Air-gapped Wallet is a wallet arrangement in which the signing device has no ordinary network connection to the online coordinator. It isolates the private-key environment but accepts transaction data and returns signatures through controlled transfers.
Distinguish secret storage, signer and online coordinator: these can be separate components. The coordinator tracks the blockchain and prepares payments; the signer authorizes them. Temporarily disabling Wi-Fi on an ordinary computer does not establish a permanently isolated environment. Describe the device's active interfaces and full operating procedure, beyond the air-gap label. [SeedSigner — Frequently Asked Questions]
The coordinator constructs a PSBT with the transaction and required data about the UTXOs being spent. The signer reads it, verifies supported data and adds signatures; the result returns to the coordinator. Once all required signatures exist, the transaction can be finalized and broadcast. Transferring a PSBT is not itself signing, finalization or block confirmation and does not require sending the seed online. [BIP 174 — Partially Signed Bitcoin Transaction Format]
Before approval, compare recipients, amounts and fees on the signer's trusted display with your intended payment. A Change Output must be checked against the correct wallet keys and configuration; the host's change label is insufficient. For example, a 100000 sat input and outputs of 60000 and 39000 sat imply a 1000 sat fee, but correct arithmetic alone does not establish who owns the addresses. [BIP 174 — Partially Signed Bitcoin Transaction Format] [SeedSigner — Independent Custody Guide]
QR encodes data; it does not authenticate them. Animated formats such as BBQr or UR carry larger payloads, but both ends must support the same format. The decoder and PSBT parser still process untrusted input. Distinguish transaction QR from SeedQR: SeedQR contains a secret and must not enter an online computer's or phone's camera. [COLDCARD — Bitcoin Air-Gap Signing Methods] [SeedSigner — Independent Custody Guide]
MicroSD carries a file through a controller and filesystem; their handling and firmware also affect security. A dedicated card reduces file mixing but does not prove a PSBT harmless. USB used only for power must actually lack an active data path; neither a cable's presence nor a charging label determines the isolation boundary. [COLDCARD — Bitcoin Air-Gap Signing Methods] [SeedSigner — Frequently Asked Questions]
COLDCARD includes NFC among its air-gap transfer methods. NFC nevertheless uses short-range radio, not optical isolation. A mode using it does not satisfy a threat model that excludes radio. Compare the actual channel, activation and connection duration; QR, MicroSD, NFC and a persistent USB data connection are different interfaces. [COLDCARD — Bitcoin Air-Gap Signing Methods]
A watch-only coordinator can use an xpub or public Descriptor without being able to sign. These data still reveal addresses and transaction relationships; a PSBT may carry derivation paths, public keys and UTXO information. For Multisig, preserve the correct configuration of all cosigners for recovery and address verification. Isolating the signer does not itself hide the online coordinator's activity. [BIP 174 — Partially Signed Bitcoin Transaction Format] [SeedSigner — Independent Custody Guide]
An air gap does not solve a photographed Seed Phrase, malicious firmware or mistaken payment approval. SeedSigner separates the secret backup from the temporarily loaded signer; the correct backup and configuration must therefore remain available after power-off. Recovery and the complete signing flow can be rehearsed with separate test keys. Isolation is one layer, not a substitute for verifying the device and recoverability. [SeedSigner — Frequently Asked Questions] [SeedSigner — Independent Custody Guide]
For the clearest picture, read this entry together with Hardware Wallet, PSBT, Cold Storage, Seed Phrase, Output Descriptor, Multisig. The reverse links also lead from Cold Storage, Secure Element.