SafeKeepVault v1.53

Release Date: October 27, 2026

Build: v1.53 · build 389 · afa0a32 · 2026-10-27

Add SafeKeep to Nunchuk or Sparrow by scanning its screen, with animated QR codes for anything dense. Earlier changes are in the v1.52 release notes.

🔄 Update in place from v1.47 or later
Copy SafeKeep-Update-v1.53.tar onto your stick's TRANSFER drive.
Boot SafeKeep and unlock your vault.
Open Device Options → Update SafeKeep → Check for update, then Install and Restart now.
Your vault, your vault password and your Transfer Drive are not touched. Before installing, SafeKeep shows the app's SHA-256: it should match the boot.html line of this release's SHA256SUMS.

Sticks set up with v1.46 or earlier still need one last reflash onto a flash drive of 8 GB or more. The update guide walks you through it.

📲 Add SafeKeep to your wallet by scanning
No more saving a file and carrying it over with the Courier.

Nunchuk: in Seed Management, choose Hardware Wallet JSON (or Minimal JSON), press Show QR, then Play as animated QR. In Nunchuk, add a key as a Passport and scan the screen.
Sparrow: choose BC-UR Account, press Show QR. In Sparrow, add a keystore as an Airgapped Hardware Wallet and scan. This format was in SafeKeep before but hidden, and it wrote a code no wallet could read; it is fixed and back in the Key Format menu.
Pick the Address Type and Wallet Type that match the wallet you are making (Multi-Sig for a multisig cosigner).

🎞️ Animated QR codes for dense data
A QR code that is dense enough to trouble a camera (a Hardware Wallet JSON export, or a larger multisig descriptor in Output Descriptor) now offers Play as animated QR: the same text in a loop of much simpler codes, using BC-UR, which Sparrow, Nunchuk, Keystone, BlueWallet and other wallets read. Show as one QR switches back. A code too big for a single QR, which used to give an error, plays animated straight away.

🔑 Seed Management
A passphrase you type must be typed twice before any key, address, export or print uses it. A typo used to show, and export, a different empty wallet without warning. One applied on the Dashboard or loaded from the Library needs no retyping.
The BIP-380 key format is now Output Descriptor (BIP-380) and gives the full descriptor, exactly as the Output Descriptor tool makes it. It used to give only a key in a form that isn't a valid descriptor.
Seed Management and Output Descriptor each say when to use the other.
🌱 BIP-85 Child Seeds
The passphrase box fills in from the Dashboard when a passphrase wallet is active, and a passphrase you type must be typed twice. A typo used to make child seeds that your master seed and real passphrase could never rebuild.

🔍 Check Shares I Already Have
After checking, Show the seed words shows the seed the shares rebuild, labelled as your vault seed or clearly as a different one.
Shares of either length can be checked: 12 or 24 words for Seed XOR, 20 or 33 for Shamir.
👀 Things come into view by themselves
QR codes (including Seed QR's grid and the Transfer Hub loop), camera scan windows, and the welcome screen's Restore from Words, Restore via Seed XOR and Recover Shamir Backup panels now scroll onto the screen when they appear. An animated QR never pulls the page back once you scroll away.

🍎 "SafeKeep" in the Mac boot menu
Holding Option on a Mac now shows the stick as SafeKeep instead of "EFI Boot". This applies to sticks flashed from this release: updating in place doesn't change the stick's boot partition.

🧹 Smaller fixes
Messages no longer use names from early builds: the Encrypted Backup message lists "Encrypted Notes, Saved Passphrases…" instead of "codex, cipher…", and the seed button says "Generating…".
The browser is pinned to ungoogled-chromium 155.0.8059.84-1: every build uses exactly this version and checks its fingerprint.
✅ Verifying This Release
The USB image (SafeKeep-Release-v1.53.zip):

Download SafeKeep-Release-v1.53.zip, SHA256SUMS.txt and SHA256SUMS.txt.asc.
Verify the signature: gpg --verify SHA256SUMS.txt.asc SHA256SUMS.txt Expect a good signature from Anton anton@safekeepbitcoin.com, key fingerprint A333 EB82 6F70 A79A 736F 0994 8EA7 DD8C EDBA 86C2.
Unzip, then check the image hash: shasum -a 256 -c SHA256SUMS.txt Expected: 22a9241981872d2e83b7e3313daf9952f2375285e204abe18a7fad617ea3196f SafeKeep-Release-v1.53.img
The update file (SafeKeep-Update-v1.53.tar) carries its own signature, which the stick checks before installing.

The app on its own (boot.html; its checksum file is SHA256SUMS, without .txt):

sha256sum -c SHA256SUMS
gh attestation verify boot.html -R Pasalon0404/SafeKeepVault
gpg --verify SHA256SUMS.asc SHA256SUMS
Expected: fc78458a7b0664c6c62b8fa49801937bec7b19dd247ef90378af8410b812ca3b boot.html

The boot.html inside the USB image and the update file is byte-for-byte this release's boot.html. See VERIFYING.md for every check.