← All posts

DIY & Open Source Security Masterclass September 8, 2026

Building an Airgapped Bitcoin Laptop: Part 4 - Offline Bitcoin Core, Output Descriptors & Airgapped PSBT Signing

In Part 1, Part 2, and Part 3, we selected our generic ThinkPad hardware, physically stripped its wireless communication cards, hardened the BIOS, and installed a clean, encrypted Ubuntu Linux environment. In Part 4, we bring the entire system to life: cryptographically verifying Bitcoin Core, generating seedless master keys using operating system entropy, exporting watch-only output descriptors to Sparrow Wallet, and executing full airgapped PSBT signing round-trips via USB.

Air-Gapped Bitcoin Core Architecture Diagram
Offline descriptor wallet generation and PSBT signing architecture on an air-gapped laptop.

The Security Core: OS-Level Entropy & Seedless Descriptors

Commercial hardware wallets rely on bespoke microcontrollers and closed-source RNG chips that have repeatedly suffered critical low-entropy vulnerabilities. In contrast, Bitcoin Core generates private keys using the Linux kernel's cryptographically secure random number generator (/dev/urandom), the exact mathematical foundation securing the modern internet. By storing our keys in an encrypted descriptor wallet on an offline machine, we eliminate single points of failure, vendor firmware dependencies, and paper seed phrase exposure.

Overview of the Part 4 Workflow

To keep this tutorial accessible to everyday Bitcoiners, we minimize command line usage and rely on clean graphical interfaces:

  1. Download & Verify Bitcoin Core: Validate developer PGP signatures and SHA-256 hashes on our online computer.
  2. Airgap Transfer & Launch: Move the verified binaries to our offline laptop and launch Bitcoin Core with a single terminal command.
  3. Generate Encrypted Wallet: Create a descriptor wallet protected by a high-entropy passphrase using native OS entropy.
  4. Export Output Descriptors: Extract Native SegWit (wpkh) descriptors and import them into Sparrow Wallet on our online PC as a watch-only coordinator.
  5. Airgapped PSBT Signing: Construct an unsigned transaction in Sparrow, sign it offline in Bitcoin Core, and broadcast the signed transaction to the Bitcoin network.

Step 1: Downloading & Verifying Bitcoin Core (Online PC)

On your internet-connected computer (Windows in this walkthrough), prepare the installation files:

1. Download Bitcoin Core Linux Binary

Go to bitcoincore.org (or bitcoin.org) and download the Linux x86_64 release tarball: bitcoin-*-x86_64-linux-gnu.tar.gz into your Downloads folder.

2. Download Hashes & Signatures

Download SHA256SUMS and the detached signature file SHA256SUMS.asc into the same Downloads directory. (If your browser opens the file as text, right-click and choose Save As...).

3. Download Developer Builder Keys

Download the Bitcoin Core builder keys repository from GitHub as a ZIP archive and extract it into your Downloads folder.

Cryptographic GPG Signature Verification

Open Windows PowerShell in the extracted builder-keys folder (hold Shift, right-click in the folder, and select Open PowerShell window here):

Get-ChildItem *.gpg | ForEach-Object { gpg --import $_.FullName }

This imports all official PGP certificates for active Bitcoin Core release signers.

Now, navigate back to your Downloads folder and verify the checksum signature manifest:

cd ~\Downloads
gpg --verify .\SHA256SUMS.asc .\SHA256SUMS

Scroll through the output and confirm Good signature from the recognized Bitcoin Core release signing keys.

Calculating the SHA-256 Hash

Compute the cryptographic hash of your downloaded Linux archive:

Get-FileHash .\bitcoin-*-x86_64-linux-gnu.tar.gz -Algorithm SHA256 | Format-List

Open the SHA256SUMS file in Notepad, locate the line corresponding to x86_64-linux-gnu.tar.gz, and verify that the calculated 64-character hash matches character-for-character.

Extracting & Preparing the Transfer Drive

Extract the verified .tar.gz archive. Plug in a dedicated USB flash drive (your clean 64GB transfer USB) and copy the uncompressed bitcoin-* folder onto the root of the USB drive. Safely eject the drive.

Step 2: Launching Bitcoin Core on the Offline ThinkPad

Insert your USB transfer drive into your offline Ubuntu laptop:

  1. Copy the bitcoin folder from your USB drive onto your Ubuntu Desktop.
  2. Open the Ubuntu Application menu (bottom-left Super button) and open Terminal.
  3. Type cd (with a space), double-click your bitcoin folder on the desktop, open the bin folder, and click-and-drag the bin folder directly into the Terminal window. Press Enter.
  4. Launch the Bitcoin Core GUI by typing the only terminal command you will ever need:
./bitcoin-qt

On initial launch, click OK on the default data directory prompt. When the blockchain sync screen appears, click Hide on the bottom-right corner. (Because the laptop is 100% airgapped, it will never connect to nodes or sync blocks).

