The air-gapped PSBT workflow

Every air-gapped signer works the same way underneath. A wallet on your computer builds a transaction it cannot sign, that transaction crosses to a device holding keys but no network connection, the device signs, and the signature comes back. The gap is never bridged by a cable, and the private key never crosses it in either direction.

The thing making the round trip is a PSBT — a partially signed bitcoin transaction. Four guides on this site mention it in passing; this one explains what is actually in it, because the contents are what determine whether your device can protect you or is merely signing whatever it is handed.

There is also one output in every transaction that almost nobody thinks to check, and it is the one an attacker would use to rob you.

1Two halves of a wallet

An air-gapped setup splits the job of "a wallet" into two pieces that never touch.

• The coordinator runs on your computer or phone — Sparrow, Nunchuk, Electrum, and the rest. It talks to the network, watches your balance, knows your addresses, chooses which coins to spend, and builds transactions. It holds no private keys and cannot sign anything.
• The signer is the offline device — a COLDCARD, SeedSigner, Krux, or similar. It holds the keys and can sign, but knows nothing about the blockchain, cannot see your balance, and has no idea what has happened since you last used it.

Neither half can spend your bitcoin alone, and that is the entire architecture. The PSBT is how they cooperate without ever being connected.

2What is actually in the file

A PSBT is not just an unsigned transaction. If it were, your signer would be helpless — it would see addresses and amounts it could not verify and would have to take them on faith.

So the coordinator packs in everything the offline device needs to check the work itself:

• The transaction being proposed — which coins are being spent, and to which addresses, in what amounts.
• The full details of every input being spent. This is the part that matters most, and section 3 explains why.
• Derivation paths, so the device knows which of its keys apply to which input, and which outputs belong to your own wallet.
• Any signatures already collected, which is what makes multisig possible — each signer adds theirs and passes it along.

The device reads all of that, works out the truth for itself, shows you the result on its own screen, and only then signs.

3Why the input details matter

Here is a subtlety worth understanding, because it explains a design decision that otherwise looks like bloat.

Your offline signer cannot look up the blockchain. If the PSBT told it only "you are spending these coins" without saying how much each one was worth, the device would have no way to calculate the fee — and the fee is simply whatever is left over after the outputs are paid.

A dishonest coordinator could exploit exactly that. It tells the device the inputs are small, the device computes a modest fee and displays it, you approve, and the real transaction burns an enormous amount to the miner. You signed something whose true cost you were never shown.

4Getting it across the gap

The PSBT has to physically travel. Four routes are in common use, and the choice is mostly about which device you own.

Only the first two involve no electrical or radio connection whatsoever. If the reason you bought an air-gapped signer was to avoid that connection, using it over USB gives most of that back.

5The output nobody checks

This is the section to read twice.

A typical payment has two outputs, not one. There is the amount going to the person you are paying, and there is the change coming back to you — because coins are spent whole, and the remainder has to go somewhere.

Everyone verifies the recipient address. Almost nobody looks at the change output, because it is "just my own money coming back". And that is precisely the gap.

A compromised coordinator does not need to alter the address you are watching. It only needs to alter the one you are not.

If malicious software sets the change address to one it controls, you would see a correct payment to your intended recipient, approve it, and unknowingly send the entire remainder of the coin to an attacker. The transaction looks perfect on the half of it you inspected.

The defence is built into the PSBT, and it only works if your device is in a position to use it:

• The device verifies the change output derives from your own wallet. It has your keys, so it can check whether it could produce that address. If it cannot, the address is not yours.
• For single-sig, this works out of the box, because the device knows its own key and can derive its own addresses.
• For multisig, the device must know the whole wallet — every co-signer's public key. A change address in a 2-of-3 is derived from all three, and a device that has only seen its own key cannot tell a legitimate change address from a hostile one.
• So register the wallet on each signer before you fund a multisig. This is the step that makes change verification possible, and the multisig guide covers why that configuration matters for recovery too.

6The round trip, start to finish

• Build. The coordinator selects coins, sets the fee, and produces the PSBT.
• Transfer. The file goes across by card, camera, or tap.
• Verify on the signer. Amount, recipient, fee, and — where the device supports it — confirmation that the change is coming home. Read these on the signer's screen, which is the whole reason it has one.
• Sign. The device adds its signature into the PSBT. The key does not move.
• Transfer back the same way it came.
• Finalise and broadcast. The coordinator assembles the finished transaction and sends it to the network.
• For multisig, repeat steps two to five with each signer until enough signatures are collected.

7When it goes wrong

Air-gapped signing fails in a small number of recognisable ways, and none of them put your coins at risk — an unsigned or unbroadcast transaction has changed nothing.

• The signer cannot find the file. Usually a card formatted the wrong way, or the file written to a folder the device does not look in.
• The animated QR will not scan. Raise the screen brightness, slow the animation if the coordinator allows it, and clean the camera lens. Transactions with many inputs make long animations.
• The device will not show a change address as its own. On multisig this almost always means the wallet was never registered on that device.
• The fee on the device does not match the computer. Stop. The device is doing arithmetic on real values; something is wrong on the other side.
• A signature is rejected as invalid. Typically the wrong device for the wallet, or a derivation path mismatch.

8What the air gap does not do

Worth stating plainly, because "air-gapped" is often heard as a broader claim than it is.

• It does not make you private. The coordinator still talks to the network and still knows every address you own.
• It does not protect a bad backup. Losing your recovery words loses the wallet regardless of how the signing was done.
• It does not verify the recipient for you. If you pasted an address from a compromised source, the device faithfully signs a payment to the attacker — correctly, exactly as instructed.
• It does not help if you approve without reading. The screen is the protection. Skipping it removes the entire benefit of the arrangement.

The short version

A PSBT carries the proposed transaction plus everything an offline device needs to check it independently — including the value of every input, so the device computes the fee rather than believing one. It crosses the gap by card, camera, or tap, gets signed, and comes back to be broadcast. Verify on the signer's screen, and register multisig wallets on every device so change addresses can be verified too.