Intro to Self Custody

Self custody means one specific thing: the secret that authorises spending your bitcoin exists only where you put it. No company holds a copy — which is why no company can freeze it, lose it in a bankruptcy, or hand it over on request, and why nobody can help you if you destroy it. Both halves of that sentence are the job.

This is the foundation article for everything else on this site. It assumes nothing except that you have bought some bitcoin, or are about to. It is longer than a checklist because a checklist is easy to follow, and easy to follow into a hole — the reasoning underneath each step is what tells you what to do when the screen in front of you does not match the instructions.

There is a version of this that takes an afternoon and a version that takes six months. The difference is not intelligence or technical skill. It is whether you moved money before you understood what you were doing with it.

What you are actually building

Strip away the hardware and the vocabulary and a bitcoin wallet is one enormous random number, plus software that knows what to do with it. That number is called the seed, and it is written out as twelve or twenty-four ordinary English words so that a human being can copy it down without making a mistake. Every key, every address, and every signature your wallet will ever produce is derived from it, in a fixed and publicly documented order.

Three consequences follow, and between them they set the shape of everything below.

• The words are the wallet. Not the device, not the app, not the brand. Any compatible wallet fed the same words rebuilds the same keys and finds the same coins.
• Anyone holding the words holds the bitcoin — immediately, permanently, and without needing anything else you own.
• Nobody can reissue them. There is no recovery department, no reset link, and no support line with a copy on file.

So the four stages below are not four chores to get through. They are one idea, taken in order: make that number well, record it durably, prove the record works, and only then put money behind it.

The rule that makes it work: do not move on until you can explain the outcome of the current stage in your own words. Not recite it — explain it, to yourself, without looking. Every expensive mistake in bitcoin custody is someone who skipped that check because they were nearly sure.

1Create your wallet

This stage has four parts, and only the first is about shopping. Begin with the simplest setup that fits what you are protecting: complexity can come later, once you have proven you can operate and recover a basic wallet.

Pick a shape before you pick a product

People stall here for weeks comparing devices, which is a strange place to stall — the whole time, the bitcoin is sitting on an exchange, which is the one option they had already decided against. The choice is not really between products. It is between shapes: how many keys, on what kind of hardware, in how many places.

Most people should start with the simplest suitable option and move through them slowly over years — not pick the most complex one because it sounds the most secure. Multisig removes the single point of failure, which is real and valuable. It also multiplies the number of things you must back up, and adds a new category of loss: a setup that nobody, including you, can actually restore. Reach for it after you have demonstrated you can recover a simple wallet, not before.

You do not have to buy a hardware wallet

Dedicated signing hardware is the recommendation on most of this site, and for good reason: it keeps the key away from the machine that reads your email. But it is a recommendation, not an entry requirement, and treating it as one keeps people custodial for another year while they save up and read reviews. There are several honest routes in.

• A phone wallet, today. Free, five minutes, and it teaches you what an address, a fee, and a backup actually are while the amount at stake is small. The keys live on an internet-connected device, so keep the balance to something you would be annoyed rather than devastated to lose.
• A dedicated signing device. The usual answer for savings, and the one the rest of this site assumes by default. Keys are generated on the device and never touch a general-purpose computer.
• Hardware you build yourself. Open projects like SeedSigner and Krux run on inexpensive off-the-shelf parts and sign by QR code, so nothing is ever plugged in. More assembly, no supply chain to trust, and no purchase that links your name to a bitcoin product.
• Bitcoin Core on a computer you control. The reference implementation ships with a wallet of its own — see the note below.
• An old phone or laptop, kept permanently offline. A workable cold setup, and a genuinely awkward one to operate safely. Worth knowing it exists; worth attempting only once the rest of this page is second nature.

None of these is the wrong answer. The wrong answer is leaving the coins on an exchange for another eighteen months while you decide.

Choosing your first setup   Compare hardware   Compare wallet software

Where the seed comes from is the most important decision on this page

Whatever you chose above, the moment that decides the security of the whole wallet is a few seconds long and almost invisible: the device offers to generate the seed for you, you press yes, and twelve words appear.

That step is the one part of the process you cannot check. A random number generator is a black box by construction. Good randomness and bad randomness look identical from the outside — there is no test you can run on twelve words to find out whether they came from a well-seeded generator, a subtly broken one, or a list somebody prepared in advance. If the number is weak or known, nothing you do afterwards helps. The backup is perfect, the recovery test passes, and the coins leave anyway.

