A signing device is only as trustworthy as its setup. The hardware matters less than the habits: verify what you run, keep it air-gapped, prove every backup, and test with pocket change before real money. This guide walks that path with SeedSigner as the reference device, but the steps apply to any Bitcoin-only, air-gapped signer.
1. Source It Safely
Supply chains are an attack surface. If you build a SeedSigner, buy generic parts (a Pi Zero, screen, and camera) from ordinary electronics sellers; their anonymity is the security feature, since nobody can target parts that were never labelled "bitcoin wallet." If you buy any ready-made signer, order directly from the maker, never a marketplace or a used unit, and inspect packaging and tamper seals before first boot. Give the whole process a private room: no cameras, no phones, no observers.
2. Verify the Software
Download the device's software only from the project's official releases page, and verify the signature or checksum before flashing or installing. This is the step people skip, and it is the one that catches a tampered download. Open-source projects with reproducible builds (SeedSigner among them) publish exactly what you need to check that the code you flash is the code the community reviewed.
3. Load Your Seed
Two good options, one rule. The options: generate the seed on the device using your own entropy (SeedSigner takes dice rolls or a camera snapshot), or generate it entirely yourself first with the DIY dice method and enter the words. The rule: the seed is born offline and stays offline. Write the words on paper, then metal, and never photograph or type them into anything with a network connection.
Add a passphrase now if you plan to use one, so every later step tests the real configuration. On a stateless device like SeedSigner there is nothing stored to protect with a PIN; the seed lives on your backup and, during a session, in your hands. A SeedQR backup is worth making too, so you can reload the seed by camera in seconds.
4. Pair It With Your Wallet, Air-Gapped
Connect the signer to Sparrow as a watch-only wallet: the device shows its public key information as a QR code, Sparrow scans it, and from then on Sparrow tracks your balance and builds transactions while holding no keys at all. Spending is a QR conversation: Sparrow displays the unsigned transaction (a PSBT), the signer reads it, signs it, and shows the signed result back. No cable ever links your keys to a computer, which is exactly how we like it.
5. Test Before You Trust
- Verify the receive address on the device screen, not just in Sparrow. Malware can repaint a computer screen; it cannot repaint your signer.
- Receive a small test amount and watch it confirm.
- Send it back out, reviewing amount, address, and fee on the device before approving.
- Run a full backup verification: prove the written seed regenerates the same wallet before serious funds arrive.
⚠️ The order matters. Verify software before flashing, verify addresses on the device before receiving, verify the backup before funding. Every major loss story skips one of those three checks. Skip none, and a mistake costs you a test amount instead of your savings.
Next steps. Read the full SeedSigner guide, prove your backup with backup verification, or level up to multisig. We set devices up together at meetups, too.