PSBT

Signing bitcoin used to mean handing your private keys to whatever program built the transaction. BIP174 broke that apart in 2018 and Bitcoin Core shipped support in version 0.17.0, so the device holding the keys can be a different device from the one connected to the internet. Every hardware wallet and multisig coordinator now speaks it.

How it works

A PSBT is a container of key-value maps: one global map describing the transaction being assembled, then one map for each input and one for each output.

The file opens with five magic bytes, 70 73 62 74 ff, which spell out "psbt" plus a separator. Base64 is the usual way to move one around, so a PSBT pasted into a text box always begins with the characters cHNidP8. A string that starts any other way is not a PSBT, whatever the person sending it says.

Each input map holds the information an offline signer cannot look up for itself:

• the output being spent, so the device knows the exact amount and locking script it is authorizing
• the redeem script or witness script, when the coin sits behind a policy rather than a single key
• a derivation path and master key fingerprint for every key that needs to sign, so a device holding the right seed can find the right child key
• the partial signatures gathered so far, one per signer

Output maps carry derivation information too, and that is what lets a signer confirm the change output really belongs to the wallet it is protecting.

BIP174 divides the work into roles rather than programs. A creator produces the skeleton, an updater fills in the input details, signers add partial signatures, a combiner merges files that were signed independently, a finalizer turns partial signatures into a valid script or witness, and an extractor produces the raw transaction ready to broadcast. One piece of software often plays several roles at once, but the separation is why files from different vendors interoperate at all.

The format was built to tolerate ignorance. Every field carries a type byte, and a signer that does not understand a field must pass it through untouched rather than discard it, which is how a wallet written in 2018 can still hand a file to one written for Taproot. BIP371 added the Taproot fields; BIP370 defines a version 2 in which inputs and outputs may still be added after creation, the property collaborative transactions need.

Why this matters when you buy bitcoin

The moment you move coins off an exchange into your own hardware wallet, you are using the PSBT format whether or not any screen says so.

It keeps the keys off your computer. Your laptop builds the spend and produces a PSBT, the Trezor or Ledger reads it, shows you what it says, signs, and hands it back. Nothing secret crosses the cable. That is the difference between a compromised laptop, which is survivable, and a compromised seed phrase, which is not.

It defends against the change address swap. Malware in control of your computer can display an honest payment screen while quietly routing the change to an address it owns, and change is usually the larger amount. Because the file names a derivation path for every output, the signing device can check that the change descends from its own seed and warn you when it does not. Read the device screen, never the browser tab.

It makes multisig workable for people who are not engineers. A 2-of-3 spread across two hardware wallets and a backup in another building only functions if an unsigned transaction can travel by SD card, QR code, or email without leaking anything. A PSBT contains no private keys, so losing one in transit costs you nothing at all.

It is the piece your heirs will need. An envelope of seed words is not a recovery plan for anything more complicated than a single key wallet. Pair the seeds with the wallet's output descriptor and a note naming software that reads PSBTs, and the plan outlives you. Our security guide covers the rest of that setup.

Signing a 2-of-3 withdrawal, step by step

Say you buy 0.4 BTC on an exchange and withdraw it to a vault controlled by three keys, any two of which can spend.

Months later you want to move some of it. A watch-only wallet on your laptop, loaded with the vault's descriptor and no keys whatsoever, builds the transaction: one input, one payment output, one change output. A 2-of-3 native segwit input runs about 105 virtual bytes and two outputs about 62 more, so with overhead the whole thing lands near 177 virtual bytes, and at 8 sat/vB the fee comes to roughly 1,400 satoshis.

The laptop writes a PSBT. You plug in the first hardware wallet, which reads the file, displays the recipient, the amount, and the fee, and writes one signature into the input map. Then you carry the file on a microSD card to the second device, which has never touched a network, and it adds the second signature.

Back on the laptop the combiner merges the two files, the finalizer assembles the signatures into a witness in the order the script expects, and the extractor produces a raw transaction. Only then does anything reach the network. Up to that moment no key left a device, and nothing you did was visible to anyone.

PSBT vs serialized transaction

A serialized transaction is finished; a PSBT is a workspace. Broadcast a PSBT and every node rejects it, because this is not a format the peer-to-peer protocol carries. The difference runs the other way too: a PSBT holds context a finished transaction throws away, such as the value of each input being spent and which key derived each address, which is precisely the information a hardware wallet needs and a block does not.

PSBT vs output descriptor

An output descriptor describes a wallet; a PSBT describes one spend. The descriptor is a single line naming the script type, the keys, and the derivation paths, and it does not change from one year to the next. PSBTs are disposable, one per transaction. For a single key wallet the seed phrase alone recovers everything, but for multisig you need both: the descriptor to work out which addresses are yours, and PSBTs to move anything out of them.