SeedSigner: build and first use

A SeedSigner is about fifty dollars of commodity electronics that you assemble yourself: a Raspberry Pi Zero, a small screen with a joystick, and a camera. There is no secure element, no company standing behind it, and nothing is sealed in a tamper-evident bag. It signs bitcoin transactions as capably as devices costing ten times more.

What makes that work is a design decision rather than a component. The device is stateless: it holds your seed only while powered on, and forgets it completely the moment you unplug it. There is nothing on the hardware to steal, which is why the hardware does not need to defend itself.

The trade is that you perform the security yourself — the checks a manufacturer would normally have done are now your job, and there is one in particular you must not skip. Budget an evening.

The three SeedSigner components laid out unassembled on a workbench: a Raspberry Pi Zero, a Waveshare 1.3 inch LCD hat with its joystick, and a small camera module with ribbon cable.

Image to come

1What you are actually building

Every other device in this section arrives finished. Someone chose the components, wrote the firmware, sealed the box, and put their name on the result. You check the seal and inherit their work.

Here you are the manufacturer. Nobody vetted your parts, and the tamper-evident bag does not exist. In exchange you get a device with no proprietary silicon, an image you can rebuild from source, and no supply chain to compromise except the one you ran yourself.

Two consequences shape the whole build:

• Verifying the image is not optional here. On a sealed device the bag is your integrity check. On this one, the signature on the software is the only one you get. Step 3 is the most important step on this page.
• Wireless hardware you do not use is still wireless hardware. The SeedSigner image never touches WiFi or Bluetooth, but a Pi Zero 1.3 cannot use them because the radios are not on the board. That is a stronger statement than trusting software to leave them off, and it is why the 1.3 is preferred.

SeedSigner hardware list   SeedSigner source and releases

• There are no official vendors. The project endorses nobody, so judge sellers on their own reputation rather than assuming a listing is legitimate.
• Buy the 240×240 Waveshare screen specifically. Ordering the wrong lookalike is the single most common way a build fails, and it fails after assembly rather than before.

2Assembly

Mechanically this is a ten-minute job, assuming your Pi came with its GPIO header already soldered. If it did not, that is the one step needing an iron — forty pins, or a repair shop and a coffee.

• Seat the screen on the GPIO header. The hat covers the 40-pin connector, aligned from the pin-1 corner. It only goes on one way round.
• Connect the camera to the CSI port with its ribbon cable, contacts facing the correct side for your Pi. The connector lifts, the ribbon slides in, the connector presses back down.
• Leave the enclosure until it boots. Confirm the thing works before committing it to a case, because taking it apart again to reseat a ribbon is irritating.

3Verify the image, then flash it

This is the step that replaces the tamper-evident bag, and skipping it means running software of unknown origin on a device you are about to show your seed to.

Download the release image along with its checksum file and the signature of that checksum file. Then, on your computer, three commands do the work — substituting the version you actually downloaded:

• Fetch the project's signing key: gpg --fetch-keys https://keybase.io/seedsigner/pgp_keys.asc
• Verify the checksum file was signed by that key: gpg --verify seedsigner.0.8.7.sha256.txt.sig
• Verify the image matches the checksum: shasum -a 256 --ignore-missing --check seedsigner.0.8.7.sha256.txt

The first command establishes which key you are trusting. The second proves the checksum list came from that key. The third proves your download matches the list. All three have to pass; any one of them alone proves very little.

Once verified, write the image to the microSD card with Raspberry Pi Imager or Balena Etcher, and put the card in the Pi.

4First boot, and the stateless model

Power it on and it comes up in seconds with no setup wizard, no PIN, and no wallet. It is genuinely empty, and it will be empty again every time you power it on.

This is the part that surprises people arriving from other devices. A COLDCARD remembers its seed and defends it with a PIN and a secure element. A SeedSigner remembers nothing, so there is nothing to defend. Every session begins by loading a seed and ends, at power-off, by forgetting it.

• Nothing persists. A SeedSigner recovered from a drawer, or from a thief, holds no key material at all.
• You re-enter the seed each session. By typing the words, by dice, or by scanning a SeedQR — see step 6.
• The threat model moves. Your security no longer rests on the device resisting attack. It rests on where your words live when the device is off, and on nobody watching the screen while they are on it.

5Creating a seed on the device

The SeedSigner can generate a seed for you, and it offers two sources of randomness rather than asking you to trust a chip you cannot inspect.

• Dice rolls. You roll, it converts. This is the most transparent option available on any device and is covered properly in rolling your own entropy.
• Image entropy. The camera photographs something unpredictable and derives randomness from the sensor data.

Write the resulting words down immediately, on paper or metal, in order. On a stateless device this is not a backup step you can defer — if you power the thing off before recording them, the wallet is gone, and there is nothing anywhere to recover it from.

• The dice-to-seed method changed in 2022, so rolls recorded on older firmware will not reproduce the same wallet today. Your words are the backup; the rolls are working paper.
• Decide your passphrase policy now. The device supports a BIP39 passphrase, and a passphrase you cannot reproduce is a wallet you cannot open.

6SeedQR, and the trade it asks of you

Typing twenty-four words on a joystick every session gets old within a week, so the project offers SeedQR: your seed encoded as a QR code that the camera reads instantly. The device walks you through transcribing it by hand onto a blank grid, so the code is created by you rather than printed by anything.

It genuinely solves the usability problem. It also changes the shape of your risk, and this is worth sitting with before you make one.

Written words have to be read, understood, and typed. A SeedQR only has to be photographed. Convenience for you is convenience for anyone who gets a look at it.

• A photograph of a SeedQR is your wallet. No transcription, no reading skill, no delay — a glance from a phone camera is enough.
• Store it as you would the words themselves, which for most people means not in the same place as the device, and never anywhere a camera can see.
• It is not a substitute for the written words. Keep the plate. A damaged or unreadable QR with no word backup is a total loss.

7Signing a transaction

Nothing is plugged in, ever. The SeedSigner and your wallet software talk in QR codes across the air gap, and the round trip goes like this:

• Your wallet software builds an unsigned transaction — a PSBT — and shows it as a QR code on the computer screen.
• You load your seed on the SeedSigner, then point its camera at that code.
• The device shows you what you are signing. Amount, destination, fee. Read it here, on the device, not on the computer.
• You approve, and the SeedSigner displays the signed result as a QR code.
• Your wallet software reads that code with a webcam and broadcasts the transaction.

The device supports single-sig and multisig, exports xpubs for both, and handles taproot, native segwit, nested segwit, and legacy address types — so it pairs with essentially any modern wallet software.

8Verify before you fund it

Everything so far is an assumption until you prove it, and on a DIY device that proof matters more, not less.

• Export the public keys to your wallet software as a watch-only wallet, and confirm the fingerprint shown on the device matches the one in the software.
• Power the SeedSigner off completely, then reload your seed from your written words — not from a SeedQR — and confirm you reach the same wallet. This tests your backup and your transcription in one go.
• Send a small test amount, confirm it arrives, then sign a transaction sending it back out. Only then is the whole loop proven.
• Note the firmware version you used, since the dice method belongs to that version.

If the fingerprints disagree, stop. The software is watching a different wallet from the one the device will sign for, and every address it offers you would be wrong.

The short version

Buy the right screen, assemble three parts, and verify the image signature before flashing it — that check is the only supply-chain protection a DIY device has. Then treat the device as disposable and the words as everything, because the SeedSigner is designed to hold nothing at all when it is switched off.