Step 3: Creating an Encrypted Master Descriptor Wallet

Now, create your cold vault inside Bitcoin Core:

  1. In the top menu, go to File → Create Wallet....
  2. Enter a wallet name (e.g., SovereignCold).
  3. Check the box for Encrypt Wallet.
  4. Enter a strong, high-entropy passphrase (10+ random alphanumeric characters or 8+ Diceware words). Confirm the passphrase.
  5. Click Create.

Passphrase Security Warning: If you lose or forget this passphrase, your master private keys cannot be decrypted and your Bitcoin will be permanently unrecoverable. Write down your passphrase securely and store it in an offline, physical metal backup.

Step 4: Exporting Output Descriptors to Sparrow Wallet

To safely monitor balances and construct transactions on an online computer without exposing private keys, we export the public output descriptors:

  1. In Bitcoin Core, navigate to Window → Console.
  2. In the console prompt at the bottom, type:
    listdescriptors
  3. Bitcoin Core will return a JSON list of public descriptors for various script formats (Legacy, Nested SegWit, Native SegWit, Taproot).
  4. Open the Ubuntu Text Editor (Notepad). Locate the two Native SegWit descriptors starting with wpkh(:
    • External / Receive Descriptor: Contains "internal": false.
    • Internal / Change Descriptor: Contains "internal": true.
  5. Copy the descriptor strings (excluding surrounding quotation marks), paste them into a text file separated by a space or new line, and save the file as descriptors.txt onto your USB transfer drive.
  6. Safely eject the USB drive from your offline laptop.

Step 5: Importing Watch-Only Descriptors into Sparrow (Online PC)

Plug the USB transfer drive into your online PC running Sparrow Wallet:

  1. Open Sparrow Wallet and go to File → Import Wallet.
  2. Select Output Descriptor and click Import File....
  3. Select descriptors.txt from your USB drive and click Open.
  4. Sparrow instantly reconstructs the complete Native SegWit wallet, showing your master fingerprint, extended public key (xpub), derivation paths, and all unspent transaction outputs.
  5. Test Deposit: Go to the Receive tab in Sparrow, generate an address (e.g. test in), and deposit a small test amount (such as 10,000 sats). Sparrow confirms receipt on-chain via your connected node.

Step 6: Executing the Full Airgapped PSBT Signing Round-Trip

Partially Signed Bitcoin Transactions (PSBTs, defined in BIP 174) act as the secure cryptographic bridge between our online coordinator (Sparrow) and our offline signer (Bitcoin Core ThinkPad):

Phase A: Construct Unsigned PSBT in Sparrow (Online)

In Sparrow, go to the Send tab. Enter a destination address (e.g. test out), choose the amount (10,000 sats / Max), set your fee rate, and click Create Transaction. Click Save Transaction and save the unsigned .psbt file directly to your USB transfer drive.

Phase B: Sign PSBT Offline in Bitcoin Core (ThinkPad)

Plug the USB drive into your offline ThinkPad. In Bitcoin Core, go to File → Load PSBT from file... and open the .psbt file. Verify the recipient address, amount, and miner fee. Click Sign Transaction on the bottom left, enter your wallet encryption passphrase to unlock your private keys, and click Save... to save the fully signed PSBT back onto the USB drive.

Phase C: Broadcast Signed Transaction in Sparrow (Online)

Plug the USB drive back into your online PC. In Sparrow, click Load Transaction and open the signed PSBT from your USB. Sparrow verifies that 1-of-1 signatures are valid. Click Broadcast Transaction! Your satoshis are immediately transmitted to the Bitcoin network and confirm into the next block.

Roadmap: The 5-Part Series Overview

We have now successfully transformed a $100 second-hand laptop into an institutional-grade sovereign signing machine:

EP 01

Philosophy, Threat Models & Hardware Selection

Why generic hardware outperforms commercial signers on supply-chain and RNG risk.

EP 02

Physical Radio Removal & BIOS Hardening

Disassembling the laptop, removing the mini-PCIe Wi-Fi card, and disabling Bluetooth/ports in BIOS.

EP 03

Cryptographic Verification & Encrypted Ubuntu Installation

GPG verification, SHA-256 hashes, Rufus bootable drive creation, and offline disk encryption.

EP 04

Bitcoin Core Offline Installation, Descriptors & PSBT Signing

Generating seedless keys using OS entropy, exporting descriptors to Sparrow, and signing airgapped PSBTs (this guide).

EP 05

Long-Term Key Preservation & Generational Inheritance

Encrypted backups, Coldcard/seed compatibility, and building durable inheritance procedures.

Want 1-on-1 Guidance with Sovereign Self-Custody?

Whether you are building your own airgapped signing machine, architecting a multi-vendor multisig vault, or creating an unshakeable inheritance plan, I provide private 1:1 coaching sessions tailored to your exact security needs.

Book a 1:1 Coaching Session

Watch Episode 4 on YouTube

Watch Forrest HODL walk through the full hands-on demonstration: cryptographically verifying Bitcoin Core, generating the descriptor wallet on an offline ThinkPad, and completing a live airgapped PSBT transaction round-trip with Sparrow Wallet.

Watch on YouTube