Air-gapped by design
Runs on a phone with every radio off. Transactions travel by QR code only — including animated BC-UR and BBQr formats for large PSBTs. No cables, no NFC, no exceptions.
Features
MetroVault is a full-featured cold-storage signer built on a custom Kotlin Bitcoin library — BIP-32, 39, 48, 85, 174, 352, 370, and 374 included.
Runs on a phone with every radio off. Transactions travel by QR code only — including animated BC-UR and BBQr formats for large PSBTs. No cables, no NFC, no exceptions.
Native SegWit, Taproot, Nested SegWit, Legacy, and Silent Payments. Switch a wallet between script types at any time without re-importing the seed.
Import wallet descriptors over QR or text, export your signer info (BIP-48 compatible), and co-sign 2-of-3, 3-of-5, or any collaborative custody setup.
Create dedicated SP wallets, send to sp1q… recipients from any wallet, and sign spends of received outputs — fully air-gapped. The spend key never leaves the device.
Roll dice or flip coins for verifiable entropy, derive BIP-85 child seeds and passwords, complete mnemonics with the checksum calculator, and practice safely on Testnet4.
Prove ownership of an address by signing a message, or verify signatures from anyone else — QR code in, QR code out.
How it works
MetroVault pairs with the watch-only wallet you already use. The online device sees balances and builds transactions; only the offline device holds keys and signs.
Export an XPUB from MetroVault by QR and create a watch-only wallet in BlueWallet, Sparrow, or Electrum.
Build an unsigned transaction (PSBT) on your online device and display it as a QR code.
Scan it with MetroVault. Check the address, amount, and fee on the offline screen you trust.
Approve, and your key signs the transaction — on a device that has no way to reach a network.
Scan the signed QR back into your online wallet and send it to the Bitcoin network.
Screenshots
Material 3, edge to edge — a signing device that feels like a modern app, not a calculator.






