Cold storage without a hardware wallet

Some product links in this guide are affiliate links. How that works.

You don’t need to buy a hardware wallet to keep bitcoin in cold storage. What makes storage “cold” is simple: the private keys are created on a computer that never connects to the internet, and they never leave it. This guide shows how to do that with free software and a spare computer.

The method is older than hardware wallets. People signed transactions on offline machines before Coldcard or Trezor existed. It takes more steps, but it costs almost nothing and teaches you exactly how Bitcoin signing works.

How it works

You use two computers:

• The offline computer holds the keys. It creates the wallet and signs transactions. It never goes online again.
• The online computer is your normal machine. It holds a watch-only copy of the wallet. It can see your balance and create receive addresses, but it cannot spend.

Transactions move between them as files on a USB stick, or as QR codes shown on one screen and scanned by the other’s webcam. The unsigned transaction format is called a PSBT (partially signed Bitcoin transaction). Every modern Bitcoin wallet supports it.

The private keys never touch the online computer. If your daily machine gets malware, the attacker can see your balance but cannot move your coins.

What you need

• A spare laptop or PC. Anything that can boot from USB. For a stronger setup, use a laptop with the Wi-Fi card physically removed. See choosing an air-gapped laptop.
• Two USB sticks, 8 GB or larger. One for the operating system, one for moving files.
• Tails. A free operating system that runs from a USB stick and forgets everything when you shut down.
• Sparrow Wallet. A free Bitcoin desktop wallet. Tails does not include it; Tails ships a different wallet, Electrum.
• A way to back up the seed. Paper is fine for a test wallet. For real money, use steel, like a stamping kit. See seed backups.

Total cost: about $10 if you already own a computer.

Step 1: Download and verify the software

Do this on your normal, online computer.

1. Download Tails from its official site. Follow the site’s own instructions to verify the download. Tails provides a browser-based check and a signature you can verify with GPG.
2. Write Tails to the first USB stick. The Tails site gives instructions for Windows, macOS and Linux.
3. Download Sparrow’s Linux version too, verify its signature using the instructions on sparrowwallet.com, and copy it to the second USB stick.

Always verify downloads. A fake wallet download is one of the most common ways people lose bitcoin.

Step 2: Prepare the offline computer

1. Unplug any network cable.
2. Enter the BIOS setup and disable Wi-Fi and Bluetooth if the option exists. The key to enter the BIOS varies by maker (often F1, F2, F12 or Delete).
3. If you can, physically remove the Wi-Fi card. Switching radios off in software is weaker than removing them.
4. Boot from the Tails USB stick.
5. At the Tails welcome screen, choose not to connect to a network.

From this point on, treat this computer as offline forever. If it ever goes online again, assume any wallet created on it is no longer cold.

Step 3: Create the wallet offline

1. Open Sparrow on the offline computer.
2. Create a new wallet and choose a software keystore with a new seed.
3. Pick a 24-word seed. Sparrow generates it from your computer’s randomness.
4. Write the 24 words down in order. No phone in the room, no photos, no typing them anywhere else.
5. Sparrow will ask you to confirm the words. Do it carefully.

Menu names change between Sparrow versions. If a step looks different, check Sparrow’s current documentation.

Optional: a passphrase

You can add a passphrase, sometimes called a “25th word.” It creates a completely different wallet from the same 24 words. It protects you if someone finds your seed. But if you forget the passphrase, the funds are gone. For a first wallet, skip it.

Step 4: Export the watch-only wallet

The online computer needs the wallet’s public information, not the keys.

1. In the offline Sparrow, export the wallet. Choose an export format Sparrow supports for watch-only use (the output descriptor or xpub).
2. Save it to the second USB stick. Or display it as a QR code if your online computer has a webcam.
3. On the online computer, import that file into Sparrow. It will show the same addresses and balance, but it holds no private keys.

Check that the first receive address matches on both computers. If it doesn’t, stop and find out why before sending any money.

Step 5: Receive bitcoin

1. On the online computer, get a receive address from Sparrow.
2. On the offline computer, check that the same address appears in its address list.
3. Send a small amount first.

Checking the address on the offline machine matters. Malware on your online computer could show you a fake address. The offline machine is the one you trust.

Step 6: Spend with offline signing

This is the full cycle. Practice it with a small amount before you rely on it.

1. Build: On the online computer, create the transaction in Sparrow. Instead of broadcasting, save it as a PSBT file to the USB stick (or show it as a QR).
2. Carry: Move the stick to the offline computer and open the PSBT in Sparrow.
3. Check: Read the destination address, the amount and the fee on the offline screen. This is your last chance to catch a mistake.
4. Sign: Sign it in the offline Sparrow. Save the signed file back to the stick.
5. Broadcast: Move the stick back to the online computer, load the signed transaction and broadcast it.

QR codes are safer than USB sticks. A USB stick can carry malware between machines. Sparrow can pass transactions by QR if your offline computer has a webcam.

Step 7: Test recovery

A backup you haven’t tested is a guess. Before putting real money in:

1. Shut down Tails. By default it forgets everything, including the wallet.
2. Boot Tails again, open Sparrow, and restore the wallet from your 24 words.
3. Confirm the same receive addresses appear.
4. Spend your test amount using the full offline signing cycle.

If anything doesn’t match, find out why now, while only a few dollars are at stake.

Practice for free first

If you want to learn the process without any money at risk, run every step above on signet. It’s a Bitcoin test network with free coins. See practice on signet.

Where this method is weaker than hardware

• More steps means more room for mistakes. Each manual step is a place to slip.
• USB sticks can carry malware. Use QR codes where possible.
• The computer must stay offline forever. This is a habit you have to keep, not a feature you buy.
• General-purpose computers have a large attack surface. A dedicated signing device does one job.

For learning and for small amounts, this method is excellent. If the wallet grows to an amount you’d hate to lose, compare it with hardware wallets or build a SeedSigner.

Next steps

• Want no radios at all? Choose and prepare an air-gapped laptop.
• Want a cheap dedicated device? Build a SeedSigner.
• Want to compare all your options with a checklist? See the cold storage kits.