Taking Control

Once you understand Bitcoin (Bitcoin 101) and you're ready to own your keys, the next question is: what do you actually use to hold, send, and watch your Bitcoin, privately and on your own terms?

For the desktop, our answer is Sparrow, a free, open-source, Bitcoin-only wallet built for people who want total transparency and control. It's the closest thing to a personal Bitcoin command centre.

1. What Sparrow Is

Sparrow is an open-source (Apache 2.0) desktop wallet led by developer Craig Raw, running on Windows, macOS, and Linux. It is Bitcoin-only: no altcoins, no distractions, no clutter. And it's built, in its own words, "for those who value financial self-sovereignty."

Importantly, Sparrow is best used as the interface to your Bitcoin, while your actual keys live offline on a signing device. Sparrow coordinates and watches; your device signs. That separation is what makes it both powerful and safe.

2. Why Sparrow: Privacy and Control

Most wallets hide the machinery from you. Sparrow does the opposite. It puts every detail in your hands:

• Connect to your own node. Sparrow can talk to your own Bitcoin Core node or a private server, so you verify your own transactions and never leak your addresses and balances to a stranger's server. It also offers public servers with built-in Tor.
• Total transparency. A full transaction editor that doubles as a blockchain explorer lets you inspect every input and output. You can label every transaction, coin, and address.
• Coin control. Choose exactly which coins (UTXOs) you spend, with comprehensive coin and fee selection, so you manage your privacy and your fees deliberately, not by accident.
• Bitcoin-only focus. Single-sig and multisig support on the common script types, full PSBT support, and testnet/signet for practice, all aimed at one asset, done well.

3. Pair It With a Signing Device

Sparrow shines when paired with a signing device (you will see these sold as "hardware wallets," but the device holds keys, not coins, and its real job is signing). In this setup Sparrow holds no keys. It builds the transactions, and your offline device signs them. Sparrow supports the common devices in both USB and air-gapped modes (signing via QR codes or microSD, so the keys never touch your computer). A Bitcoin-only device that pairs beautifully with it:

Sparrow supports other Bitcoin-only signing devices too, in both USB and air-gapped modes. See Sparrow's documentation → for the full list and setup guides.

4. Run Your Own Node

Self-custody answers "who holds my keys?" Running your own node answers "who do I trust to tell me the truth about the blockchain?" When Sparrow connects to your own Bitcoin Core node, you check the rules yourself and keep your wallet activity private. If you're not ready to run a node yet, Sparrow's public servers over Tor are a solid privacy-respecting starting point, and you can switch to your own node later.

5. Is Sparrow Right for You?

Sparrow is a desktop power-user wallet. It has more features (and more buttons) than a simple phone wallet, and that's the point: it's for people who want to hold serious savings with privacy and full control, paired with cold storage. If you're brand new, get comfortable with Bitcoin 101 first, then grow into it. For an everyday phone wallet you'd choose something simpler; for your long-term Bitcoin, Sparrow is hard to beat.

6. What You'll Need

• A desktop computer (Windows, macOS, or Linux) to run Sparrow.
• A Bitcoin-only signing device: SeedSigner is an excellent match.
• A metal backup plate for your recovery words (paper survives neither fire nor flood).
• Optional but recommended: your own Bitcoin node for maximum privacy.
• Pen, paper, and a little patience.

7. Verify Before You Install

Sparrow is the coordinator: it builds every transaction, shows you every receive address, and holds the public keys that reveal your whole balance and history. That makes a tampered copy of Sparrow the single most valuable attack on this entire setup. A fake build can swap a receive address, quietly send your xpubs to a stranger, or hand your signer a transaction that pays someone else. Your signing device's screen catches the first trick. It cannot catch the other two. So before Sparrow ever touches your wallet, prove that the file you downloaded is the one Craig Raw actually published.

Every Sparrow release ships with two small extra files: a manifest (sparrow-2.5.4-manifest.txt, the SHA-256 hash of every installer) and the manifest's PGP signature (sparrow-2.5.4-manifest.txt.asc). Verification asks two questions: did Craig Raw sign this manifest, and does my installer's hash match what the manifest says? Download all three files into the same folder (Downloads is fine), swap in the current version number wherever you see 2.5.4, and work through the steps for your system.

