Supports numeric coin-type and account indexes for single-signature and multisignature derivation. Purpose, coin type, and account indexes are hardened by default; the starting address index is unhardened by default. Each can be changed independently. Coin type 0 uses Bitcoin Mainnet, coin type 1 uses Bitcoin Testnet, and custom indexes retain Mainnet address serialization. Hardened address children require private key material and therefore cannot be derived from multisig co-signer xpubs. A network picker in the header (the Bitcoin-orange coin next to the network name) offers Bitcoin, Testnet, Signet, and Regtest; it shows the network every tool is set to and switches it — address formats, extended key versions, WIF prefixes, and coin-type defaults all follow, and each menu entry spells out the checks its choice implies. The PSBT tools read the picker's choice directly and have no network control of their own. Nothing connects anywhere: the choice only picks formats, and a tool's own advanced fields can still override it. Every load starts on Mainnet again.

Derives watch-only multisignature wallets from extended public keys without requiring private keys. Multisig script type and purpose are separate as well; conventional script choices restore their standard purpose, while pasted co-signer origins auto-detect and must agree with the selected path indexes and hardening choices. An exported wallet descriptor can also be pasted to repopulate the station — quorum, script type, key order, and co-signers; descriptors carrying private keys are refused. Addresses are derived from the exported output descriptor itself by rust-miniscript (in the WASM crate), so the two cannot drift.

Watch-only descriptors (single-signature and multisig) and a multisig's BIP 388 wallet policy each carry a QR button. Up to 1,000 characters the code is the text itself; a longer one is shown as an animated ur:bytes sequence, in the same fixed-rate UR parts the PSBT editor uses for ur:crypto-psbt. An extended private key never gets a code.

Inspects PSBT v0 transactions (paste, or upload a binary .psbt / hex or base64 text export; the loaded bytes download as .psbt or .txn), reports PSBT-provided amounts and fees, checks for repeated ECDSA nonces from the same public key — including signatures carried by finalized scriptSig/witness fields, which are decoded and analyzed rather than skipped — verifies optional Jade anti-exfil (sign-to-contract) transcripts without a key, and can compare supported SegWit v0 SIGHASH_ALL signatures with RFC 6979, including Bitcoin Core-style low-r grinding, in a temporary session. A signature on a script containing OP_CODESEPARATOR is reported as unverifiable rather than compared, because its digest commits to the script from just past the last executed separator. Every input's declared sighash policy and each signature's appended sighash byte are decoded without a key; anything other than exact SIGHASH_ALL (or Taproot's equivalent SIGHASH_DEFAULT) is a blocking warning. Finalized signatures that cannot be decoded or associated with a key block any clean nonce verdict. The report gives each check a completed, problem, or incomplete state and gives an overall incomplete result whenever required data or support is missing. “Completed” describes only that check against the data in the file; it is not a claim that the transaction is safe or that PSBT-provided data is true.

Host randomness (rho) remains sensitive after signing. A malicious signer using an operator-known base nonce can expose the signing key if its operator later obtains rho and the signature. With the corresponding account xpub and a non-hardened derivation path, compromise can extend to the account private key. Do not save, share or record real transcripts or paste them on a shared/recorded screen. Clipboard copies can persist outside this page.

In normal and preview builds, tab hide, idle timeout and print clear the pasted transcript and last-inspection cache and close its disclosure. Plain window blur preserves them so the opening or PSBT can be copied from another window; other revealed secrets and visible result panes are still concealed. End Session and pagehide clear field/cache. Clearing is best-effort; browser/OS copies are outside reliable erasure. A successful transcript check does not establish that host randomness stayed secret.

Accepts a fully signed raw Bitcoin transaction (hex or base64) in the same inspector: outputs, extracted ECDSA nonces, and inscription-envelope hints. Fee and RFC 6979 cannot be checked without previous outputs.

Keeps an optional cross-session ECDSA nonce history in page memory and lets the user download or upload it as versioned JSON. The file contains only the check time, master fingerprint when available, raw r, a domain-separated SHA-256 tag for the exact signing key, a tagged message or source identity, and a verification flag — never the PSBT, transaction, signature, public key, or message digest. The exact-key tag prevents child keys sharing a master fingerprint from being conflated. It can confirm reuse only when the same key/r pair has different verified message digests; incomplete records produce a warning instead. The file is correlation-sensitive metadata and should remain offline. Nothing persists unless it is downloaded.

