Create a vault with BlueWallet
Keep your key in BlueWallet on your phone, a backup key in Fountain, and let SignBit hold the third. Set up the 2-of-3 vault, then fund it, check the address and make your first send, signed in BlueWallet and approved in SignBit.
1. What you need
A 2-of-3 vault has three keys, and any two of them can move your bitcoin. Here, one key lives in BlueWallet on your phone, your backup key lives in Fountain, and SignBit holds the third.
- BlueWallet on your phone.
- Fountain, our free signing app, on a second device. It runs on Android, Windows and Linux, so a second phone or your computer is fine. Get it from the download page.
- A SignBit account with a confirmed email address. Your first 2-of-3 vault is free.
- Paper and a pen for your recovery words.
- A small amount of bitcoin for a first test.
Never put Fountain on the same phone as BlueWallet. That one phone would then hold two of your three keys, and losing it would take both at once.
2. Make your key in BlueWallet
Open BlueWallet and tap Add now, or + if you already have a wallet. Give it a name, pick Multisig Vault and tap Create. Open Vault Settings and check that it says 2 of 3 and Best practice (p2wsh). That's the same kind of vault SignBit makes. Tap Done, then Let's start.
Under Vault Key 1, tap Create New. BlueWallet makes your key and shows its 12 recovery words. Write them on paper, in order, and keep the paper somewhere safe. The words are your key, so don't type them anywhere else and don't take a photo of them.
3. Show the key's QR code
Next to Vault Key 1, tap Share.... BlueWallet shows a QR code with a line of text under it. Both are the public half of your key, and on their own they can't spend anything. Keep this screen open, because SignBit reads the key from it in a moment.
You don't need to finish the vault in BlueWallet. Its builder is only where your key gets made. The finished vault comes over from SignBit later.
No camera on your computer? Tap the line of text under the QR code, and BlueWallet copies it. Send it to yourself, by email for example. It's only the public half of your key, so that's fine.
4. Make your backup key in Fountain
On your second device, open Fountain. The first time, it asks for a passphrase. Type it twice and choose Create keystore. The passphrase locks your keys on that device and nobody can reset it, so write it down too.
Type a name for the key in New key label, such as "Recovery", and choose Create key. Fountain shows the key's 24 recovery words. Write them on paper and keep them apart from BlueWallet's words, or save an encrypted backup file from Settings, Export backup and keep it away from the device. Either one brings the key back. Then choose I've backed it up.
5. Copy Fountain's public key
On the key's card, choose Show public key (mainnet). Note the 8 characters under Key fingerprint. Then choose the Copy right next to Public key, not the one at the bottom of the window.
If Fountain is on a second phone, send the copied key to your computer, by email for example. Like BlueWallet's QR code, it's only the public half.
6. Start the vault in SignBit
In SignBit, open Vaults and choose Create vault. Give the vault a name, such as "BlueWallet Vault", and pick 2-of-3. Under Who holds the keys, keep SignBit co-signs. Choose Next.
7. Add your BlueWallet key
On Your key, choose Scan key QR and hold BlueWallet's QR code up to your computer's camera. The fingerprint and the public key fill in by themselves. Check the fingerprint against BlueWallet's text, where it's the 8 characters after "xfp", in capitals.
No camera? Paste the text you sent yourself into Public key (xpub). SignBit reads it and fills in the fingerprint and the key just the same.
Give the key a name, such as "BlueWallet", and choose Next.
8. Add your Fountain key and create the vault
The next step is SignBit's own key. It's added for you, so choose Next.
On the last key, keep Recovery as the key type and Add key now selected. Name the key, such as "Fountain". Type the fingerprint Fountain showed you into Key fingerprint, paste the public key you copied into Public key (xpub), and choose Next.
Check the review. You should see the name, 2-of-3 and all three keys, with SignBit's marked Added automatically. Then choose Create vault.
9. Download the vault backup
Your new vault opens with its first address to receive to. Before anything else, open the backup button at the top right of the vault page, called Vault backup (descriptor), and choose Download backup.
Think of the file as the map of your vault. It knows your three public keys and how they fit together, but it can't spend anything. Keep it with your recovery words. With this file and any two of your keys, you can always reach your bitcoin, even if you can't reach SignBit.
10. Bring the vault into BlueWallet
In the same window, choose Copy under the vault backup. That's your whole vault in one line of text, with no private keys in it. Send it to your phone, by email to yourself for example. It can't spend anything, but it does show your vault's balance, so send it only to yourself.
In BlueWallet, tap +, then Import wallet. Tap Paste, then Import. BlueWallet finds a Multisig Vault. Pick it and tap Import.
Paste the copied text here, not the backup file you downloaded.
11. Put your key back into BlueWallet
Right now BlueWallet can see the vault, but it can't sign for it yet. Open the vault and tap Manage Keys. Under your BlueWallet key, tap I have a seed for this key, type in the 12 words you wrote down and confirm. Then tap Save at the bottom.
Not sure which key is yours? Don't worry. BlueWallet only accepts your words on the key they belong to. In our example it was Vault Key 3.
This is the one place your words go back in, in BlueWallet on your own phone.
12. Check the receive address
Before you send real money, check the address. In BlueWallet, open the vault and tap Receive. In SignBit, look at the Receive tab on the vault page. The two addresses must match, character for character. Each app works the address out on its own, so a match tells you it really belongs to your vault. Our guide on checking a receive address goes further.
13. Send a small amount first
Send a small amount to that address from another wallet. Once it arrives, BlueWallet shows the balance, and so does SignBit. Send the rest only after this first payment has arrived.
14. Start a send in SignBit
Now send some back out. On the vault page, open the Send tab. Paste the address you're paying into Recipient address, then type an amount, or choose Send max to send everything. Pick a fee rate, choose Continue, check the review and choose Continue again.
On the Sign step, choose Download unsigned transaction (PSBT). It's just a file, and on its own it can't move anything. Get it onto your phone.
15. Sign it in BlueWallet
In BlueWallet, open the vault and tap Send. Open the menu at the top right and choose Sign a transaction. Tap the file icon at the top of the scanner and pick the file. When BlueWallet asks Co-sign this transaction?, tap Yes.
BlueWallet shows the amount and the address it signed. Check they're what you entered in SignBit. That's one of the two signatures done. Tap Provide signature, then Share... and Save..., and save the signed file. Then get it back to your computer. If it's easier, Share... in that same menu sends the file straight to your email or another app.
16. Approve and send in SignBit
Back on the Sign step in SignBit, use Choose file under Upload signed transaction (PSBT) to pick the signed file, then choose Submit signed transaction. One of your keys has signed, so SignBit can add the second.
Choose Approve & send. SignBit checks the payment against your vault's rules, adds its signature and sends it to the Bitcoin network. You'll see Payment sent.
17. Bigger sends wait a day on a new vault
New vaults come with a protective rule. Up to 0.01 BTC a day goes out straight away. A payment that takes the day's total past 0.01 BTC waits 24 hours before SignBit signs, and everyone on the vault gets an email with a link to cancel it. If it wasn't you, one press stops it.
Only sends that need SignBit's signature wait. Your BlueWallet and Fountain keys together never do. You can loosen the rule later, as our guide on setting a spending policy explains.
18. Why it works
That payment needed two keys, BlueWallet on your phone and SignBit's. If someone got into your SignBit account, they still couldn't send anything without one of your keys. If you lose your phone, your Fountain key and SignBit can still move everything, and your 12 words bring your BlueWallet key back. And with your own two keys and the vault backup, you can always move your bitcoin without us.