Multisig accounts

What a k-of-n account is

A multisig account is a Taproot address whose coins move only on the script path: any k of its n signers must sign. Each signer signs the same message on their own, in any order. There are no rounds between signers. The PSBT carries the signatures until there are enough.

Independent keys need independent protection. Different public keys do not prove different owners, devices or backups.

Settings → Signers

Accounts are built from the signers this phone knows. In Settings → Signers:

• Pair a Ledger. Unlock the Ledger, open its Bitcoin app (2.1.2 or later; Bitcoin Test on signet) and tap Pair. The first time, confirm the same pairing code on both screens. The Ledger's multisig key is saved on the phone; nothing is approved on the Ledger until an account uses it.
• Keys someone sent. Save another person's key with a name, such as Bob. A key looks like [fingerprint/path]xpub…/<0;1>/*. Two keys sent together, such as a phone's and its Ledger's, count as one signer: both must sign for it.

This page also shows this phone's own key to send to others. Removing a signer does not change accounts already built with it.

Create, join and share an account

Multisig accounts are in Advanced mode, on the Wallet tab, in the Multisig section.

Create an account

Choose the members: this phone, a paired Ledger, keys someone sent, or an account already on this phone (its own policy then decides how it signs). Set how many must sign, for example Any 2 of 3 members spend. The app shows the resulting policy before you create it.

Join an account

If someone else builds the account, send them this phone's key from Join an account → This phone's key, alone or together with a paired Ledger's as one signer. When they share the account, paste it there. Winnow finds coins sent to it from then on.

Share with co-signers

Everyone who signs needs the account to see its coins. On the account page, Share with co-signers sends its descriptor.

The optional recovery path

When creating an account, turn on Recovery after a delay. Once a coin has not moved for the chosen delay (1 to 455 days, about 144 blocks a day), it can be spent by fewer of the same signers, or by a separate recovery key you paste. Coins that moved more recently still need the full threshold. The account's coin list shows the block from which each coin's recovery path opens.

A recovery path is part of the account's script tree, so every co-signer sees it in the shared account.

What a Ledger shows

A paired Ledger signs over Bluetooth. When an account includes it, Winnow registers the account on the Ledger, and you approve it in the Bitcoin app. A recovery path or a nested account needs Bitcoin app 2.2.1 or later.

Verify on Ledger has the Ledger derive the receive address; compare it with the one on its screen. When spending, the Ledger shows the payment on its own screen before it signs. Check the addresses, amounts and fee there, not only on the phone.

A Bitcoin Core wallet as one key

A Bitcoin Core wallet can hold one key of an account. Take its Taproot key from listdescriptors, written as [fingerprint/86'/1'/0']tpub…/<0;1>/* on signet, and save it under Settings → Signers. After creating the account, import its descriptor into Core with Core's own key replaced by the private version (importdescriptors). Core then adds its signature to a PSBT with walletprocesspsbt; paste the result back into Winnow.

Core is one signer here, like any other key. It is not a coordinator, and Winnow has no separate Core setup screen.

Back up before funding

1. Recovery words restore the wallet, not its multisig accounts. Only a backup file or the iCloud copy brings accounts back.
2. Current backups, file and iCloud alike, carry the multisig accounts, their Ledger registrations and the Signers list (public keys only). Make a new backup file after creating or joining an account.
3. Every other signer needs its own key backup. Winnow never holds another signer's private key.

The default backup file excludes recovery words and restores watch-only access. A file made with Include recovery phrase contains this phone's signing key; protect it as you would the words. Backup contents and limits →

Upgrading from the Swift app

On a phone upgraded from the Swift app, the saved people, Signers and multisig accounts that app stored are set aside, not deleted, and start empty. Pair the Ledger again, save other people's keys again, and join or restore accounts from a current backup or the shared descriptor.

Spend from an account

Every payment starts from Send, the recovery path included; the account page also has Send from this account. Review the payment, sign on this phone, and the payment waits under Transactions until the other signers have signed. Share the PSBT with them, or paste a co-signer's signed copy with Paste a PSBT from a co-signer. Once enough signatures are in, Winnow finalizes and broadcasts the transaction over its own peer connections.

Signers can sign in any order. Private keys stay with their holders; the PSBT carries the payment details and signatures.

Earlier account types

History, 25 October 2026: MuSig2 accounts and Bitcoin Core cosigners ended in 0.8.13, the Swift app's last full release. A backup carrying a MuSig2 account is refused rather than restored without those coins. Restore such a file in the Swift app instead.

How it is tested

• Every pull request runs testMultisigTwoOfThreeWithRecovery: a 2-of-3 built in the app with two Bitcoin Core wallets on a regtest node. The phone and both Core wallets sign, Core accepts a witness with exactly two signatures, and after a one-day delay the phone alone spends on the recovery path.
• testLedgerPairVerifySpend pairs a simulated Ledger under Settings → Signers, has it verify the receive address, and spends with the phone's and the Ledger's signatures. No real Ledger is in CI.
• On 26 October 2026, a real Nano X co-signed a mainnet 2-of-2 with the Swift app (0.8.14): transaction 6d2b391e…, block 973,281. The Lean app's CI uses the simulated Ledger.

The recorded journeys · Current test runs