With a session seed, root xprv, WIF, or hex key, labels each output as change, receive, or not in this wallet (accounts 0–2, 50 receive + 50 change, all four script types). A two-or-more-output transaction with no matching change is a blocking warning. OP_RETURN outputs are decoded for size and a text/hex preview; the tool does not create data-carrier outputs.

Scans PSBT tap-leaf scripts and finalized witnesses for inscription envelopes (OP_FALSE OP_IF "ord"). Reports content-type, size, and text previews; does not number sats, fetch chain data, create inscriptions, or render images.

Edits PSBT v0 and v2 (BIP-370) files field by field (a bip174.org-style editor backed by rust-bitcoin compiled to WebAssembly): a mempool.space-style transaction-flow diagram draws one box per input and output (claimed amount, address or script template, signing status) with per-column totals and bezier connectors into the unsigned transaction; selecting a box opens that key-value map for editing in a panel under the diagram, the transaction box opens the version/locktime fields, and output amounts edit directly in their boxes. Every key-value pair of the global, per-input, and per-output maps is decoded (BIP-174 and BIP-371 taproot fields), editable as raw hex, and removable, new pairs can be added, and the unsigned transaction's version, locktime, input prevouts/sequences, and output amounts/scripts get structured fields. Fields longer than 64 characters (a whole previous transaction, a large script) collapse to a truncated preview with a length label; clicking the cell opens the full text in an editor window, where values stay editable. Re-serialization is validated by rust-bitcoin before the edited PSBT is shown. A second PSBT can be pasted for a semantic comparison against the editor's: the underlying transaction, the signing state, and the PSBT metadata are diffed separately on the decoded contents, so reordered map serialization is not reported as a change. The comparison reports differences only; it does not judge whether a change is safe. An edited PSBT too large for a static QR code is shown as an animated ur:crypto-psbt fragment sequence for air-gapped scanning, and an Insane editing switch lifts the consensus-layer checks for deliberately broken files while still listing their problems. The editor never signs anything.

Verifies and extends Bitcoin Core descriptor wallets (Core Wallet tab): upload a SQLite wallet.dat (Bitcoin Core 23+; legacy Berkeley DB wallets are refused) and every record is decoded — client versions, wallet flags, sync locators, descriptors with their cached branch parents and private-key records, and the active scriptPubKey pointers — then re-checked claim by claim: descriptor checksums and recomputed DescriptorIDs, cache parents re-derived from the account keys (an honest warning where a descriptor shape sits outside that re-derivation, never a silent pass), private-key records against their pubkeys and record hashes, the network magic against the chain's genesis hash, and every descriptor key's xpub/tpub version against that network. Private key material is listed but redacted unless a reveal toggle is on. Additional ranged descriptors (watch-only or, into a wallet that already signs, private) can be appended; the rebuilt database is re-parsed and re-verified before it downloads (an edited file that fails any check is not offered), and records the tool does not decode are preserved byte-for-byte. As with Core, a private descriptor is refused by a disable-private-keys wallet, and a descriptor whose keys belong to another network is refused. A signing wallet's proven key material can also move into a Key Station slot for review: the private key records are reassembled into the exact root or account xprv they belong to (given the descriptor's own public bookkeeping) — only when the secret provably matches the record's pubkey and the embedded extended key — and the Key Station opens with the key filled in for the user to derive and compare by hand, on the wallet's own chain (a regtest wallet derives bcrt1…). Only the standard path the Key Station derives is accepted (a master key with its purpose/coin/account-0 tail, or an account key on /0/* or /1/*); a non-standard path is skipped, because the fingerprint would still match while every address would not. Watch-only and Core-encrypted wallets are refused outright.

Derives BIP-85 child entropy from the active key's BIP32 root (or a pasted root xprv): English BIP-39 mnemonics (12–24 words), HD-seed WIF, XPRV, HEX, and Base64/Base85 passwords. Same parent, application, and index always reproduce the same child — this is a calculator, not a generator. Children follow the published BIP-85 vectors and match COLDCARD, including derivation from a passphrase-extended root when a BIP-39 passphrase is in effect. Unremoved BIP-39 and XPRV children can be selected as HD roots in BIP-85, Silent Payments, Vanity, PSBT/Nonce inspection, and multisig; WIF children can be selected for PSBT/Nonce inspection. Their pickers show the parent LifeHash, an arrow, then the child LifeHash and fingerprint. Deleting a child removes its picker options and wipes any private sessions loaded from it. Vanity matches from an immutable child can be searched and copied, but not written back to that child.

