Coming soon · pre-alpha, not audited, open source
Three keys. No company. Your keys, your server, your bitcoin.
Trikey is a 2-of-3 bitcoin wallet that's easy to use, and no company holds a key. Your phone, your hardware wallet and your own home server: any two move your money.
The three keys
Key 2
Everyday payments with Face ID. The key sits behind your phone's biometrics, with an encrypted backup in your own cloud that a passkey unlocks.
Key 1
Ledger, Trezor, Coldcard, Jade, Keystone and other multisig devices. For big payments, changing your rules, and recovery.
Key 3
An app on your own Umbrel or Start9. It co-signs phone payments under a daily limit and runs a 7, 14 or 30-day Delay & Notify recovery.
Under the hood it's a plain wsh(sortedmulti(2,…)) descriptor, so any multisig wallet can recover your funds without Trikey.
How it feels
Everyday payments: just your phone and Face ID.
Your guardian at home co-signs anything under the daily limit you set.
How it feels
Big ones: confirm on your hardware wallet.
Over the limit, the hardware wallet signs instead of the guardian. Raising the limit needs it too.
If a key goes missing
Part 1 · Key 2
Your hardware wallet and guardian have you.
Watch part 1 · 0:40
Lost it?
Got your backup? Restore it on a new phone with your passkey. No waiting.
No backup? Your hardware wallet and guardian start a recovery. It waits 7, 14 or 30 days and alerts you and your contacts every day. Any of you can cancel a fake one.
Stolen?
They can spend at most your daily limit. Raising it needs your hardware wallet. Start a recovery and phone-only payments pause.
Part 2 · Key 1
Your phone and guardian have you.
Watch part 2 · 0:35
Lost it?
Restore your seed words on a new device. Done.
Stolen?
It's PIN-locked. And even unlocked, it's one key of three. If they try to start a recovery with it, you and your contacts are alerted every day, and you cancel it.
Then restore your seed words and move everything to a fresh wallet with your phone. Keep the seed words somewhere other than the device, and outside your home.
Part 3 · Key 3
Your phone and hardware wallet have you.
Watch part 3 · 0:31
It dies or goes offline?
Your phone and hardware wallet still move any amount. Phone-only payments wait until the guardian is back, or you set up a new guardian and move to a fresh wallet.
Stolen?
It locks itself after any restart: key 3 stays encrypted until you unlock it. Unplugged, it's useless to them. Think it's been tampered with? Lock it from your phone. And it never held your money. Just one key of three.
One key gone. Your bitcoin isn’t.
How it compares
| An exchange | One hardware wallet | Multisig with a company key | Trikey | |
|---|---|---|---|---|
| Who holds the keys | The exchange | You hold one | You hold two, a company holds one | You hold all three |
| Single point of failure | Yes the company | Yes your seed words | No | No |
| Everyday payments from your phone | Yes | No the device signs every time | Yes | Yes under your daily limit |
| A stolen phone can drain it | Depends on the account | Not applicable | Usually not: the company's limits apply | No at most your daily limit |
| Recover a lost key without a company | No | Yes with your seed words | No its server takes part | Yes any two of your keys |
| If the company behind it disappears | Depends on the company | Nothing changes | Depends on its exit plan | Nothing changes: no company is in the loop |
Trikey is coming soon and isn't audited yet. It keeps the everyday ease of multisig with a company key, and gives the third key back to you.
Under the hood
Your phone and your guardian never talk directly, and never through a server of ours. They pass encrypted notes through nostr relays, and both only ever dial out.
wsh(sortedmulti(2,…)) descriptor on standard paths. Any multisig wallet can move your coins with two of your keys.Setup, once it ships
01
Trikey reads its public key only. Your seed words never leave it.
02
Open Trikey Guardian on your Umbrel or Start9 and scan its code. No port forwarding, no shared Wi-Fi.
03
Payments under it need only your phone. Raising it later needs your hardware wallet.
04
Encrypted on the phone, unlocked by a passkey, kept in the cloud you choose.
Where it stands
Every step lands in the open repository first. No dates: it ships when it's ready, and not before a security review.
In the repo
Nostr RPC, pairing, the policy engine, Delay & Notify, lock and unlock, chain data from your node.
apps/guardianIn the repo
A Docker image, an Umbrel community app store entry and a Start9 package skeleton.
packagingIn the repo
Onboarding, send and receive, recovery and settings, with Ledger, Trezor and QR devices. Recovery Key mode screens are still a demo.
apps/mobileNext
Open testing with coins that have no value.
Before mainnet
An outside audit of the wallet, the guardian and the protocol.
After the review
Real bitcoin, once the review is done and its findings are fixed.
No. It's pre-alpha and hasn't been audited, so don't use it with real funds. It runs on testnet, signet and regtest while it's built, and there's no release to download yet. An independent security review is planned before mainnet.
No. All three keys are yours. Nobody runs a server, a guardian or a cosigner for you: the guardian is an app on your own home server.
Your wallet is a plain wsh(sortedmulti(2,…)) descriptor on standard BIP 48 paths, and your phone's backup holds it. Any multisig-capable wallet can recover your coins with two of your keys, no Trikey needed.
No. Recovery Key mode keeps key 3 offline, on a printed Recovery Kit or a second hardware wallet, and gives the phone a small spending balance refilled by timelocked, pre-signed refills. Recovery then takes any two keys, with no waiting period.
Ledger and Trezor over Bluetooth, and QR devices such as Coldcard, Keystone, Passport, Jade and SeedSigner.
No. Every message is end-to-end encrypted to the other side. A relay can drop messages, but it can't read or forge them. You can use several relays, or run your own.
They get one key of three: the same exposure as a company's cosigning server being breached. They still need a second key to move anything, and the guardian only co-signs phone payments under your limit.
Pre-alpha and not audited. Don't use it with real funds. There's no release yet, so there's nothing to download. It runs on testnet, signet and regtest while it's built. An independent security review is planned before mainnet. Know the trade-offs too: a remote compromise of your home server gives up one key of three, and phone-only payments wait while the guardian is offline.
Notes on nostr are coming soon.