QR code transaction signing is the most accessible implementation of air-gapped Bitcoin security available for daily on-chain transactions. An air-gapped wallet is a device that has never touched the internet — the private key is generated and stored on hardware with no network connection. Signing a transaction on an air-gapped device normally requires some data bridge to move the signed transaction to a connected device without exposing the key. QR codes are that bridge: the unsigned transaction travels to the offline device as a QR code scan; the signed transaction returns to the online device as a QR code scan. The private key never traverses any network connection. Bitok Arena's review of air-gapped Bitcoin workflows finds this the most practical model for participants who want the security of a permanently offline key without the workflow complexity of USB-only signing.
QR code signing splits the transaction workflow into two parts: the offline device receives the unsigned transaction as a QR code, signs it with the private key, and displays the signed result for the connected device to broadcast. The key stays offline. The transaction reaches the Bitcoin network. Two scans replace the data bridge that would otherwise require USB or Bluetooth — both create a network surface the QR method eliminates.
Air-gapped signing for Bitcoin on-chain transactions uses a two-device workflow. The connected device holds a watch-only wallet configured with the public key only: it can display balances and construct unsigned transactions but cannot sign them. The offline device holds the private key and signs when presented with a valid unsigned transaction. The participant constructs the on-chain send on the watch-only wallet, scans to the offline device, signs, scans back, and broadcasts — all without the private key leaving the air-gapped hardware at any step.
The PSBT Workflow
What is PSBT (Partially Signed Bitcoin Transaction) — and how it enables air-gapped signing — is the technical foundation behind the QR code workflow. A PSBT is a standardized transaction format that separates the transaction construction step from the signing step. The watch-only wallet builds a PSBT containing all transaction details: the input UTXOs, the recipient address, the send amount, and the fee rate. This unsigned PSBT is what gets encoded as a QR code for the offline device. The offline device reads the PSBT, validates the details, applies the private key signature, and outputs a signed PSBT — which the watch-only wallet then broadcasts to the Bitcoin network as a complete transaction.
Bitok Arena reviewed the two-device QR signing setup for daily Bitcoin on-chain transactions.
Connected device role — runs Sparrow Wallet in watch-only mode; constructs the unsigned PSBT with the recipient address and the desired send amount; exports the PSBT as a QR code displayed on screen; later receives the signed PSBT by camera scan and broadcasts it to the Bitcoin network.
Offline device role — SeedSigner, Passport, or Sparrow on an offline laptop; scans the unsigned PSBT QR; displays transaction details for review; signs with the private key; encodes the signed PSBT as a QR code for the connected device to scan back.
Address verification step — before signing, the offline device displays the recipient address; confirm it matches the intended destination exactly before approving the signature; this is the anti-address-substitution check.
Bitcoin transaction mempool — how to time fee rates for on-chain sends — is a separate consideration from the air-gap workflow but intersects with it in practice. When the mempool is congested, a transaction submitted with a low fee rate can wait hours before confirming. An on-chain transaction needs to confirm within the intended timeframe. Checking mempool.space on the connected device before constructing the unsigned PSBT shows the current sat/vbyte rate needed for confirmation within the next few blocks. This fee rate goes into the PSBT when it is constructed on the watch-only wallet, before the QR code is generated for the offline device.
Fee Rate and Confirmation Timing
Minimum sat/vbyte fee for on-chain Bitcoin sends — and what happens when it is set too low — is what creates the confirmation delay risk. A typical Native SegWit send from a single-input wallet is approximately 140–150 vbytes. At a fee rate of 5 sat/vbyte, the transaction fee is roughly 700–750 satoshis. During low-congestion periods, 5 sat/vbyte confirms within the next few blocks. During high-congestion periods, the same fee rate can leave a transaction waiting for hours in the mempool. For a time-sensitive on-chain transaction, setting the fee rate 10–20% above the current median for the next-block estimate removes the confirmation delay risk. The fee cost difference between 5 and 15 sat/vbyte on a 150-vbyte transaction is 1,500 satoshis — small relative to most sends.
Bitok Arena reviewed security model options for Bitcoin holders who make regular on-chain transactions.
Hot wallet — private key on a connected device; simplest daily transaction workflow; appropriate when the amount being sent is small relative to total holdings.
Hardware wallet via USB — private key on a dedicated signing device; requires physical connection to sign; stronger than hot wallet software with a smaller attack surface.
Air-gapped QR signing — private key on a permanently offline device; adds two QR scan steps per transaction; the strongest available model; proportionate to large capital positions where the overhead is worth the protection.
The QR signing workflow adds approximately two to five minutes to each transaction. For large capital amounts, that overhead is justified by the attack surface eliminated.
What is Replace-By-Fee (RBF) — and when to use it for stuck transactions — is the question when a transaction is submitted with too low a fee rate and ends up stranded in the mempool. RBF allows a new version of the unconfirmed transaction to be broadcast with a higher fee, replacing the original. Not all wallets signal RBF by default; Sparrow does and has a fee bump interface for pending transactions. If a transaction is stuck and the wallet has signaled RBF, the watch-only wallet can construct a higher-fee replacement PSBT, which goes through the same QR signing workflow with the offline device and gets broadcast as the replacement.
CPFP and Transaction Recovery
Child-Pays-For-Parent (CPFP) is the alternative to RBF for cases where the stuck transaction did not signal RBF. CPFP works by creating a new transaction that spends an output from the stuck parent transaction and pays a high enough fee that miners are incentivized to confirm both together. This does not require the parent transaction to have signaled RBF — it only requires a spendable output from the stuck transaction that can be used as an input in the child transaction. Sparrow Wallet has a CPFP interface that automates this: select the stuck transaction, click "Child Pays For Parent," set the combined fee rate, and broadcast. The child transaction also goes through the QR signing step if the spending wallet is air-gapped.
BIP84 versus BIP44 wallet derivation resolves to BIP84 for bc1q Native SegWit addresses — the format that carries lower transaction fees due to the SegWit discount. A wallet configured with BIP44 generates Legacy 1xxx addresses and pays more in fees at the same sat/vbyte rate. Any air-gapped signer configured for BIP84 produces bc1q addresses from the first send onward and pays less per transaction than the equivalent Legacy address would.
How to set up an offline wallet for air-gapped Bitcoin signing comes down to three components working together: an offline device (SeedSigner, Passport, ColdCard, or an air-gapped laptop running Sparrow), a watch-only wallet on a connected device configured with the public key derived from the offline device's seed, and QR scanning capability on both ends. Once the pair is configured, the transaction workflow is consistent: build the PSBT on the watch-only wallet, scan to the offline signer, verify the recipient address and amount, sign, scan back, broadcast. The offline device remains offline through the entire process — it never touches the network at any point before, during, or after signing.
Bitok Arena's review of QR code signing for Bitcoin on-chain transactions finds it the most accessible air-gapped security model for regular Bitcoin senders: the private key stays permanently offline while completed transaction signatures travel via QR code scan. Construct the PSBT on a watch-only wallet with the correct fee rate, scan to the offline signer, verify recipient address, sign, scan back, broadcast. Two additional steps per transaction in exchange for a private key that never touches any network connection at any point.