Specter: coordinating a multi-brand multisig

Specter Desktop is not really a wallet. It is a graphical face for Bitcoin Core, built for people who already run a node and want to drive hardware signers — particularly several of them at once, from different manufacturers, in a multisig.

That architecture is unusual and it is the entire reason to choose it. Specter has no servers of its own. It asks your node about your coins, and there is no third party anywhere in the arrangement.

This page assumes you have already decided what your multisig should look like — how many keys, from which makers, stored where. That guide covers the choices. This one covers the mechanics of actually building it in Specter, which is the part it leaves to the coordinator.

1What Specter actually is

Most wallet software bundles two jobs: a user interface, and a source of blockchain data. Sparrow and Electrum both ship with public servers configured, so they work the moment you install them.

Specter does only the first job. It has no data source of its own and no fallback — it talks exclusively to a Bitcoin Core node you provide. Install it without one and it does nothing at all.

That is a deliberate design, not an omission, and it produces the property the next section is about.

2Why this matters more for multisig

When a wallet asks somebody else's server for your balance, it hands over the keys to watch you. For a single-signature wallet that means one extended public key. For a multisig it is worse.

A multisig is described by an output descriptor — a string containing every co-signer's extended public key, the policy, and the derivation paths. It is the complete specification of your wallet. Hand it to a third-party server and that server can derive every address you will ever use across all of your devices, permanently.

A multisig descriptor is a more complete description of your finances than any single xpub. It is the last thing you want sitting on somebody else's server.

Specter's node requirement removes that question entirely. Your descriptor goes to Bitcoin Core, running on your machine, and nowhere else. Why run a node makes the general case; multisig is where it stops being philosophical.

3The cost, stated honestly

Bitcoin Core is a serious piece of infrastructure and this is where most people abandon the plan, so it is worth being upfront.

• Disk. A full node stores the entire chain — several hundred gigabytes and growing. Pruning reduces that substantially, but complicates rescanning when you import an existing wallet with history.
• Time. The initial sync verifies the chain from the beginning. Expect days on ordinary hardware, not hours.
• Uptime. Specter is only useful when the node is running. A node that lives on a laptop you close is a coordinator that is frequently unavailable.
• Maintenance. It is another thing to update and keep healthy, indefinitely.

If that is more than you want, Sparrow with your own Electrum server is a lighter route to a similar privacy position, and Sparrow connected to a public server is still a perfectly reasonable multisig coordinator — it simply makes the trade this guide is trying to avoid.

4Connecting Specter to your node

• Get Bitcoin Core running and fully synced first. Do not start Specter until the node is caught up; nothing will work properly and you will misdiagnose it.
• Verify the Specter download before installing. Releases are signed, and a coordinator is exactly the kind of software worth checking.
• Point Specter at the node. On the same machine it will usually detect Core automatically. Otherwise supply the host, port, and RPC credentials.
• Confirm the connection and block height in Specter before going further.

5Adding the devices

Each signer is added to Specter individually, as a device, before any wallet exists. What you are importing is public keys — no private key ever enters Specter.

• Add each device and choose how it connects: USB for Trezor, Ledger, BitBox02 and similar; microSD file import for COLDCARD; QR for SeedSigner, Keystone, and Passport.
• Import the extended public keys by file or QR rather than typing. A single mistyped character produces a wallet nobody can spend from.
• Check the fingerprint shown in Specter against the one on each device. This is how you know Specter is describing the device in front of you.
• Name each device for the physical object, not the brand — COLDCARD in the safe beats coldcard1 when you are recovering under stress in five years.

6Building the wallet, and registering it back

• Create a new multisig wallet in Specter, set the policy — 2-of-3 for most people — and select the devices you added.
• Choose the script type and leave it consistent across everything. Native SegWit is the sensible default.
• Export the wallet configuration immediately, before doing anything else.
• Register that configuration on every device that supports it. COLDCARD, Jade, BitBox02, Passport, Keystone and others accept a multisig configuration file or QR.

That last step is the one to take seriously, and it is worth knowing precisely why rather than treating it as a formality.

7Signing across three brands

Here is where a multi-brand multisig stops being theoretical. Each manufacturer moves transactions differently, and a single payment may involve two or three different mechanisms.

• Build the transaction in Specter. It produces a PSBT.
• Take it to the first signer by whichever route that device uses, and verify amount, destination, fee, and change on the device screen.
• Bring the partially signed result back into Specter.
• Repeat with the second signer — likely a different transport entirely.
• Specter combines the signatures, finalises, and broadcasts through your node.

Collecting signatures one device at a time, in whatever order suits you, is the normal rhythm. Nothing is lost by pausing halfway; an unsigned or partially signed transaction has moved no money.

8What to back up

This is where multisig wallets are actually lost, and the failure is never the cryptography.

• Every seed backup, one per device, stored apart from each other.
• The wallet configuration file — the descriptor — stored with every one of those seed backups. Seeds alone will not rebuild a multisig.
• A note naming the coordinator, the policy, and the script type, so a future you knows what they are looking at.
• A rehearsal. Restore the wallet from the descriptor plus two devices on a clean machine, before it holds anything.

The multisig guide goes into why the configuration is the thing that kills these wallets. Specter makes exporting it easy, which removes every excuse for not having done it.

9Where Specter fits

• Choose Specter if you run a node already, or intend to, and want a coordinator whose privacy properties require no configuration because it has no alternative.
• Choose Sparrow if you want a capable multisig coordinator without a node requirement, and are willing to point it at a server — ideally your own.
• Choose Nunchuk if you need shared or collaborative arrangements across people and phones.

All three build the same wallet. A multisig created in one can be rebuilt in another from the descriptor and the devices, which is worth knowing: you are not marrying the software.

The short version

Specter is a front end for your own Bitcoin Core node, which means your multisig descriptor — the most complete description of your finances that exists — never leaves your machine. The price is running and maintaining a node. Add each device, build the wallet, register the configuration back onto every signer, and store that configuration with every seed backup.