Descriptor Backup

Put your wallet's map on Bitcoin, so your keys are always enough.

A multisig wallet needs two things to spend: enough keys, and the descriptor that says how those keys fit together. Lose the descriptor and the keys alone will not open the wallet. This page encrypts the descriptor so that your own keys unlock it, and gives you a line of text to write onto the chain. After that, your keys are enough.

How this works and how to use it safely

Everything happens on this device. The descriptor is encrypted in your browser. Only the encrypted text leaves this page, and only when you publish it.
What goes on the chain is public and permanent. Anyone can read the encrypted text. Only your keys can decrypt it. Treat this as a one-way decision.
Your policy stays readable. The script type, the threshold and the derivation paths are not encrypted, because whoever recovers needs them to know which keys to derive.
Never put seed words here. Seeds belong on steel or in a codex32 kit. This page takes a descriptor and nothing else.
Recovery does not need us. The text this page produces can be decrypted by other tools. See the recover step for how.

1 Your descriptor

Export it from your coordinator. In Sparrow: Settings, then Export, then Output Descriptor.

2 Who can open it

My wallet's threshold The same number of keys it takes to spend. A 2 of 3 wallet needs 2 keys to open the backup. Matches your wallet exactly, so the backup is never harder to open than the money is to spend. Any one of my keys One key opens it. Easier to recover, and easier for anyone who gets hold of a single key. Follows the draft BIP-138 format, which other wallets are starting to read.

3 The text to publish

Put it on the chain

Two ways. Both put the same text into one OP_RETURN output. Keep the transaction id afterwards, and write it on your estate insert.

Pay someone to publish it

opreturnbot.com takes the text and publishes it for you. You pay on chain or over Lightning. You need no node and no wallet software.

Paste the text into its Message box.
Tick Private. Without it the site announces your backup on social media. Your backup is public either way, but there is no reason to advertise it.
Pay on chain or over Lightning.
Copy the transaction id and bring it back to step 4 here.

The transaction comes from their wallet, so your own coins are never linked to your backup.

Publish it yourself with Bitcoin Core

Run this against your own node. It builds, signs and broadcasts in one step.

Needs Bitcoin Core 30 or newer, with a funded wallet loaded. It prints the transaction id; bring that back to step 4.

Not finished yet. Publishing is not proof. Come back here with the transaction id and let this page read your backup off the chain. A backup nobody has read back is a guess.

4 Prove it landed

Paste the transaction id from whoever published it. This page reads the bytes back off the chain and opens them with the keys already in your descriptor, so you have to type nothing else. Come back any time: leave, return with the transaction id, put your descriptor back in step 1, and this still works.

Transaction id Explorer (optional)

1 Find the backup

I have the text Paste it from the estate insert, a file, or a block explorer. I have the transaction id This page fetches the text from a public explorer. It is the only step that touches the network.

2 Your keys

Paste the extended public keys of the wallet, one per line.

Derive these from your seeds with your signing device, using the paths shown above. This page never asks for a seed.

3 Your descriptor

If this page is gone

Neither format is ours to own. A threshold backup uses the published multisig-backup format. A one-key backup follows draft BIP-138. Both are open, and other software already reads them, so your descriptor can be rebuilt with no Bitcoin Butlers involved.

Your estate insert names the tool and how to reach it, because that is the page someone reads on the day this one is gone.