Skip to content

SafeKeepVault v1.52

Choose a tag to compare

View all tags
@github-actions github-actions released this 23 Oct 16:01
· 126 commits to main since this release
v1.52
af4f5c6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Release Date: October 23, 2026

Build: v1.52 · build 358 · af4f5c6 · 2026-10-23

Seed XOR and Shamir Backup, rebuilt: one share at a time, each checked against your paper before you move on. Earlier changes are in the v1.51 release notes.

🔄 Update in place from v1.47 or later

  1. Copy SafeKeep-Update-v1.52.tar onto your stick's TRANSFER drive.
  2. Boot SafeKeep and unlock your vault.
  3. Open Device Options → Update SafeKeep → Check for update, then Install and Restart now.

Your vault, your vault password and your Transfer Drive are not touched. Before installing, SafeKeep shows the app's SHA-256: it should match the boot.html line of this release's SHA256SUMS.

Sticks set up with v1.46 or earlier still need one last reflash onto a flash drive of 8 GB or more. The update guide walks you through it.

🧩 One share at a time

Seed XOR Splitter and Shamir Backup now work the same way:

  1. Choose how many shares, in plain words: "All 3 shares are needed" (Seed XOR) or "Any 2 of 3 shares recover your seed. You can lose 1 and still recover it" (Shamir).
  2. Write down each share on its own screen, with Print and Show QR.
  3. Check it straight away: type it back with word suggestions, or scan its QR code. A wrong word is pointed out by its position, without showing the right one.
  4. Final check: SafeKeep confirms the shares you typed rebuild your seed exactly. If you set a Shamir share passphrase, it asks for it again from memory.

Leaving before every share is checked asks first, and leaving anyway discards the unchecked shares.

🔍 Check Shares I Already Have

New in both tools. Type in or scan shares you made earlier, and SafeKeep tells you whether they rebuild your vault seed (naming both fingerprints if not). The seed is never shown and nothing is loaded.

♻️ Easier recovery

On the welcome screen, Restore via Seed XOR and Recover Shamir Backup use the same word boxes with suggestions and Scan QR. Shamir recovery checks each share as you add it (a wrong word, a share from another set, the same share twice), says how many more you need, and now accepts more shares than the minimum.

🧹 Removed

  • The Copy buttons: a clipboard on an offline computer only keeps words around.
  • Seed XOR's Merge tab, which showed your combined seed on screen. Combine shares from the welcome screen, or check them with Check Shares I Already Have.
  • The long pages that showed every share at once.

🖨️ Shamir fixes

  • A printed Shamir share no longer shows your seed's last word: it gave away a little of the seed, and Shamir promises that fewer shares than the threshold reveal nothing. The fingerprint still identifies the seed.
  • A BIP-39 passphrase active on the Dashboard is no longer used as the shares' passphrase. The share passphrase is only what you type under Advanced; if your wallet uses a BIP-39 passphrase, back it up separately.

🤫 Quieter start

The brief "Download started" message and the flash of a Mount Transfer Drive box after unlocking are gone. Nothing was ever downloaded: that is how the app passes requests to the system.

✅ Verifying This Release

The USB image (SafeKeep-Release-v1.52.zip):

  1. Download SafeKeep-Release-v1.52.zip, SHA256SUMS.txt and SHA256SUMS.txt.asc.
  2. Verify the signature:
    gpg --verify SHA256SUMS.txt.asc SHA256SUMS.txt
    Expect a good signature from Anton anton@safekeepbitcoin.com, key fingerprint A333 EB82 6F70 A79A 736F 0994 8EA7 DD8C EDBA 86C2.
  3. Unzip, then check the image hash:
    shasum -a 256 -c SHA256SUMS.txt
    Expected: f4572273fb63ace02cb47efe4e70b6214551593050a77f393068fa0326c3b6b5 SafeKeep-Release-v1.52.img

The update file (SafeKeep-Update-v1.52.tar) carries its own signature, which the stick checks before installing.

The app on its own (boot.html; its checksum file is SHA256SUMS, without .txt):

sha256sum -c SHA256SUMS
gh attestation verify boot.html -R Pasalon0404/SafeKeepVault
gpg --verify SHA256SUMS.asc SHA256SUMS

Expected: 94196bddd01fa51f623649082dda4da210a510c6bc02d091d418997bc2560f32 boot.html

The boot.html inside the USB image and the update file is byte-for-byte this release's boot.html. See VERIFYING.md for every check.

Assets 10
Loading