The fix is not to suspect a particular manufacturer. It is to remove the question from the table: supply the randomness yourself, from something physical you can watch. Do that and the quality of the device's generator stops mattering, because it is no longer the thing deciding your wallet.

Most serious signing devices accept this directly. You roll, you type the results in, and the device hashes what you gave it into a seed — and the better implementations mix your rolls with their own entropy, so you are never worse off than if you had let it choose. Ninety-nine rolls of an ordinary six-sided die produce a full-strength twenty-four-word seed.

Dice are the common route, not the only one:

• A coin. One flip is exactly one binary digit, so 256 flips is a 256-bit seed. Slower and more tedious than dice, and it needs nothing but a coin and patience.
• Dice with more faces. Powers of two are the tidiest: a sixteen-sided die is exactly four binary digits a roll, an eight-sided die exactly three. A twenty-sided die carries more randomness per roll than a D6 but does not divide cleanly into binary, so it needs a discard rule — one more thing to get wrong at two in the morning.
• Casino dice. Precision-made and sharp-edged rather than rounded, so the bias is smaller than a board-game die. Nice to have, and not remotely necessary — the maths tolerates a badly skewed die far better than most people expect.
• Whatever you use, do not re-roll a result you dislike. Editing the randomness is the one way to actually damage it. Roll on a hard flat surface, record what lands, and keep going.

• Do not use a website, a phone app, or a spreadsheet to generate the number. That is trading a black box you own for one you do not.
• Do not invent the words yourself, or pick a phrase you find memorable. Human-chosen seeds are guessed at scale, automatically, and emptied within minutes.
• Do not shorten the roll count because it is probably enough. It is one afternoon, once, for the life of the wallet.

Roll the dice: generating your own entropy

Whichever way you make the number, there is one thing worth knowing before you start: there is no standard for turning rolls into words. COLDCARD, SeedSigner and Krux hash the digits; Keystone rewrites every 6 to a 0 first and wants 100 rolls; BlueWallet packs bits without hashing at all. The same rolls produce unrelated wallets on different devices, which is why the recovery words are the backup and the column of rolls in your notebook is not. If you want to see that for yourself, Entropy Workshop converts a set of test rolls and shows you the wallet they land on.

What the words actually are

Worth ninety seconds, because it explains several things that otherwise look arbitrary. The twelve or twenty-four words come from a standard called BIP39, which maps a random number onto a fixed list of 2,048 English words. Each word therefore carries eleven bits. Twenty-four words is 264 bits: 256 bits of actual seed plus an eight-bit checksum. Twelve words is 132 bits: 128 of seed plus four of checksum.

That checksum is quietly one of the most useful things in the design. Copy a word down wrong and the phrase is usually rejected outright, rather than silently opening a different, empty wallet and leaving you to work out what happened.

From the seed, your wallet derives a master private key — written out as an xprv — and a matching master public key, the xpub. Every key in the wallet hangs off that root, addressed by a derivation path, which is why one backup can restore an unlimited number of addresses. It is also why the next section matters.

Pair it with wallet software, even if the keys are cold

A signing device is deliberately stupid. It has a small screen, no idea what the current block height is, and no way to look anything up. On its own it can tell you almost nothing about your money.

The wallet software is the other half. It watches the blockchain, finds every payment made to you, adds them up, keeps labels and history, estimates fees, and builds the transactions your device will sign. You want it even for a wallet you intend never to touch — a balance you cannot see is a balance you will start checking on a block explorer instead, which is worse for your privacy and worse for your nerves.

What you give it is not the seed. It is the xpub: one long line of text from which the software can derive every address the wallet will ever use, watch for payments to all of them, and show you the result — with no ability whatsoever to move a single satoshi. This is called a watch-only wallet.

A vault with a glass front. You can count what is inside, watch deposits land, and hand out deposit slots all day. Opening it takes the key, and the key is in your other hand.

One secret, two halves

What stays on the device, and what is safe to hand your phone

Your seed12 or 24 words · the root secret

ONE SEED · TWO CAPABILITIES

SDEVICE ONLYPrivate keys · xprv

Can sign and spendNever exported · never shown to the phone

Spending produces a signature, not a key. The signature proves the key exists without revealing it, so the secret never reaches your laptop or the network.

