When the cats were being introduced, the week that worked was the week of the closed door with a gap underneath. Information crossed — scent, sound, a paw occasionally — and nothing else did. Neither animal could reach the other, and that was precisely what let them get comfortable.

There's a way of signing bitcoin transactions built on the same principle: let the information across, never the access. It's called air-gapped signing, and the piece that makes it work is an unglamorous file format almost nobody outside wallet development has heard of.

1. The Problem It Solves

Your private keys live on a hardware wallet. To spend, that device has to sign something. The usual way is to plug it into a computer over USB — the computer builds the transaction, the device signs it, the computer broadcasts it.

That's good. The keys never leave the device, and the device's own screen shows you where the money is going.

But the device is now, briefly, in electrical conversation with a general-purpose machine that browses the internet. Vulnerabilities in that path are rare and have existed. For most people this is a fine risk. For larger amounts, there's a version with no connection at all.

2. What a PSBT Actually Is

A Partially Signed Bitcoin Transaction is a standard file format for a transaction that isn't finished yet.

It contains everything needed to understand and sign a spend — which coins are being used, where they're going, what change comes back, what fee is attached — and a slot where signatures go. Crucially, it contains no private keys and it is useless to a thief.

That's the note you pass under the door.

The workflow splits into three roles, which can be three different machines:

• The watch-only wallet (on your laptop or phone, holding only the xpub) creates the unsigned PSBT.
• The signing device, which has never touched a network, reads the PSBT, shows you the details on its own screen, and adds the signature.
• The watch-only wallet takes the signed PSBT back and broadcasts it.

The keys and the internet are never in the same room. Not "protected from each other" — never in the same room.

3. How It Crosses the Gap

Three common transports, in descending order of paranoia:

• QR codes. The watch-only app displays an animated QR, the signing device's camera reads it, then displays its own QR back. Nothing physical is exchanged. Used by devices like Keystone, Passport, SeedSigner and others.
• MicroSD card. Save the PSBT to a card, carry it across, bring the signed file back. Physical, simple, and the card is the only thing that ever travels. Coldcard is the best-known device for this workflow.
• A USB cable to a machine that is itself offline. Weaker, but still a real gap if that machine never goes online.

All three move the same file. The transport is just how literal you want the gap to be.

4. Who Should Actually Bother

Honest assessment, as always:

Most people shouldn't. A hardware wallet over USB, with the address verified on the device's own screen, already gets you the large majority of the benefit. The attack it leaves open is sophisticated and rare; the attacks that actually drain people are phishing, bad backups, and devices of unknown provenance — none of which air-gapping fixes.

It's worth it when: the amount is large enough that a rare attack is worth someone's effort; you're already running multisig and signing on several devices anyway; or you simply prefer a setup where the words "my keys touched a networked computer" are never true.

It costs you: more steps per transaction, a slower process, and — the thing people underestimate — a workflow you must be able to perform correctly under stress, possibly years from now, possibly by somebody else following your letter.

5. The Side Benefit Nobody Mentions

PSBTs aren't only for the paranoid. They're also what makes multisig practical.

A 2-of-3 spend is literally a PSBT passed between keyholders: the first signs and passes it on, the second signs and it's complete. The people can be in different cities. The file can go by email, because it's useless on its own.

If you read the multisig article and wondered how two keys in two locations ever produce one transaction — this is the answer. It's the same note, under several doors.

The Point

The door stayed shut for a week and that's exactly why it worked. Everything each cat needed to learn about the other crossed the gap underneath; nothing that could go wrong did, because the only thing that could travel was information.

A PSBT is that gap, formalised. The transaction crosses. The keys stay where they are. And for most readers the honest recommendation is still the simpler one — but it's worth knowing that when the amount justifies it, there's a version of this where your keys and the internet are never introduced at all.

Let the note cross. Keep the door shut. 🐾⚡