There is one app on the stick and its first screen offers exactly those three choices. Each one below is walked through the way it actually appears — screen by screen, with the words the machine puts on them — followed by the handful of things the screens cannot tell you themselves. If you have not written the stick yet, start at Download & Boot.
◆ The screens below are redrawings of the real ones, not photographs and not a working app — nothing on this web page can generate a key or touch a wallet.
Eight screens. The words appear on exactly one of them, once, and they are never written to the stick, to this machine, or to anywhere else — the only file that gets written holds public keys and cannot spend a thing.
▸ “CREATE A NEW WALLET”
This machine will generate a seed and show you the recovery words once. The words are never written to the USB stick, to this machine, or to anywhere else. There is no backup, no copy and no recovery service.
Anyone who reads those words owns everything the wallet will ever hold. Anyone who cannot read them — including you, if you lose the paper — has lost it permanently.
The only file that will be written is a watch-only one: the public keys your everyday wallet needs to see this wallet's balance and prepare payments for it. It cannot spend anything.
▸ HOW MANY WORDS
// Both lengths are far beyond anything anyone can guess — nobody has ever broken a properly generated 12-word seed. 24 is the convention for large, long-lived holdings; 12 is meaningfully easier to write down without making a mistake, and a copying error is a real risk where guessing is not.
▸ “WHERE YOUR SEED COMES FROM”
// A wallet is exactly as safe as the randomness it was made from, so this screen does not rely on any single source of it. It mixes four together — including your own hand moving the mouse, which is the one source no software anywhere can watch. Only one of the four has to be unpredictable for the result to be safe, and if the machine cannot offer a source it trusts, it refuses to generate at all rather than asking you to decide.
// One source is deliberately not allowed to be that reason on its own. Processors carry two random instructions: one is the raw physical source, the other is a mathematical generator sitting in front of it, reseeded in a way nobody outside the chip can inspect — and chips have shipped that answered it with the same constant every time while reporting success. It still goes into the mixture, and the screen still says it is there; it is simply never what the machine takes as permission to make a key. Neither is the operating system's own pool, if that pool was only ever told it was ready by the same chip — so this machine tells it not to count that either.
▸ WHAT THE SCREEN REPORTS
143 of 256 movements collected.
▸ “WRITE THESE 12 WORDS DOWN, IN ORDER”
// On paper, not on a phone and not in a photograph. This is the only copy that will ever exist — the machine keeps none, and neither does anybody else. There is a sheet for it: the recovery sheet, printed blank and filled in by hand.
▸ “NOW TYPE EVERY WORD BACK”
word 8 of 12: aban_
7 of 12 words entered and correct so far.
// The words are hidden here on purpose: you are meant to be copying from your paper, and a readable screen would let you copy from that instead while believing you had checked the paper. A word that stops matching turns red straight away, while it is still in front of you, and you fix it where it stands — going back to word 3 costs you word 3 and nothing else. If your handwriting is genuinely ambiguous, Show the words again is always there and does not throw away what you have typed.
▸ “ADD A PASSPHRASE? (OPTIONAL)”
// A passphrase is a 25th word of your own choosing. The same recovery words with a different passphrase are a completely different wallet, with different addresses and a different balance. It protects you against someone who finds your written words — and destroys the wallet if you forget it, with no way to recover or reset it. Leave it empty if you are not certain you want one; most wallets have none.
▸ PASSPHRASE — SHOWN ON SCREEN, TYPED TWICE
// It is shown rather than hidden behind dots because the machine treats every keyboard as a US one. On a Turkish-Q or a German layout the punctuation keys land somewhere else, so what gets typed is not what is printed on your keys — and nothing, anywhere, will ever tell you afterwards. Seeing the characters catches that; typing it a second time catches an ordinary slip, which no amount of looking will.
▸ “WHAT WILL BE WRITTEN TO THE USB STICK”
// This is the whole of what leaves the machine, and there is nothing in it that can spend. It covers all four address styles a wallet might use, and prints the keys in both of the shapes wallets ask for, so you copy the one line your wallet wants — Sparrow takes the first, Blockstream Green wants the pair underneath it. The file also shows you the first address of each style, which is what you check against your wallet after importing.