Derives BIP-352 Silent Payment addresses (sp1q… / tsp1q…) from a seed or root xprv, including labeled codes, BIP-392 spscan / spspend descriptors, sender taproot outputs from pasted vin JSON, and receiver verification of pasted x-only outputs. Prints a BIP-321 bitcoin:?sp= URI and the BIP-353 DNS TXT to paste on a domain you control; paste that URI back on Send. Hybrid URIs with an ordinary Bitcoin fallback address still use Silent Payments; the results identify the fallback address as not used.

Privacy tab, BIP-47 payment codes station: derives your payment code and notification address from the BIP-47 account (m/47'/coin'/0') of a seed or root xprv, decodes a contact's code with no private key, lists the pair addresses to pay or receive (10 at a time, real indexes, skipped indexes listed), and checks a pasted notification transaction offline (designated input found automatically; a manual override is marked unverified). A receive key is shown only on request; anyone who paid you there could rebuild your BIP-47 account key from it, so it must never be shared. Nothing is signed or broadcast. This is a calculator: it does not scan the chain or resolve names.

Grinds vanity addresses for a Key Station key or a compatible BIP-85 child (Vanity tab), picked through the same chip picker as BIP-85 and Silent Payments. Two methods: the passphrase grind extends the key's BIP39 passphrase with base-62 odometer counter characters, the derivation grind keeps the passphrase and steps through BIP32 account indexes. Every candidate is derived the standard way (PBKDF2 seed, BIP32 path — the key's own purpose, account, branch, and address index) in a dedicated WebAssembly module, one Web Worker per CPU core, and its mainnet address of the selected type (legacy, nested SegWit, native SegWit, Taproot, or a BIP-352 Silent Payment code) is checked against the chosen prefix. For Silent Payment codes, the first custom character is limited to g f 2 t v d w 0; later characters can use the full Bech32 alphabet. A short timing sample on tab entry (fixed published constants, never the session's keys) turns the odds into an expected time to a match, and Stop on first find halts the grind at the first hit. Same key and counter always reproduce the same address, so nothing is invented. For a Key Station source, Update key writes a found passphrase or account index back to the key and re-derives it, so the Keys tab, its exports, and the Journal show the vanity wallet. BIP-85 children stay unchanged. Found passphrases stay in page memory, are masked until revealed, and are wiped with the session.

Derives Lightning node identity public keys (a Lightning tab held back from release navigation while its UI is polished) from a seed phrase: an LND 24-word aezeed cipher seed is deciphered in WebAssembly (scrypt key derivation, AEZ v5, CRC-32C checksum; a wrong passphrase is detected, unlike BIP39) and its entropy derives the node key at LND's m/1017'/coinType'/6'/0/0 keychain path, while a BIP-39 phrase follows the ldk-node convention (BIP39 seed, master key, re-seeded second BIP32 tree, node secret at m/0'). The decoded cipher seed's internal version and wallet birthday are shown alongside the node key; the decoded entropy and salt and the BIP32 root xprv (what chantools showrootkey prints) sit behind a reveal toggle. Decoding only: the tab never creates seeds.

