Set up an air-gapped signer: SeedSigner or Jade

After this lesson you can: hold bitcoin on keys that have never touched an internet-connected computer, and verify a receive address on a screen malware cannot change.

Two tracks

SeedSigner is an open-source signing device you build from a Raspberry Pi Zero, a camera and a small screen, or buy pre-assembled from community sellers. It is stateless: it holds no seed when powered off. You load the seed each time by scanning a SeedQR, typing the words, or generating a new one from dice or a photo. Everything in and out is a QR code. There is no company, no account, no USB.

Blockstream Jade is a small commercial device with open-source firmware. The Jade Plus has a camera for fully air-gapped QR use; the original Jade can also work over USB or Bluetooth with Blockstream Green. Jade has no secure element chip; instead it protects the PIN with a "blind oracle" server, and it offers anti-exfiltration signing, which matters after lesson 3.

Either device does the one job that matters: the private key lives on a machine that is never online, and you confirm what you are signing on its own screen.

Before you start

Buy from the maker or a reseller the maker lists, never second-hand. If anything arrives with a pre-printed seed phrase, it is a scam: stop and contact the maker. For a SeedSigner kit, you will download the firmware image yourself and can verify its signature (lesson 7); that is a feature.

Steps

1. 01Firmware. SeedSigner: download the image from the project's GitHub releases, verify it, flash it to the microSD card, assemble. Jade: connect to the Blockstream Green app and let it check and update the firmware.
2. 02Create the seed on the device. SeedSigner: Tools, then Create a seed, and choose dice (50 rolls for 12 words, 99 for 24) or a camera image. Jade: when it offers to create a new wallet, use the "advanced" option to add your own dice entropy if available, otherwise accept the device seed and consider a passphrase later. Never import a seed from a website or a card that came in the box.
3. 03Write the words in order, numbered, on paper, exactly as shown on the device screen. On SeedSigner you may also export a SeedQR to paper; store it as carefully as the words.
4. 04Verify. Both devices make you confirm the words. On SeedSigner, power off, power on, and load the seed again from your written copy before you fund anything.
5. 05Set a PIN (Jade) or, on SeedSigner, note that there is nothing to unlock: the device forgets the seed, so your paper is the whole backup.
6. 06Export the public key. Both devices show an xpub (or descriptor) as a QR code. Scan it with your desktop or mobile wallet (next lesson) to create a watch-only wallet that can see balances but cannot spend.
7. 07Receive a test. Generate an address in the watch-only wallet, then verify the same address on the signer's own screen. Send a few dollars from your exchange and watch it confirm.
8. 08Send a test back. The wallet builds the transaction and shows it as a QR; the signer scans it, shows you the destination and amount, you confirm on the device, and it shows a signed QR to scan back. Broadcast.
9. 09Store the paper safely. Lesson 6 covers the options.

Check your work

Imagine the device is lost or broken. Could you recover from the paper alone? With SeedSigner you can test this at any time: it has nothing to reset. With Jade, test with a small balance before it matters.