SeedSigner project and shows you every value to compare. Cypherpunk trusts nobody, hands you the commands, and sells you nothing.

Open the verifier Why we built it
The verify.bitsaga.be page showing a matching hash and a green result after checking a SeedSigner firmware file

03 A chain to practise on

Rehearse a multisig with real confirmations

Behind the simulator sits Bitsaga Signet, a private Bitcoin network we run ourselves, with a block every thirty seconds and a faucet that always has coins. Public test networks make a poor rehearsal: slow blocks, empty faucets, and a chain that sometimes reorganises under you.

Everything else behaves like Bitcoin because the software is Bitcoin: the same node, the same addresses, the same part-signed transactions moving between a wallet and a signing device. A 2 of 3 multisig built from three simulated SeedKeeper cards, funded, signed by two of them and broadcast, confirmed in eight seconds.

The coins are not real bitcoin. They exist only on that network, cannot be sold or sent to anyone, and are worth nothing. That is the point of them.

See the network

Bitsaga Signet

Network
A custom signet, ours, always up
Block time
30 seconds
Faucet
Public, 0.01 test bitcoin per request
Addresses
testnet format, tb1...
Coin value
None, and there never will be
Open to wallets
No. The simulator reaches it from the inside

And here is what none of that buys you

A browser tab is not a hardware wallet. It has no secure element, no air gap, and it runs on a general-purpose machine next to every other tab and extension you have installed. Never type a seed phrase you rely on into the simulator, not even once, not even to check something. Use a public test seed. If you already have, treat that seed as compromised and move the funds.

Software cannot verify hardware. A perfectly checked image on a tampered board is still a tampered board, and verification says nothing about how your seed was generated. Reproducible builds push the trust boundary a very long way and they do not erase it. Anyone telling you their product achieves zero trust is selling something.

What all of it defends is one claim: that you can check we did not tamper with the firmware. Not that a browser tab is safe for your keys. We would rather say that here than have you find it out later.

“The foundation of SeedSigner's security model relies on users taking on the responsibility to ensure they are running valid software.

The SeedSigner project, on its own security model

Now pick your model

All five are the same idea: an air-gapped, stateless signing device that holds nothing once you unplug it. What differs is the screen, the case, what comes in the box, and whether your seed arrives by QR code or off a smartcard. Prices and stock are read live from the catalogue.

Seedsigner plus without background
The easy first one

SeedSigner Plus

€150.00VAT included

Assembled, boots with the card in the box, and the biggest screen of the family for the least money.

  • 2.8 inch IPS 240x320 screen with DPAD controls
  • USB-C port that carries power only
  • Ships with a microSD card, a USB-C cable and SeedQR cards
  • 10 dollars per unit goes to the SeedSigner project maintainer
Read the full page →
Seedsigner standing transparent
The metal one

Seedsigner premium

€175.00VAT included

The original SeedSigner layout in a CNC-milled aluminium case, with a thumbstick instead of a pad.

  • Precision CNC-milled aluminium enclosure and buttons
  • Waveshare 1.3 inch LCD hat, aluminium thumbstick
  • Raspberry Pi Zero 1.3, the version with no WiFi
  • No microSD card in the box, you flash your own
Read the full page →
Seedsigner standing transparent
The metal one, revised

Seedsigner premium v2

from€180.00VAT included

Same aluminium case, rebuilt: spring-loaded card slot, better camera, and an SD card that is already in it.

  • The v2 build: spring-loaded SD slot, optimised camera, tighter fit
  • microSD card included, so it runs out of the box
  • Bundle it with Seedfan steel backups, single sig or multisig
  • One hour of setup guidance can be added to the order
Read the full page →
Choose options

Bundles and guidance are picked on the product page.

Seedsigner+ with smartcard showing saved screen
The daily driver

Seedsigner+ Smartcard

from€200.00VAT included

Your seed lives on a PIN-protected smartcard and loads from it, so you stop handling a SeedQR every time you sign.

  • Loads keys from a Satochip SeedKeeper card, protected by a PIN
  • Cards also hold multisig descriptors and other secrets
  • 2.8 inch IPS screen, DPAD controls, USB-C power only
  • Ships with a SeedKeeper card, an 8 GB microSD and a cable
Read the full page →

Enclosure colour, then how many SeedKeeper cards.

Seedsigner Pro Bundle box opened without background
The complete kit

Seedsigner Pro bundle

from€300.00VAT included

Everything around the device as well: a Faraday box, a power bank, a cable and a demo seed to learn on.

  • Seedsigner Premium, black aluminium
  • Faraday box, power bank and braided micro USB cable
  • Demo seed to practise with before you use a real one
  • SD card, optionally pre-loaded with the latest firmware
Read the full page →

The SD card arrives blank, or with the firmware already on it.

The differences, side by side

Taken from the product data, not from us. Where the data does not say, this table says so rather than filling the gap in.