Step 1: Get the tools

• Linux: gpg and sha256sum are almost certainly installed already. If gpg --version complains, install the gnupg package with your distribution's package manager.
• macOS: shasum is built in, but GPG is not. Install it with Homebrew (brew install gnupg) or install GPG Suite from gpgtools.org, then open Terminal for the rest.

Step 2: Import the signing key and check its fingerprint

Identical on both systems:

curl https://keybase.io/craigraw/pgp_keys.asc | gpg --import
gpg --fingerprint craig@sparrowwallet.com

The second command prints the key's fingerprint. It should read exactly:

D4D0 D320 2FC0 6849 A257  B38D E946 1833 4C67 4B40

Do not take our word for it. Compare it against the fingerprint on Sparrow's own download page and on keybase.io/craigraw. Three independent sources agreeing is the whole point. If any one of them disagrees, stop and ask before going further.

Step 3: Verify the manifest's signature

cd ~/Downloads
gpg --verify sparrow-2.5.4-manifest.txt.asc

You want to see Good signature from "Craig Raw <craig@sparrowwallet.com>". You will also see a warning that the key "is not certified with a trusted signature." That is normal: GPG is pointing out that you have not personally vouched for this key, and the fingerprint check in step 2 is what stands in for that. What you must never see is BAD signature.

Step 4: Check the installer against the manifest

• Linux: sha256sum --check sparrow-2.5.4-manifest.txt --ignore-missing
• macOS: shasum --check sparrow-2.5.4-manifest.txt --ignore-missing

The manifest lists every build for every platform, and --ignore-missing tells the tool to check only the file you actually have. A good result is a single line, such as sparrowwallet_2.5.4-1_amd64.deb: OK on Linux or Sparrow-2.5.4-aarch64.dmg: OK on an Apple silicon Mac. Both checks passed? Now install.

Step 5: Let Sparrow verify its own updates

Here is the payoff. Once you are running a copy of Sparrow you verified by hand, every later update can be checked inside the app: download the new installer, manifest, and signature into one folder, then open Tools → Verify Download (or drag any of the three files onto the Sparrow window). It checks the signature against Craig Raw's key and the installer's hash against the manifest, and tells you plainly whether the download is good. It can be pointed at other projects' signed releases too, such as Bitcoin Core or signing-device firmware, which makes it a handy classroom for the whole idea.

The honest caveat: the tool can only vouch for the next version, because the copy doing the checking is the one you already trust. That is why the first install gets the manual treatment above. Skip it, and you are asking a possibly fake Sparrow whether it is real.

8. Setting Up Sparrow (The High-Level Path)

This is the shape of the process. For the exact click-by-click, follow Sparrow's own up-to-date documentation, linked at the bottom.

• Download from the official source only: the Sparrow download page.
• Verify the download exactly as in section 7 above. It is the one step here that is not optional.
• Choose how you connect: your own Bitcoin Core node or private server for full privacy, or a public server over Tor to start.
• Import your signing device into Sparrow as your wallet. Your recovery words are generated and stored on the device. Write them on paper, then metal, never as a digital file, screenshot, or photo.
• Back up your wallet. Keep your recovery words safe, and for a multisig wallet, also back up the wallet output descriptor (the map of your keys), which you'll need to restore it.
• Receive a small test amount first, and verify the receive address on your signing device's own screen before sending anything real.
• Label as you go. Naming your coins and transactions keeps your privacy and bookkeeping clean from day one.

9. The Golden Rules of Self-Custody

• Your recovery words are the keys. Never type them into a website, app, or "support agent" chat. No legitimate person or wallet will ever ask.
• Keep them offline. No photos, no cloud, no password managers, no email. Metal backup, stored privately.
• Verify addresses on the device. Always confirm a receive address on your signing device's own screen. Malware can change what your computer shows.
• Start small. Move meaningful funds only after a test send and a recovery dry run.
• Beware impersonators. Scammers pose as wallet "support" on Telegram, X, and Discord. Limestone City Bitcoin will never DM you first or ask for your recovery phrase.

Limestone City Bitcoin is not affiliated with Sparrow Wallet. This guide is educational and is not financial or legal advice.