A session Journal has three working areas: Notes, Keys, and Session. Notes opens first; Keys holds recoverable key inputs, and Session shows the current report first, saved historical snapshots in their own disclosure, and the Debug log separately. Current and saved reports have independent reveal, copy, and export controls; revealed labels use the same red cue as private data elsewhere. In live and saved snapshots, private field labels are red and their values blue, using the same styles as derived keys; public fields keep their ordinary styling. Saved snapshots, including older backups and files opened through Open report, highlight recognized report fields without changing their text. Unrecognized text stays plain; coloring does not verify saved contents. Copy and export preserve the original text. Multisig reports include public descriptors, paths, and displayed addresses. Create journal and Open backup are the starting choices. Section tabs and global controls stay hidden until the user creates a journal, with or without a password, or opens an existing backup. The create form reports whether password protection is enabled and checks confirmation matches live without exposing what was typed. A blank password is accepted and provides no access protection: anyone holding the resulting file can open it by leaving the password blank. Journal-wide backup and Clear journal actions remain available alongside protection and save status in every area. The complete backup contains every notes page and its formatting, all managed and archived key inputs, unfinished Key Station inputs, saved historical records, the session snapshot, and the debug log. The complete backup includes the current private recovery snapshot even when the on-screen snapshot is concealed. Unfinished Key Station inputs restore as a separate, unverified input set in Keys; they never replace the current working form or derive automatically. An empty working form consumes no backup slot. The 100-active-input limit includes an unfinished form; backup refuses overflow rather than omitting it. These limits apply to Journal storage, not standalone Key Station derivation. Changes to notes and key inputs mark the Journal as unsaved; edits made while a backup is encrypting remain unsaved. Clear journal opens a confirmation with choices to download a backup, discard the Journal, or cancel. Downloading keeps the Journal open: the page cannot verify that the file was saved, so discarding still requires an explicit choice. Cancel keeps the Journal intact. Discard wipes the password and Journal contents from page memory on a best-effort basis and returns to the create/open gate. Keys still open in Key Station remain there; End Session clears the whole page. Leaving the page still clears the Journal without this confirmation. The backup uses AES-256-GCM; the key is PBKDF2-SHA-256 (600,000 rounds) of the optional password the user chooses, with the salt derived from that password and the IV HMAC-SHA-256 of the plaintext. The file is a pure function of password and backup content; no CSPRNG is called. Nothing is stored in the browser; download a file to keep it. Closing the page discards the sitting. Opening a complete backup restores its Journal sections together. Saved snapshots are historical text, concealed until explicitly revealed; they do not recreate live wallets, multisig sessions, or PSBTs. Backup snapshots keep recovery material and descriptors but omit recomputable address and WIF rows; the live Session report and its separate export still include those rows. Reopening and saving without newly derived results does not append another snapshot. Changed derived results append a report while preserving earlier recovery material. The snapshot size limit remains explicit; export saved history before removing it if that limit is reached. Open report reads exported snapshot and Debug log files using the open Journal's password setting. Its read-only viewer starts concealed and never installs data into tools or the Journal. Closing the viewer, automatic concealment, or clearing the Journal releases its report text. Session offers Remove saved snapshot when history is present. Confirmation removes that history from this Journal and future backups while preserving current session data, notes, key inputs, and existing downloaded files; Cancel keeps it. Old entry-only files remain readable, and their records appear in Keys only when present. Existing saved records can be edited. Save or cancel an open record edit before downloading a complete backup. Changing its recovery inputs removes the old wallet association; changing its label or notes preserves it. Journal no longer creates manual entries or duplicate records on each derivation. Complete backups retain historical records and require the updated reader (payload version 3). Section-only exports remain secondary controls. Clear debug log asks for confirmation; Cancel keeps the log. Confirming removes its events and leaves one event marking the clear. Pending log exports cannot download the old log after it is cleared. The log follows new events only while the reader is already at the bottom. Recovery exports use the Journal's password setting; a password protects them, while files created without one have no access protection. The debug log export follows the same password setting. The Keys area exports all available source inputs and archived inputs into an .elkeys file. Its summaries use the app's shared text styles; public fingerprints, paths, and keys copy on click with inline feedback. Archived metadata wraps to keep the complete path readable. The file uses the open Journal's password setting without another password prompt, random salt, or random nonce. Import key inputs is available beside the Key Station action and previews the input names and archived count before changing the Journal. Encrypted key-input imports must use the current Journal's password; importing with a separate source password is not yet supported. Import and derive adds the new inputs and derives them in order, using each input's saved network; archived inputs stay archived. Canceling the preview leaves the Journal unchanged. An archive-only file imports its archived inputs without starting derivation. Derive all pending retries outstanding inputs, and Review inputs loads one into Key Station for editing, asking before replacing an unfinished draft. The saved network appears beside Derive Key and follows an explicit Network-menu change. Archiving the source or clearing Journal does not change that reviewed draft's network or bypass its duplicate checks. If Journal has been cleared and derivation reuses an existing key, the reviewed inputs remain in the Key Station draft. Imports remain unverified inputs until fresh derivation succeeds. Cached addresses, private outputs, fingerprints, and claimed identities from legacy files are discarded. New key files use input-only format version 2; version 1 files remain importable. Cached outputs cannot replace missing source inputs. A present passphrase must be text; malformed values reject the whole file before