ShopAir-gapped signing is a method of authorizing Bitcoin transactions that keeps the private key on a device that never connects to an internet-connected computer or phone. Because the signing device has no network connection, any data moving between it and your wallet software must cross a physical boundary rather than a network connection.
There are three methods for making that crossing: QR codes, microSD cards, and NFC taps. Each method has different hardware requirements and trade-offs.
For the conceptual foundation on what air-gapping is and why it matters, see What is Air-Gapped Signing?. This article covers how each method works, what hardware it requires, and when to use it.
The Three Channels at a Glance
When you spend bitcoin using a signing device (also called a hardware wallet), two separate devices handle different parts of the process. Coordinator software on your internet-connected computer or phone builds and broadcasts the transaction. The signing device holds the private key and authorizes the transaction by digitally signing it.
The coordinator and signing device communicate by passing a PSBT (Partially Signed Bitcoin Transaction) between them in a simple procedure. The full air-gapped signing procedure follows six basic steps:
- Construct. The coordinator builds the unsigned transaction and packages it as a PSBT.
- Transfer. The unsigned PSBT moves from the coordinator to the signing device via one of three air-gapped methods.
- Verify. The signing device displays the transaction details on its trusted screen, including the address, amount, change address, and transaction fee.
- Sign. Once approved, the signing device adds the cryptographic signature to the PSBT.
- Return. The signed PSBT moves back to the coordinator via the same air-gapped method.
- Broadcast. The coordinator receives the signe transaction and broadcasts it to the Bitcoin network.
Steps 2 and 5 are where the air gap signing occurs. The three methods for making that crossing are QR codes, a MicroSD card, and NFC.
| Channel | Air-gap method | PSBT size limit | Notes |
|---|---|---|---|
| Animated QR (BBQr) | Visual | Effectively unlimited | Fully wireless visual transfer. |
| Static QR | Visual | ~2,953 bytes | Singlesig only. Small PSBTs. |
| MicroSD | Physical card | Effectively unlimited | Largest PSBTs. Most widely adopted air-gap. |
| NFC | Proximity radio | ~8 KB practical limit | Convenience. Stateless, proximity-gated. |
QR codes come in two forms:
- Standard static QR codes for encoding data as a single image.
- Animated QR codes for delivering a sequence of frames to carry larger payloads.
The distinction between these QR code types applies for multisig PSBTs, which often exceed what a single QR code frame can hold.
Both Coldcard Q and Coldcard Mk5 support MicroSD and NFC. The Q also supports QR code scanning, enabling fully bidirectional QR signing without physical media.
QR Code Transfer
QR code signing transfers data optically, using no physical media and no radio component. It is the preferred method for most singlesig workflows and, with animated QR protocols, handles multisig equally well.
A standard static QR code holds roughly 2,953 bytes of data, enough for a typical singlesig transaction. Multisig PSBTs are considerably larger, and can run in the range of 5-20 KB. This is because they include UTXO data for each input, witness scripts containing all participant public keys, and accumulate partial signatures from each signer.
That amount of data exceeds single-frame QR capacity. Animated QR protocols solve this by splitting the payload across multiple frames displayed in sequence.
BBQr: Coinkite's Animated QR Protocol
"BBQr" is an animated QR protocol developed by Coinkite. The specification is open and available at bbqr.org.
BBQr splits the data across multiple QR frames displayed in sequence, and the receiving camera accumulates the frames until it has the complete payload.
Each frame carries a file type identifier (P for PSBT, T for final transaction, J for JSON, B for binary), the total number of frames, and the current frame index. This means frames can arrive in any order and still be reassembled correctly.
Data within each frame is encoded as Base32, which maximizes the amount of data that fits in a scannable QR code. Optional Zlib compression reduces payload size for larger files.
How QR Code Signing Works
Transfer a PSBT over QR code requires the camera and screen from both the signing device and the computer or phone where the coordinator software is running.
- The coordinator encodes the unsigned PSBT as a QR code. For singlesig transactions this produces a single static image, whereas for larger PSBTs, the coordinator generates an animated BBQr sequence, splitting the payload across multiple self-describing frames.
- The coordinator displays the QR code or animated sequence on screen.
- You activate the signing device's camera and point it at the screen. For animated sequences, the device scans the sequence of frames until it has the complete payload.
- The signing device reconstructs the PSBT from the scanned data and displays the transaction details on its trusted screen for verification and approval.
The return of the signed PSBT works in reverse. After approval, the signing device encodes the signed PSBT as a QR sequence and displays it on its own screen. The coordinator's webcam or external scanner reads it to complete the transfer.
In a multisig setup, this process repeats for each required signer. Each signing device receives the PSBT, adds its partial signature, and returns an updated file. The coordinator collects partial signatures until the threshold is met, then assembles the fully signed transaction for broadcast.
UR: The Alternative Animated QR Standard
"UR" (Uniform Resources) is an alternative animated QR protocol developed by Blockchain Commons (BCR-2020-005).
