What’s inside the vault

Features

How SafeKeepVault keeps your keys offline, and the tools that come with it.

Built to stay offline

SafeKeepVault starts your computer in a locked-down system that can’t go online and doesn’t touch the computer’s own drive. There’s nothing to configure: this is how it starts every time.

  • No way online Every network, Wi-Fi, Bluetooth, NFC and USB-network driver is removed from the system, along with the terminal, the file manager and the compilers. A watchdog switches off any network connection that appears and shows a red warning. For the strongest air gap, also unplug the network cable.
  • Checks itself first Before you can enter anything, the vault runs published Bitcoin test cases (seed words, keys, addresses, signatures) through its own code. If this computer gets a single answer wrong, the vault stops instead of risking a wrong key or address.
  • Blocks fake keyboards It talks only to your screen, keyboard, mouse, camera, the flash drive, a Coldcard or Trezor One if you co-sign with one, and a USB printer if you print a SeedQR. It never prints over a network. About 30 seconds after it starts, any newly plugged-in keyboard or mouse is blocked, so a USB device pretending to be a keyboard can’t type commands.
  • Leaves your computer untouched SafeKeepVault runs from memory and never opens your computer’s own drive, so nothing from a session is written to it. Keys are cleared from memory when you lock or shut down.

Keep your seed, or keep nothing

  • Encrypted vault Store your seed, passphrases, wallets and notes on the flash drive, encrypted with AES-256. Unlock it by typing your password, or by showing a QR code of it from your phone to the camera.
  • Or keep only the vault With Seed storage turned off, the flash drive keeps your passphrases, saved wallets and notes but not your seed. You scan your SeedQR or type your words each time you start, so someone with the flash drive and its password still can’t spend. Keep your SeedQR and written words safe: they are then the only copies.
  • Temporary Session Load a different seed for one session, for example a second key of a multisig wallet. Nothing from it is saved, and you can go back to your vault without restarting.
  • A real lock Locking clears your keys from memory and closes the encrypted vault, back to the password prompt. An Auto-Lock timer can do it for you.
  • No device to order There’s no order or shipping record tied to a Bitcoin device. The flash drive itself isn’t disguised, though: its startup menu and drive names say SafeKeep, so keep it as private as the hardware wallet it replaces.

18 tools

Everything you need to create, back up and use your keys, from your first seed to signing a multisig payment. Each tool works offline and produces standard formats your wallet app understands.

  • PSBT SignerCheck and sign a transaction
  • Show an addressShow the next receive address as a large QR code
  • Connect a wallet appStep-by-step watch-only setup for your wallet app
  • Seed ManagementView seed words, public keys and addresses, and keep up to 20 more seeds in the Seed Vault
  • Transfer HubManage files on the Transfer Drive
  • Entropy GeneratorCreate a seed from dice, cards or other randomness
  • BIP-85 Child SeedsMake separate seeds from your main one
  • Seed QR CodeTurn your seed into a QR code, then trace it, copy it square by square or print it over USB, with a line to cut along
  • Passphrase LibrarySave and load passphrases
  • Output DescriptorBuild, import, check and save wallets
  • Seed XOR SplitterSplit your seed into XOR shares
  • Shamir BackupSplit your seed into Shamir shares
  • Encrypted BackupBack up the whole vault to one encrypted file
  • Wallet RecordPrint a one-page record of a wallet
  • Message SignerProve you own an address
  • Courier ToolSend data to another device by QR code
  • Encrypted NotesKeep private notes in the vault
  • 2FA BackupBack up authenticator app codes
SafeKeepVault Dashboard: wallet card with the seed nickname, Health, five everyday task tiles, and all tools grouped into Keys and Seeds, Backup and Recovery, Signing and Transfer, and Private Data
The SafeKeepVault Dashboard — your wallet and its health at the top, tiles for the everyday tasks (sign, show an address, connect a wallet app, transfer files, back up), then every tool grouped into Keys & Seeds, Backup & Recovery, Signing & Transfer, and Private Data.
Entropy Generator — SafeKeepVault's seed generation tool
The Entropy Generator — mix physical dice rolls, a shuffled deck of cards, mouse movement and camera noise into your master seed, or use Verifiable Dice to create a seed you can check on SeedSigner or COLDCARD. Draw Your Own Words makes a seed from words you draw by hand and coin flips, and SafeKeep works out the last word.
PSBT Signer — SafeKeepVault's transaction signing tool, showing the ingest, review, sign, and export workflow
The PSBT Signer — review and sign Bitcoin transactions entirely offline. Load an unsigned PSBT via QR code, a file sent with The Courier, or the Transfer Drive, then export your signature back across to your wallet software. The review shows the total leaving your wallet, the inputs being spent and which of your saved wallets they come from, and lets you compare each payment address with the one you were given. Nothing is committed until you've verified it yourself.
Encrypted Notes — SafeKeepVault's vault notes tool, showing a rich-text editor stored inside the encrypted vault
Encrypted Notes — store recovery instructions, multisig coordination details, or configuration notes sealed inside your encrypted vault. Protected by full-disk encryption.
Wallet Record — the descriptor-first form: add the wallet, then name each key and note which need a passphrase
The Wallet Record — add your output descriptor (from the Output Descriptor tool or any wallet app) and the vault works out the wallet type, keys and first receive address. You name each key and note which need a passphrase, then print a clean one-page summary for long-term offline storage and inheritance planning.

Works with the wallets you already use

Your usual wallet app keeps track of your balance using only your public key, so it can see your bitcoin but can’t spend it (a watch-only wallet). When you want to spend, it prepares the payment and passes it to SafeKeepVault by QR code or on the flash drive. You check it, sign it offline and pass it back for your wallet app to send.

Step-by-step setup guides: BlueWallet · Nunchuk · Sparrow · Specter · Electrum · Bitcoin Core

Multisig

SafeKeepVault can hold one key of a 2-of-3 or larger multisig wallet alongside a Coldcard, Trezor or other signing device, or hold several keys itself for one session. A Coldcard or Trezor One can also plug straight into the vault: it reads the device’s key when you set up the wallet, and asks it for its signature after the vault adds its own. You approve each signature on the device’s own screen. A COLDCARD’s encrypted backup can also be brought in, over USB, with the Courier or from the Transfer Drive, to restore its wallet or add its multisig wallets and notes to your vault. SafeKeep can also send a COLDCARD a passphrase or a seed over USB, so you don’t type it on the COLDCARD’s keys, and a seed kept in the Seed Vault can be a cosigner key. If one vault would hold enough keys to spend, SafeKeep warns you.

Download

SafeKeepVault is free. The download page shows how to check that your copy is genuine and put it on a flash drive.

Download ♡ Donate