▸ NAME THE FILE
written to the USB stick
type to change the name · Enter accepts it
// Every file this machine writes, you name. The dated name is only the suggestion, so pressing Enter is still the whole interaction — and if a file of that name is already on the stick you are told, rather than having the old one quietly replaced.
The file is on your USB stick. The recovery words have been erased from the machine's memory — your paper is now the only copy in existence.
// Use Secure shutdown and wait for the machine to switch itself off before pulling the stick out. That is what makes sure the file is really written, and what wipes the leftovers of your key out of the memory.
The verification step has no way past it. Typing all the words back is what catches one you misread while copying, so there is no "skip" — and the grid is built for the correction that follows: arrow keys move between cells, clicking a cell jumps to it, and fixing word 3 of 24 does not mean retyping the other 21.
The passphrase is shown in clear and typed twice on purpose. It is the one secret here with nothing behind it — any characters are legal, so a wrong one quietly opens a different, perfectly valid, empty wallet instead of reporting an error. Seeing the characters catches a keyboard layout you did not expect; the second entry catches a slip. Leaving it empty is a normal choice.
Afterwards, take the stick to your everyday computer and import the file into Sparrow, Electrum, Blue Wallet or whatever you use. It can then watch the balance and prepare payments, and it still cannot send one without this machine. A printable recovery sheet is on this site if the words are still on a scrap of paper.
If the wallet was made somewhere else — another device, a seed you have had for years — this turns those words into exactly the same watch-only export, without them ever touching a networked machine.
▸ “TYPE YOUR RECOVERY WORDS” — HOW MANY WORDS
▸ THE SAME GRID, SHOWN IN CLEAR
// Here your paper is the source, so the words stay readable — Hide covers them if you are not alone in the room. Recovery words come from a fixed list of 2048, and anything you type that is not on that list is outlined in red the moment you type it, so a slip is caught on the spot instead of at the end.
▸ PASSPHRASE — A CLICK OR F3 MOVES THE TYPING HERE
▸ REVIEW — BEFORE ANY FILE EXISTS
▸ THE FIRST ADDRESS OF EACH ADDRESS STYLE
// This page is the whole point of this flow, and it appears before any file is written. A mistyped word gets caught by the machine itself, twice over. A mistyped passphrase never does — any passphrase is a valid one, so the wrong one quietly gives you a different, perfectly normal, empty wallet. So compare what is on this screen against the wallet you already have. If the fingerprint and the first address match, you typed everything correctly. If they do not, nothing has been written and you can simply go back.
// The numbered buttons are there for the same reason. Most people want the first one; if your existing wallet is a later one, step through until the address matches.
▸ NAME THE FILE
written to the USB stick · type to change the name · Enter accepts it
Exactly the same file creating a wallet would have produced — where the words came from makes no difference to it. Your words, and the key worked out from them, were erased from the machine on the way out of this screen.
Here the words are shown as you type them, unlike when creating one. The paper in your hand is the source, and hiding what you are copying from would help nobody. A word that is not in the BIP39 list turns red as you finish it — the checksum at the end can only tell you the whole seed is wrong, never which word.
The review screen is why this flow has one. It shows the fingerprint and the first addresses before anything is written, which is the only place a wrong passphrase can be caught: no checksum will ever notice one, but addresses you do not recognise will.
F3 switches between the words and the passphrase from the keyboard, and the account number is 0 unless you know otherwise.
Your everyday wallet prepares the payment and saves it to the stick's PSBT_DATA partition as a .psbt file. That file is public: it says what is being spent and to whom, and carries no key. It comes back with a signature on it.
▸ “CHOOSE A TRANSACTION TO REVIEW”
// These are the transaction files you copied onto the stick, and they are all the machine looks at — it does not open anything else on it, and nothing on the stick can be run as a program no matter what it claims to be. You can plug the stick in after starting up; it appears here within a second or two.
▸ “REVIEW BEFORE SIGNING” — SUMMARY
// Every recipient is listed underneath with its full address and amount. Read them the way you would read a receipt: this machine can tell you exactly what the transaction does, but it cannot know which address you meant — check that against something you trust.
// Notice what is not claimed yet. Until you enter your key, the machine has no way to know which of these addresses is your own change, so it says so rather than guessing. Money that looks like it is going to a stranger and money coming back to you are worth being sure about.
