How to Secure Your SeedSigner with COLDCARD

Use Coldcard as the offline source of a separate SeedSigner wallet by deriving a BIP-85 child mnemonic and loading that child into SeedSigner. Never load your Coldcard master seed. SeedSigner receives one dedicated child and forgets it when power is removed.

This preserves SeedSigner's stateless model while giving the wallet a deterministic recovery root. It does not make the seed absent during a signing session or make a compromised SeedSigner safe.

Verified scope: Menu labels and SeedQR behavior were checked against current official SeedSigner source on July 10, 2026. SeedSigner hardware is assembled by users and vendors, so verify the exact board and software image in your possession.

Why pair two Bitcoin-only devices?

Coldcard is deliberately Bitcoin-only. Some users keep a multi-asset signer because they need stablecoins or networks Coldcard will not support. SeedSigner is not that device: it is also Bitcoin-only.

The reason to pair SeedSigner with Coldcard is different. SeedSigner provides a stateless, camera-based QR workflow on inexpensive, auditable hardware. It can be useful for a distinct Bitcoin signing architecture, repeated SeedQR loading, or a multisig setup that benefits from a visibly air-gapped signer.

If you also need stablecoins, assign a different BIP-85 child to a compatible multi-asset device. Do not reuse the SeedSigner child there. Each device role should have its own failure domain and recovery record.

Use a child seed, not the master

Loading the Coldcard master words into SeedSigner would expose the recovery root whenever SeedSigner is powered. A child limits that exposure to one wallet role.

Coldcard parent
└── BIP-85: BIP-39 / English / 24 words / index N
    └── SeedSigner child
        └── Single-sig wallet or one multisig cosigner

The same Coldcard parent context and index reproduce the child. A compromised child does not reveal the parent through BIP-85. A compromised parent can recreate every child.

SeedSigner itself supports BIP-85 child generation. Using Coldcard as parent is a choice to place the recovery root on Coldcard, not a claim that SeedSigner lacks the feature.

Verify the SeedSigner build

SeedSigner is software running on user-selected Raspberry Pi hardware. “Air-gapped” depends on what you built.

The project's preferred Raspberry Pi Zero 1.3 has no Wi-Fi or Bluetooth hardware. Pi Zero W and Zero 2 W boards do contain radio hardware even when software disables it. Check the board marking instead of assuming every compatible board is radio-free.

Before loading a child:

Obtain the image and verification files from the official SeedSigner release.
Follow the project's signature and checksum instructions.
Prefer reproducible-build verification when your skill and process allow it.
Boot the verified image, then remove the MicroSD card if that is part of your operating procedure.
Confirm the camera and display behave as expected before any seed entry.

Coldcard can control seed origin. It cannot verify the SeedSigner board, operating-system image, camera, or enclosure for you.

Before you start

Use an empty SeedSigner session. Power off first so no unrelated seed remains in memory.

You need:

a Coldcard Q or Mk5 with the intended parent;
a verified backup of that parent;
a checked SeedSigner hardware and software build;
a private workspace without cameras or observers;
an offline SeedQR template if you plan to make one;
a compatible Bitcoin coordinator such as Sparrow;
paper for BIP-85 and wallet-configuration metadata.

Avoid an unintended Coldcard passphrase or temporary seed. The same parent context would be required during recovery.

Derive and load the SeedSigner seed

1. Confirm the parent

Sign in to the Coldcard wallet that will be the parent. Confirm its backup and verify that no unintended passphrase or temporary seed is active.

2. Open BIP-85

Use the model-specific path:

Mk5 and Mk4: Advanced/Tools > Derive Seed B85
Q: Advanced/Tools > Derive Seeds (BIP-85)

Choose BIP-39, English, and 24 words.

3. Record an unused index

Use an unused index from 0 through 9999 and record:

Purpose: SeedSigner cosigner or single-sig wallet
Standard: BIP-85
Application: BIP-39
Language: English
Words: 24
Index: ____

Do not rely on memory. The index is not a password and should not be treated as the wallet's security control.

4. Display the child

Keep the child on the Coldcard screen. Do not save it through MicroSD, Virtual Disk, NFC, QR, or USB keyboard emulation for this workflow.