WWATCH ONLYPublic keys · xpub

Can derive and watchNo signature · no spending power

Wallet software derives every address, watches the chain, and shows your balance, history, and a fresh receiving address whenever you need one.

The seed derives private keys that remain on the signing device and can spend, plus public keys that wallet software can use to watch every address without spending. Sharing the xpub is a permanent privacy exposure.

When you do want to spend, the two halves work together and the seed still never travels: the software builds an unsigned transaction — a PSBT — the device displays it, you approve it on the device's own screen, and the software broadcasts the signed result. Sparrow is the usual desktop answer; BlueWallet, Cove and Nunchuk do the same job from a phone.

One thing to be clear-eyed about: your xpub is not a spending risk, but it is not nothing either. Anyone holding it sees every address you will ever use and every payment you ever receive, forever. Treat it as private information rather than as a public identifier.

Doing it

• Download wallet software only from the maker's official site or the app-store listing linked from it. Verify the release signature where the maker publishes one.
• Buy hardware direct from the manufacturer. Never second-hand, never from a marketplace listing, never from a reseller you found through an advertisement.
• Inspect the packaging and run the maker's own authenticity check before going any further.
• Generate a completely new wallet on the device or in the app. Never use recovery words supplied in the box, printed on an enclosed card, or given to you by another person — there is no legitimate reason for a wallet to arrive with a seed already in it.
• Supply your own entropy if the device supports it, and take the extra twenty minutes to do it properly.
• Note the wallet fingerprint and the first receiving address. Neither is secret, and they are what you will check against in stage three.
• Pair a watch-only wallet using the xpub, and keep the seed off every internet-connected machine.
• Keep the wallet empty for now. Creating it is not the same as proving you can recover it.

Outcome: you have created a new, empty wallet whose seed you know the origin of, and you can see it from software without being able to spend from that software.

2Back it up

Your recovery words are the only truly irreplaceable part of the setup. The device can be replaced with an identical one, or a different brand entirely. The software can be reinstalled. The words cannot be reissued by anybody, at any price. Everything in this stage is worth doing slowly.

• Write the words offline, in order, by hand, on the card the device came with or on plain paper. Do not photograph them, email them, type them into a computer, or store them in a password manager.
• Number every word. Order is part of the secret, and an unnumbered list is a puzzle you have set for your future self.
• Complete the wallet's confirmation step when it prompts you. It catches transcription errors while they are still free to fix.
• Check every word is legible to somebody who is not you and who is under stress. Your handwriting is the failure mode here, not your memory.

Paper is where you start, not where you finish

The awkward property of backups is that the situations which make you reach for one are the same situations that destroy paper. A card in a drawer is a perfectly good backup right up until the house is on fire, under water, or being emptied by somebody else.

And paper does not need a disaster to fail. Ink fades in a warm drawer. Damp and mould get into a basement or a garage. A burst pipe two floors up reaches it. Somebody helping you move house sees an unlabelled card of random words and throws it out. None of these announce themselves — you find out at the moment you go looking.

A stamped stainless steel plate closes most of that gap in about an hour. Common stainless steels melt far above the temperatures a house fire reaches, and steel does not care about water, damp, or thirty years in a box. Titanium is higher still. Avoid aluminium, which ordinary structure fires can exceed.

Two things metal is not. It is not theft protection — a plate is exactly as readable to whoever finds it as the paper was, and rather more durable in their hands. And it is not an excuse to keep only one copy. Durability and secrecy are separate problems, and location is still the whole of your defence on the second one.

Durable seed backups

Write down more than the words

The words restore the keys. Finding the coins also needs to know which branch of the key tree to walk down, and a wallet restored a decade from now — or set up with anything other than the current default — may not guess correctly. Keep a short, separate note recording:

• How many words there are, and which wallet or device produced them.
• Whether a passphrase is in use. Not the passphrase, and not in the same place — just the fact that one exists, so your heirs are not restoring an empty wallet and concluding the bitcoin was a story.
• The script type or derivation path, and the full wallet descriptor if you have one. Essential for multisig, and cheap insurance for everything else.
• The master fingerprint and the first receiving address, so a future restore has something to check itself against.
• The date, and where the other copy lives.

None of that is secret on its own, and none of it can spend anything. It is the difference between a restore that works and a restore that shows a balance of zero and no explanation.