 SeedSigner Plus €150.00Seedsigner premium €175.00Seedsigner premium v2 from €180.00Seedsigner+ Smartcard from €200.00 to €340.00Seedsigner Pro bundle from €300.00 to €325.00
Screen2.8 inch IPS, 240x320Waveshare 1.3 inch LCD hatWaveshare 1.3 inch LCD hat2.8 inch IPS, 240x320Waveshare 1.3 inch LCD hat
ControlsDPAD style buttonsAluminium thumbstick and buttonsAluminium thumbstick and buttonsDPAD style buttonsAluminium thumbstick and buttons
EnclosureA colour preference for the premium v2 can be left in the order notes. The aluminium version of the smartcard build is not available yet.Not statedCNC-milled aluminiumCNC-milled aluminium, tighter build3D printed, black or orangeCNC-milled aluminium, black
Power portUSB-C, power onlyNot statedNot statedUSB-C, power onlyBraided micro USB cable included
microSD card includedYesNo, not includedYesYes, 8 GBYes, blank or pre-loaded
Smartcard readerNoNoNoYes, with a Satochip SeedKeeper cardNo
Also in the boxUSB-C cable, 25x25 SeedQR cardsNothing else listedNothing else listedUSB-C cableFaraday box, power bank, demo seed
Firmware it runsBoth are covered by verify.bitsaga.be, and both run in the simulator.Stock SeedSignerStock SeedSignerStock SeedSignerShieldSigner, the Satochip forkStock SeedSigner
Try this one in the simulatorPick the stock firmwarePick the stock firmwarePick the stock firmwareThe default, smartcard firmwarePick the stock firmware
Choices at checkoutNone, one versionNone, one versionBundle and guidance, on the product pageColour, and 1 to 5 SeedKeeper cardsBlank or pre-loaded SD card

Prices are live from the catalogue. Swipe the table sideways on a phone.

What the software does, on every one of them

SeedSigner is open source under MIT, built by volunteers. This is the project's own feature list as it ships in our product descriptions.

  • Create a BIP39 seed phrase from D6 dice rolls, or from the entropy in a photo
  • Calculate the final word of a 12 or 24 word seed phrase
  • BIP39 passphrase support, the twenty-fifth word
  • Guided interface to write a SeedQR down, and to read one back in
  • Native segwit multisig xpub generation, shown as a QR code
  • Scan, parse and sign transactions through animated QR codes
  • On-demand receive and change address verification
  • Derive indexed child BIP85 seed phrases
  • Custom user-defined derivation paths
  • Mainnet, testnet and regtest

Questions

The ones we actually get asked, answered without the sales voice.

Is my seed stored on the device?

No. A SeedSigner is stateless: the seed sits in memory only while the device has power, and it is gone when you unplug it. There is no key material on the device for anyone to find later. The smartcard model changes where the seed comes from, not where it lives: it loads from a PIN-protected SeedKeeper card into the same temporary memory.

Which model should I buy?

If this is your first air-gapped device, the SeedSigner Plus: it is the cheapest, it has the largest screen, and everything you need is in the box. If you want metal, the premium v2. If you will sign often and do not want to handle a SeedQR every time, the smartcard model. If it is a gift or you want the whole setup in one parcel, the Pro bundle.

Which wallet software does it work with?

Any coordinator that speaks QR. Sparrow, Specter Desktop, Nunchuk, BlueWallet and Keeper are the usual ones. You keep watching your balance there. Only the signing happens on the device.

Can I really try it before buying?

Yes, and it costs nothing. The simulator runs the real firmware in a browser tab, so you can walk the menus, load a seed, add a passphrase, export an xpub and sign a transaction before anyone asks you for money. Use a public test seed, never one of your own.

Is the simulator the same as owning the device?

No, and it is not meant to be. A browser tab has no secure element and no air gap. It proves the flows and the firmware, not the security. Anything routed through the microSD card is missing, background animations do not run, and nothing persists when you reload. The full list is in the article about it.

Do I have to verify the firmware myself?

You should, and it is the one step most people skip because the official instructions assume a terminal. verify.bitsaga.be does the same check by dropping the file onto a page: it computes the SHA-256 in your browser and compares it against the hash the project published. The file never leaves your computer, and we host no firmware at all.

Can one device do multisig?

Yes, and it is the cheapest honest way to try it. Load your seeds one at a time, export each xpub to your coordinator, and sign each key on the same device. If you want to rehearse the whole thing first, the simulator plus our signet gives you a 2 of 3 that actually confirms.

What about VAT and shipping?

Every price on this page includes VAT. Shipping is calculated at checkout from your address, and you can pay by Bancontact, bank transfer, bitcoin or Lightning, card, PayPal, Google Pay or Apple Pay.

If you would rather read first

TechnicalRun the real SeedSigner firmware in your browserEvery faked seam, what you can verify yourself, and why you must never type a real seed into it.SecurityVerifying SeedSignerWhy the verification step gets skipped, what we built instead, and the part where we tell you not to trust it.TechnicalSeedSigner is the Bitcoin Swiss army knifeStateless signing, dice or photo entropy, and the cheapest honest way to try multisig.RepublishedThe DIY signing device revolution is just beginningKeith Mukai's report from the São Paulo summit, republished in full with our notes.

Try it first. Then decide.

It costs nothing to find out whether you like the device, and we would rather you knew before the parcel arrives than after.

Run one in your browser Pick a model

The simulator and the verifier are independent projects, MIT licensed, not affiliated with or endorsed by the SeedSigner project. Product photographs and specifications come from our WooCommerce catalogue.

0 0 items View cart →