Skip to content

SafeKeepVault v1.65

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 10 Nov 00:46
v1.65
20cee62
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Release Date: November 9, 2026

Build: v1.65 · build 524 · 20cee62 · 2026-11-09

A Seed Vault for more seeds beside your master seed, a COLDCARD companion that sends passphrases and seeds over USB so you don't type them on its keys, multisig wallets built from your stored seeds, and wallet imports that read BBQr and UR codes. Earlier changes are in the v1.64 release notes.

🗝️ Seed Vault

Keep up to 20 more seeds in your vault, beside your master seed: a family member's wallet, a second multisig key, an old wallet.

  • Seed Management → Seed Vault: Add a Seed with its words or Scan a SeedQR, or Keep the Temporary Seed Here. Rename a seed, Show words (SafeKeep asks first), or delete it.
  • Switch from the Dashboard with the Seed Vault ▾ button. A banner shows which stored seed is in use, with Back to Master Seed. Switching clears any passphrase you applied.
  • Stored seeds are encrypted in the vault next to your master seed, so Encrypted Backup's seed option, restore and factory reset cover them.
  • Off in a Temporary Session, and on a flash drive set not to keep the seed.
  • COLDCARD backups: the backup's Seed Vault entries can now be kept in SafeKeep's Seed Vault when you import or restore.

🧊 COLDCARD companion

In Device Options → Coldcard, now with every COLDCARD option together (pairing, the two new tools, then Import from a COLDCARD Backup), and Trezor after:

  • Send a Passphrase to the Coldcard: type a BIP-39 passphrase on the computer (twice), or Choose from the Passphrase Library, and send it over USB. The COLDCARD shows its length, shows the passphrase itself when you press 2, and switches to that wallet only when you press OK. With its Seed Vault on, it offers to keep that wallet. SafeKeep works out the fingerprint the passphrase gives with its own seed, and confirms the COLDCARD switched to it.
  • Send a Seed to the Coldcard: pick a seed from SafeKeep's Seed Vault, or type or scan 12 or 24 words. The COLDCARD loads it as a temporary seed, never in place of its own seed, and with its Seed Vault on offers to keep it. Check the Coldcard confirms which wallet it is using afterwards.
  • Names: the COLDCARD names Seed Vault entries by fingerprint. SafeKeep tells you how to rename the entry on the COLDCARD, with the seed's SafeKeep name or the passphrase's nickname to type.

Tested on a COLDCARD Mk4.

🔐 Multisig from your Seed Vault

In Output Descriptor → multisig, each cosigner slot has a Seed Vault button that fills in a stored seed's multisig key, next to Coldcard (USB) and Trezor (USB).

  • If this vault holds enough of the wallet's keys to spend, SafeKeep says so plainly: anyone who unlocks this flash drive could spend alone, so the wallet is no safer than single-signature. It says how many keys to keep somewhere else, such as on a COLDCARD.
  • Save the wallet, then send it to Sparrow or another app as before.

📷 Wallet imports

  • BBQr and UR codes: Output Descriptor now reads wallets shown as BBQr (B$…, as newer Sparrow versions and COLDCARD show them) and UR text (UR:CRYPTO-OUTPUT/…), whether scanned, pasted or relayed with the Courier, including animated codes.
  • Connect a wallet app → Sparrow → Multisig now shows the key as Hardware Wallet JSON, which Sparrow's multisig import reads (scan it with Airgapped Hardware Wallet → Passport). Single-sig is unchanged.
  • PSBT Signer: BBQr transactions of 16 parts or more are now put back together correctly.

🔄 Update in place from v1.47 or later

  1. Copy SafeKeep-Update-v1.65.tar onto your flash drive's TRANSFER drive.
  2. Boot SafeKeep and unlock your vault.
  3. Open Device Options → Update SafeKeep → Check for update, then Install and Restart now.

Your vault, your vault password and your Transfer Drive are not touched. Before installing, SafeKeep shows the app's SHA-256: it should match the boot.html line of this release's SHA256SUMS.

✅ Verifying This Release

The USB image (SafeKeep-Release-v1.65.zip):

  1. Download SafeKeep-Release-v1.65.zip, SHA256SUMS.txt and SHA256SUMS.txt.asc.
  2. Verify the signature:
    gpg --verify SHA256SUMS.txt.asc SHA256SUMS.txt
    Expect a good signature from Anton anton@safekeepbitcoin.com, key fingerprint A333 EB82 6F70 A79A 736F 0994 8EA7 DD8C EDBA 86C2.
  3. Unzip, then check the image hash:
    shasum -a 256 -c SHA256SUMS.txt
    Expected: c6df647a2ae4ec15fd818473ec7311a4072b2c043af332f02bb8ddca002dae42 SafeKeep-Release-v1.65.img

The update file (SafeKeep-Update-v1.65.tar) carries its own signature, which the flash drive checks before installing.

The app on its own (boot.html; its checksum file is SHA256SUMS, without .txt):

sha256sum -c SHA256SUMS
gh attestation verify boot.html -R Pasalon0404/SafeKeepVault
gpg --verify SHA256SUMS.asc SHA256SUMS

Expected: 903938e57261ae876b8b4f1c5415549a36faeb80d94dc7be6d0f0c0be2ea3262 boot.html

The boot.html inside the USB image and the update file is byte-for-byte this release's boot.html. See VERIFYING.md for every check.

Assets 10
Loading