// If the file does not contain enough information to work out the fee, SignerOS refuses to sign it and tells you what to ask your wallet for. It will not estimate, and there is no way to override it — a transaction whose fee you cannot see is one that can quietly pay your balance to a miner.
▸ “ENTER YOUR KEY TO SIGN”
▸ BOTH FIELDS ON SCREEN — A CLICK OR F3 MOVES THE TYPING
// Your words go straight into a protected area of memory that is erased the moment it is finished with, and they are never held anywhere else — not in a file, not in a log, not in a temporary copy. Both fields are visible at once on purpose: a passphrase hidden behind a button is a passphrase people forget they had.
▸ “CONFIRM WHAT YOU ARE ABOUT TO SIGN” — THE LAST SCREEN
▸ WHERE THE MONEY GOES
// The transaction file gets to claim which address is your own change. Believing that claim would mean whoever handed you the file also decides which address this screen paints green as "coming back to you" — and you would then approve the loss yourself, having read the screen correctly. So the machine works the address out from your key instead and only calls it change when the two agree exactly. If a file claims your change on an address your key does not produce, signing is blocked. Not warned about — blocked.
▸ IT SIGNS, ERASES YOUR KEY, THEN ASKS WHAT TO CALL THE FILE
written to the USB stick
// Your key is already gone by the time this page appears, so nothing secret is sitting around while you pick a name — and if the write fails, you can just try again from here. The file you brought in is never altered; the signature is written alongside it as a new file.
The signed file is on the stick, next to the one you brought in. Carry it back to your everyday machine and broadcast it from there. It is the same transaction you just approved — signing changed nothing about it except adding your signature.
// Shut down and wait for the machine to switch off before pulling the stick out.
Read the transaction on this screen, not the other one. The online machine is the one that would be lying to you, so its version of what the payment does is not evidence. Change is proved rather than believed here: an output is only shown as coming back to you when this machine can re-derive it from your own key and rebuild the address byte for byte, and a file that claims change which does not check out is refused outright, with no override.
Both key fields are on screen at once — the one receiving your keystrokes carries an accent border and a blinking caret. F3 moves between them, and clicking either does the same.
The order is sign, wipe, then name the file. So the machine holds no key material while you are typing a file name, and a write that fails can be retried from there. Afterwards use Shut down rather than pulling the power — it scrubs free memory on the way out.
The smallest multisig there is, done once from end to end: two SignerOS wallets joined into one 2-of-2 in Sparrow, a payment signed on one machine and then on the other, and broadcast from the everyday one. Every step below is either a menu in Sparrow or a screen on the stick — nothing else is involved, and nothing secret moves between them. Sparrow is not only a suggestion here: the stick signs multisig change only from a coordinator that puts the cosigners' extended public keys into the transaction file, and Sparrow is one that does.
▲ 2-of-2 needs both keys for every payment, so it survives neither a lost key nor a forgotten passphrase. It is the clearest one to learn the mechanics on, and it is a fine arrangement for a joint account where both parties must agree. For savings you keep alone, build the 2-of-3 in the previous tab instead — same steps, one more key, and one of them may be lost.
Run Create a new wallet once on each of the two machines — or twice on the same one, in two separate sessions, if you are only trying this out. Each run gives you a set of recovery words to write on paper and one watch-only file on the stick. That is two sets of words and two files, and from here on everything depends on knowing which is which.
Name them apart as you save them — signer-a.descriptors.txt and signer-b.descriptors.txt will do. Each file's header carries a master fingerprint, eight characters that identify that seed and nothing else; Sparrow will show you the same eight later, which is how you check you pasted what you meant to.
Almost all of the export describes single-signature wallets, and none of that is what a multisig wants. Scroll past it, to the block at the very end headed MULTISIG COSIGNER KEYS (BIP48), and inside that to BIP48/2h — Native SegWit multisig (P2WSH). The line you want is the one that is not commented out: fingerprint, derivation path and public key in a single string.
Take the 2h block and not the 1h one underneath it: 2h is native SegWit, which is what you are about to build, and 1h is the older nested form — take that one only if some wallet explicitly asks for it. Copy the same line out of the second file. Two lines, one per seed, is the whole of what Sparrow needs; the rest of both files can be ignored for this.