The main technical difference from BBQr is the error correction approach. UR uses fountain codes, a class of rateless erasure codes. Any sufficient subset of the transmitted frames can reconstruct the full payload. The scanner needs neither every frame nor a specific order. In noisy scanning environments, this makes UR more robust to missed frames.
If you use Sparrow as your coordinator, it auto-detects whether to use BBQr or UR based on which hardware wallet is connected. For Coldcard users, BBQr is the correct format.
MicroSD Card Transfer
MicroSD is the oldest air-gap method and the most universally compatible. The PSBT travels as a file on a physical card the user carries between devices. There is no wireless component of any kind, making it the simplest method to reason about from a security perspective.
The PSBT is saved as a standard .psbt file with no proprietary format. Any coordinator that produces a BIP174-compliant file works.
Any standard MicroSD card between 1 GB and 32 GB works with Coldcard, with 4 GB being a practical size. The card must be formatted as FAT32, as exFAT and NTFS are not supported. A Class 10 speed rating is recommended, with Class 4 as the minimum. Coinkite has verified compatible cards at the Coinkite store.
How MicroSD Signing Works
The PSBT moves between coordinator and signing device as a file on the card. The user physically carries the card between the two.
- The coordinator saves the unsigned PSBT as a
.psbtfile to the MicroSD card. - You physically remove the card from the computer and insert it into the Coldcard's MicroSD slot.
- On your Coldcard, select "Ready to Sign" from the main menu to be taken directly to the PSBT for review. The device reads the file directly from the card and displays the transaction details on its trusted screen for verification and approval.
- After approval, Coldcard writes the signed PSBT back to the card, appending "-signed" to the filename. The original file is not overwritten.
- You remove the card from the Coldcard and return it to the computer. The coordinator imports the signed PSBT.
In a multisig setup where multiple signing devices sign sequentially, each device appends another "-signed" suffix when it approves. A PSBT that has passed through two signers would be named payment-signed-signed.psbt, making the signing history visible in the filename.
Both Coldcard Q and Coldcard Mk5 have a MicroSD card slot, so MicroSD is an option regardless of which device you use. The MicroSD slot is also how firmware updates are applied to both devices, making it a useful part of the hardware setup beyond signing workflows. For this reason, it is worth keeping a compatible card available even if QR codes are your primary signing method.
A compromised host computer could write a malicious PSBT to the card before the user inserts it into the signing device. Coldcard defends against this by displaying all transaction details on its own trusted screen before the user approves. The user's verification step is not optional. Using a dedicated card for signing only reduces this risk further.
NFC Transfer
NFC stands for Near Field Communication, the short-range wireless standard behind contactless card payments. When you tap a credit card or phone on a payment terminal, that is NFC at the transport layer.
Signing devices, such as Coldcard, use the same wireless carrier to pass transaction data, but the application layer is NDEF (NFC Data Exchange Format), an open standard for peer-to-peer data exchange between NFC devices.
For singlesig transactions, NFC is the fastest of the three air gap methods. One tap sends the unsigned transaction to the signing device and a second returns the signed result. NFC is disabled by default on both Coldcard Q and Coldcard Mk5 and must be enabled in settings before use.
Most computers, including all Apple MacBooks, do not have built-in NFC hardware. Using NFC with Sparrow on a desktop requires a compatible USB NFC reader. iPhones (iOS 11 and later) and Android phones have NFC built in, making mobile signing workflows possible without a dedicated reader.
How NFC Signing Works
The coordinator encodes the unsigned PSBT as an NDEF payload and initiates the exchange. The transfer happens in a single tap.
- Enable NFC in Coldcard settings if not already active.
- In the coordinator, prepare the transaction and initiate the NFC export. The software encodes the PSBT as an NDEF payload and signals it is ready.
- Hold the Coldcard within 4 cm of the NFC reader. The first tap transfers the unsigned PSBT to the signing device.
- The signing device reconstructs the PSBT and displays the transaction details on its trusted screen for verification and approval.
- After approval, the signing device encodes the signed PSBT as an NDEF payload. Hold the Coldcard to the reader again. The second tap returns the signed PSBT to the coordinator.
- The coordinator loads the signed PSBT and broadcasts.
NFC has a practical transfer limit of around 8 KB. Singlesig PSBTs are typically well under 1 KB, comfortably within that limit. Larger multisig PSBTs can exceed it, in which case MicroSD or animated QR is the better choice.
Each tap is a short, independent exchange with no persistent connection on either side. The signing device does not stay connected between taps. This is different from Bluetooth, which maintains a paired session that a host can use at any time the device is in range. NFC can only transfer data when devices are within a few centimeters of each other, and nothing persists between individual taps.
Related articles
What is Air-Gapped Signing?
The conceptual foundation: what air-gapping means, why it matters, and what each transfer method achieves at a high level.
What is a PSBT?
The transaction format that travels over air-gap channels. Covers how it is structured, what roles process it, and why it enables multi-device signing.
Bitcoin Improvement Proposals (BIPs)
The BIP standards that govern the PSBT format these channels carry, including BIP174 and BIP370.
What is a Hardware Wallet?
The device layer that implements these channels. Covers how hardware wallets isolate private keys and why the trusted screen matters.