Where it lives

• Store the device and the backup separately, so one theft, fire, or flood cannot take both.
• Consider a second copy in a genuinely different building. Two copies in one house is one copy.
• Think about who could find it accidentally, and who could find it deliberately. Those are different lists.
• Never enter the words into a website, a support chat, a recovery tool, or a form. There is no legitimate process that requires another person to see them.

Outcome: the words exist somewhere durable and offline, the device and the backup are not in the same place, and you have recorded the handful of non-secret details a future restore will need.

3Test your recovery

A backup you have never tested is not a backup. It is an assumption — and if you never test it deliberately, the test still happens, at a moment you did not choose.

Most advice stops at "follow the manufacturer's instructions", which is not enough, because the device is not the thing under test. The card on your table is the thing under test. A real recovery drill starts from those words and nothing else, and finishes with a specific value you can compare.

First, decide what a pass looks like

Before you touch anything, write down two things from the wallet you already have:

• The master fingerprint — eight hexadecimal characters, shown by most devices under a settings or advanced menu, and by your wallet software next to the key.
• The first receiving address, in full — every character, including the prefix.

Neither is secret, and neither can spend anything. Without one of them the drill has no pass condition, and "it seemed to restore fine" is not a result.

Then pick the method that matches what you own

All three prove something. They differ entirely in what happens if the backup turns out to be wrong.

A second device, wiped. The most thorough version and the safest one. Take any compatible signing device — a spare, a second unit, a borrowed one you will wipe afterwards — reset it, and enter the words from your card. Only from the card. Then compare the fingerprint and the first address. If they match, your handwriting reproduces the wallet, and your original device was never touched. Wipe the second device again when you are done: a spare quietly holding a live copy of your seed is a new problem, not a spare.

The device's built-in backup check. Most devices offer one, called something like verify backup, dry-run recovery, or seed check. You type the words back in and the device compares them against the seed it already holds, without erasing anything. It is fast, completely safe, and it will tell you plainly if a word is wrong. Its limit is worth knowing: it proves the words match this device's seed. It does not prove they rebuild the wallet anywhere else, and it will not catch a wrong derivation path or a passphrase you have misremembered.

Wipe your only device and restore from the card. This is the real thing — the full chain, end to end, with nothing held in reserve. It is also the one method that turns a bad backup into an immediate and permanent loss. There is exactly one safe moment for it, and it is now, while the wallet is empty. Reset the device to factory settings, enter the words, and watch the same wallet reappear. Done today it costs you twenty minutes. Done after the wallet has a balance, you are betting that balance on your own handwriting.

That last point is the entire reason this stage sits before stage four rather than after it. Prefer a second device if you have one, the built-in check if you do not, and the full wipe-and-restore while there is still nothing to lose.

What counts as a pass

• The restored wallet reports the same master fingerprint.
• The first receiving address matches character for character, prefix included. A different prefix means a different script type, not a different wallet — fixable, but you need to know before you fund it.
• The balance is what you expect it to be, which at this stage is zero.
• If you used a passphrase, run the check twice: once without it, confirming you land in the empty base wallet, and once with it, confirming you land in the right one.
• Wipe whatever you restored onto, unless it is now a key in its own right.

• If anything does not match, stop. Do not fund the wallet. Re-read the card for transposed or misread words — and if it cannot be reconciled, generate a fresh seed and start stage one again. That is an annoying afternoon, not a loss.
• The words go into a signing device's own keypad or screen, and nowhere else. Not a website, not a laptop, not a spreadsheet, not a support chat, however official it looks.

The full recovery drill

Outcome: you have rebuilt this wallet from the backup alone and confirmed it produced the same fingerprint and the same first address.

4Receive bitcoin

Your wallet exists, its backup is protected, and recovery has been proven. Now check the receiving path with an amount that does not matter. Treat this as a test, not a transfer.

• Create a fresh receiving address in your wallet software.
• With a hardware wallet, display the same address on the device screen and compare it to the one on the computer. The device is the trustworthy screen; the computer is not.
• Send a small amount from an exchange or another wallet, and wait for it to confirm.
• Confirm it arrived in the wallet you just recovered, watching from your own software rather than a public block explorer.
• Understand the platform fee, the withdrawal fee, and the network fee before approving. They are three different charges and only one of them is bitcoin's.