Nothing here can spend. These are public keys, and they are meant to be handed to the wallet that coordinates the multisig — which is exactly what the next step does.
In the wallet's settings, set Policy Type to Multi Signature and Script Type to Native Segwit (P2WSH) — that is the same script type as the 2h block you just copied, and the two have to agree. Then set the threshold to 2 of 2.
Sparrow now shows one Keystore tab per cosigner: two of them, both empty.
Paste the whole line, brackets included. Sparrow reads the bracketed part and fills in the master fingerprint and the derivation path by itself. If your version leaves those two boxes empty, fill them from the same line by hand: the eight characters before the first slash are the fingerprint, and what follows is the path — m/48'/0'/0'/2'.
Check the fingerprint against the file it came from, both times. It is printed in the export's header and it is the one thing that tells you the key in front of you belongs to the seed you think it does. Give the keystores names you will recognise later — the machine, the room, whatever distinguishes them — because at signing time you need to know which words go with which.
Then Apply. Which key you put in which tab makes no difference: Sparrow's multisig wallets sort the keys before building addresses, so both orders produce the same wallet.
This is the step people skip and regret. In a multisig your recovery words are not enough to get the money back: you also need to know the other key, the threshold and the script type — which is precisely what this exported file records. It contains no private key and cannot spend, so keeping several copies of it is safe and losing all of them is not.
Do it now, while the wallet is empty and losing it would cost you nothing but the setup.
Send a small amount to an address from the wallet's Receive tab and let it confirm. (Sparrow needs its connection to a node or an Electrum server for this, and again to broadcast at the end — the online half of this arrangement is entirely ordinary.)
Sparrow will report 0 of 2 signatures. That unsigned file is what crosses the gap, and there is nothing secret in it.
Boot machine A from its stick, pick payment.psbt from the list, and read the review: who is being paid, how much, and the fee. Change is recognised here as it is in a single-signature wallet, because Sparrow puts the multisig script into the file and the machine re-derives the address from it rather than believing the label.
For the other key in that change it goes one step further. Sparrow also writes each cosigner's extended public key into the file, and the machine checks that the other cosigner's key really derives the other key of the change — anchored against the coins being spent, so a stranger's key cannot pass itself off as your cosigner's by copying its fingerprint.
▲ Build the payment in a coordinator that writes those extended public keys into the PSBT — Sparrow does. A file without them is refused, and the screen says why: nothing in it could tell your cosigner's key from somebody else's.
Type the first set of recovery words — and the passphrase, if that seed has one — confirm the summary, and sign. Name the result something that says what it is: payment-a.psbt. Then Secure shutdown, and take the stick out once the machine is off.
One signature of the two now exists. The original file is untouched next to the new one.
▲ Carry payment-a.psbt to the second machine — the file the first signing produced, not the original. Signing the original again would give you two separate files with one signature each, and neither of them can be broadcast.
Boot machine B, open payment-a.psbt, review it exactly as before, and type the second set of words. The first signature is carried through untouched and the second is added beside it. Save as payment-ab.psbt.
With the pair complete, SignerOS also writes a .tx file next to it — the finished transaction, ready to broadcast by any means at all. You do not need it if you are going back through Sparrow, and it is there for the case where you would rather not.
Sparrow reports 2 of 2 and offers Broadcast Transaction. Press it and the payment goes out. Both seeds approved it, neither one ever left the machine it was typed on, and every file that crossed the gap between them was public.
What you now have. Two sets of words, on paper, in two places — and one wallet file that describes how they fit together. All three are needed to recover, and none of them alone can spend a thing. Do the whole of the above on testnet or with an amount you would shrug at first: the point of a rehearsal is to find out which of the nine steps you misread, while it costs nothing.
The stick holds no secret and never did, so it does not need a safe. The paper does. These two pages print something better than a scrap of notepaper, and both work entirely in your browser — nothing you type on them is sent anywhere.
Two habits worth keeping: test with an amount you would shrug at before you trust the arrangement with more, and never type recovery words that hold real money into anything except a machine you started from SignerOS yourself. If something on this page did not match what you saw on screen, say so — that is worth more to this project than a thank-you.