5. Enter it on SeedSigner

Open Seeds. With no seed loaded, SeedSigner opens Load a Seed. Choose Enter 24-word seed and enter the words in order using the SeedSigner controls.

After loading, SeedSigner displays the seed fingerprint. Record it with the derivation metadata. This fingerprint will be the first recovery check.

Choose manual entry or SeedQR

Manual entry each session

Powering off wipes the child from SeedSigner's memory. Manual entry avoids creating another machine-readable object, but it requires entering 24 words for every signing session.

This is defensible for infrequent signing. It also creates more opportunities for input mistakes and shoulder-surfing, so use a private room and compare the fingerprint each time.

Physical SeedQR

For faster loading, select the loaded seed, then choose Backup seed > Export as SeedQR. Select Standard or Compact format and transcribe the QR onto the correct paper or metal template.

SeedSigner warns that a SeedQR is the private key. Treat that literally:

never photograph it;
never scan it with a phone or online computer;
do not store it beside the Coldcard parent backup;
conceal it like the 24 child words;
use Confirm SeedQR and scan the transcription back into SeedSigner before relying on it.

A SeedQR improves loading speed. It does not encrypt the child or reduce the consequences of theft.

Verify the wallet and its metadata

1. Prove the child is reproducible

Record the fingerprint from the first load, then power SeedSigner off. This clears the seed from memory.

On Coldcard, derive the same BIP-39 child again from the same parent context and index. Power SeedSigner on and re-enter the 24 words, or scan the newly confirmed physical SeedQR. The fingerprint must match.

If it does not, stop. Do not fund the wallet. Recheck the parent context, word count, language, index, and input order.

2. Export the correct wallet data

A seed fingerprint is not a complete wallet configuration. From the loaded seed, choose Export xpub and select the intended single-sig or multisig format, script type, network, and derivation path.

Import the result into the chosen coordinator. For multisig, preserve the complete descriptor or configuration, including:

quorum, such as 2-of-3;
every cosigner xpub and fingerprint;
cosigner order;
derivation paths and script type;
network and coordinator;
a tested recovery procedure.

The seed alone cannot reconstruct missing multisig metadata.

3. Verify a receive address

Use SeedSigner's address-verification workflow to check a receive address from the coordinator. A stateless signer should not trust the coordinator to define the wallet silently.

Send a small test amount to the verified address. Confirm it appears in the intended wallet before transferring the planned balance.

4. Decide whether to add a passphrase

SeedSigner supports BIP-39 passphrases, but a passphrase produces a different wallet and must be entered again after every power cycle. Complete the base workflow first. If you add one, record it separately, verify the new fingerprint and address, and test recovery before funding.

Know the limits

Stateless does not mean seedless

The child exists in SeedSigner's memory while it is powered. A malicious build or compromised session can expose or misuse it. Power-off wiping limits persistence; it does not make runtime compromise impossible.

Coldcard does not attest SeedSigner

Coldcard produces deterministic child words. It cannot prove the SeedSigner image, board, camera, or transaction parser is trustworthy. Verify the build and inspect every transaction on the SeedSigner display.

SeedQR creates a new physical target

A photographed or stolen SeedQR can be used without the Coldcard parent or BIP-85 index. Its convenience must be included in the physical threat model.

BIP-85 siblings are not independent multisig keys

Use one child as one cosigner at most. Generate the other cosigner seeds independently on separate devices. If several cosigners descend from one Coldcard parent, compromise of that parent can collapse the quorum.

This does not solve the stablecoin need

SeedSigner remains Bitcoin-only. Users who need stablecoins or other networks should use a separate, compatible signer with a different child and a separate recovery record rather than stretching this wallet across roles.

Sources and verification

Verified on July 10, 2026 against current Coldcard documentation and official SeedSigner source. Recheck the official release and exact hardware board before publication.

How to Store a Seed Phrase

Plan physical storage for a wallet backup or SeedQR that can authorize spending.

Read article

What Is a Bitcoin Passphrase?

Understand the separate wallet and recovery burden created by one exact string.