The reason for checking the address on the device rather than the computer is specific rather than superstitious. Malware that swaps a bitcoin address on the clipboard is common, cheap, and entirely automated — you copy your address, and something else pastes. The device screen is drawn by the device itself, so an address that matches on both was not swapped in transit.

Once the test amount lands, send some of it back out again. Receiving proves the address. Spending proves the whole loop: that the device signs, that you can approve it, and that the software broadcasts. That is the point at which the wallet is genuinely working rather than merely populated.

Withdraw from an exchange   Send a test transaction

Outcome: a small amount of bitcoin has arrived in a wallet you created, backed up, and proved you can recover — and you have moved some of it out again.

Five questions

Did it land?

One per stage. They are not trick questions, but they are not giveaways either — each one is a place where the intuitive answer is the expensive one.

1. 1Your hardware wallet arrives sealed, and inside the box is a card with twelve words already filled in and a note calling it your recovery phrase. What is it?

   A Your wallet, pre-generated at the factory to save you a step. B A theft attempt. Generate a new wallet on the device and never use those words. C Usable, as long as you add a passphrase so the printed words are not enough on their own.

   Why: No legitimate manufacturer ships a seed. Whoever printed that card can spend from it the moment you fund it, and the third option is worse than it looks — it keeps a seed somebody else knows at the root of your wallet, and now your entire security rests on one passphrase you also have to back up.

2. 2The device's own random number generator is almost certainly fine. So what does rolling ninety-nine dice actually buy you?

   A More randomness than a chip can produce, so a stronger seed. B A seed that is longer, and therefore harder to guess. C Nothing extra, if the generator is fine. The point is that you cannot tell whether it is.

   Why: A 24-word seed is 256 bits either way — quantity is not the issue. The issue is that a weak or rigged generator produces output indistinguishable from a good one, and no test on the finished words can separate them. Supplying the number yourself removes the only step in the process you were taking on faith.

3. 3You imported your cold wallet's xpub into a phone app to watch the balance. Someone takes the phone, unlocked. What can they do?

   A Nothing much — they can see the current balance, but not the history. B Spend the coins, since the xpub is derived from the private key. C See every address and every payment, past and future, but move nothing.

   Why: Derivation runs one way: the xpub yields public keys and addresses, never the private keys, so spending is impossible without a signature from the device. What they get instead is complete and permanent visibility of your finances. That is a privacy loss rather than a theft, which is exactly why an xpub should be treated as private rather than published.

4. 4Which of these actually proves your written backup works?

   A Checking that the words are legible, correctly spelled, and in the right order on the card. B Entering the words into a wiped device and confirming it derives the same fingerprint and first address. C Keeping two copies of the card in two separate buildings.

   Why: The first is proofreading and the third is redundancy — both worth doing, and neither is a test. Only the second one starts from the backup alone and ends with a value you can compare, which is the definition of a test. Two copies of a wrong phrase is still nothing.

5. 5Your wallet software shows a receive address. Why bother comparing it against the hardware wallet's own screen?

   A Because malware on the computer can show you an address that is not yours. B Because the device stores addresses that the software does not know about. C Because it confirms the address has not been used before.

   Why: The computer is the part of the setup you cannot vouch for, and clipboard-swapping malware is cheap and fully automated. The device's screen is drawn by the device itself, so matching the two is the one check that catches a substitution — and it is per-address, every time, not once at setup.

What comes next?

Understand what you own

You now have a working wallet and a small test balance. Before moving an amount you would not want to lose, learn what the wallet is actually controlling.

A bitcoin wallet does not hold coins the way a physical wallet holds notes. It holds the keys that authorise transactions. The bitcoin itself remains recorded on the network as individual spendable outputs.

• Private key — the secret that authorises a spend.
• Recovery words — backup material that can recreate every key in the wallet.
• Address — a destination you can share to receive bitcoin.
• UTXO — one individual chunk of bitcoin your wallet can spend. Your balance is a collection of these, not a single number.

Understand what you own

Keep it working

• Check backups periodically for legibility and environmental damage.
• Keep an inheritance instruction that explains the process without exposing the secret.
• Download wallet software only from official sources, and verify releases where supported.
• Re-evaluate single-signature versus multisig as the amount and the consequences change.

Read the failure modes next

These four stages describe what to do. What not to normalize describes the ordinary habits that quietly undo them, and it is worth reading before you move an amount you would miss.