preview or installation. A freshly derived full-root identity (or compressed public key for an imported single key) and matching setup reuse the existing station key unchanged and archive the imported source inputs. The setup comparison includes network, scripts, paths, ranges, and available recovery material. If reviewed inputs were corrected before reusing an existing key, the original inputs and a separately labeled reviewed copy are retained in the archive. If the same wallet has a different setup, choose Keep existing to leave the imported inputs pending, Add separate setup, or Stop deriving to stop the batch. Account-level imports without a comparable root identity get separate station tabs. Failed and unprocessed inputs remain pending; stopping a batch keeps keys already added. Low-entropy and fingerprint-collision warnings still require their usual decisions. The batch preserves and restores the unfinished Key Station draft and previous station selection. Newly derived imported keys keep their names, with a numbered suffix if another key uses the same name; reusing an existing setup keeps that station key's name. Archiving is available for detached inputs and does not unload a live Key Station key. Restore and derive returns archived inputs to the active list and runs the same derivation and duplicate checks as import. Failed or stopped inputs stay available for review and retry. Archive rows show the saved method, network, and path to distinguish input sets before use. Deleting a Key Station tab while a Journal is open removes it from the station while retaining its inputs in the Journal. Open all saved keys returns multiple verified, detached keys to Key Station together, without deriving them again or changing pending inputs. Notes is a plain text editor with up to 100 named pages. Pages use the Key Station's numbered naming convention, can be added or removed with the +/− controls, and can be renamed by activating the selected page again or pressing F2. Default names such as Page 1 shorten to P1 in narrow windows. Notes defaults to the same monospace input text as the rest of the app. Appearance controls can customize each page's typeface, text size, and line spacing. The editor can be resized vertically. Its key picker lists derived Key Station keys, multisig wallets, and BIP-85 children with their LifeHashes. Choosing one inserts a public inline reference; multisig references retain the wallet name, threshold, and ordered co-signer fingerprints, with unknown origins explicitly marked. Notes can import plain notebook JSON or a Journal-format export while the matching Journal is open. Switching pages retains each page's caret, selection, and scroll position for this sitting. Invalid or duplicate page names show a correction message. Names and note text remain exactly as entered when the interface language changes. Section imports accept encrypted exports up to 4 MiB; canceling an import or rejecting a file does not mark saved content as changed. New pages start with this computer's current local date and time. A placeholder beside each live timestamp disappears when editing begins; it is never included in copied notes or backups. Ctrl/⌘+Enter appends another timestamped block at the end of the page, preserving existing text and separating notes with a blank line. The new timestamp ticks each second until the first edit on that page, including typing, paste, deletion, undo, or starting input composition. Clicking, selecting, and scrolling leave it ticking without moving the caret or changing backup status. Deleting a note's entire body while leaving its final timestamp restarts that clock; Undo can recover the deleted text. Imported timestamp-only notes stay fixed until explicitly edited. Importing onto an untouched starter page replaces that starter instead of adding a redundant page. Enter continues the current note. Typing, clicking, and deleting never insert timestamps. Each line-start timestamp and its two following spaces are protected from partial edits, including timestamps in older backups. Select its complete note, through the text before the next timestamp, to delete it; selecting all clears the page. Body text and timestamp selections remain freely copyable. A refused drag into a protected timestamp restores the source text. Imported CRLF/CR newlines normalize to the editor's LF newlines, and lookalike references retain their literal spelling. Backspace immediately after an empty timestamp removes the complete timestamp and its two spaces together; a fully cleared page stays empty. Key references still select and delete as complete units. Moving the pointer over the editor briefly reveals its clipboard button at the right edge; the same control is reachable from the keyboard and copies the active page as readable text. Notes and Debug log copy controls read their current text only when clicked; they do not retain another copy of it on the button. The separate notes export encrypts versioned UTF-8 JSON containing page names, styles, and structured text/key runs. References contain public descriptive metadata, never key material or instructions to restore a wallet. Multisig references use text runs so older notebook readers preserve their contents. LifeHashes are regenerated locally when that file is uploaded in a later session. Older .txt notes can also be uploaded as a single page. The Journal also holds a read-only summary that updates as the sitting changes and a detailed debug log: navigation, appearance, tool and station changes, calculations and failures, safe setting changes, privacy toggles, copies, imports, downloads, clears, and PSBT structural edits. It retains up to 512 KiB of UTF-8 JSON event data or 10,000 events, whichever comes first. At the limit it removes the oldest events and shows how many were removed. The reader shows 400 events at a time, with Earlier, Newer, and Latest events controls; reading earlier history does not change what gets copied or exported. Opening a complete backup places its saved history before events already recorded in this browser session and combines their discarded-event counts. The same retention limits apply to the combined log; opening a legacy entry-only file also preserves this session's existing events. Backups from the original 400-event Journal remain readable within the 512 KiB log limit; an unusually large older log is rejected explicitly, without trimming it. Backups with more events require this updated reader. The existing overall backup and file-size limits still apply. New events record public fingerprints where useful, but omit secret-field values, raw derivation-path input, filenames, note bodies, PSBT bytes, and individual entry keystrokes. Imported event text is unverified and may contain sensitive information. Display, Copy, and Export escape control characters and invisible separators so an imported field cannot impersonate another event; backups retain the original field data. Copy debug log copies all retained events as plain text. Export debug log downloads an encrypted report using the Journal's password setting. Both capture the log when clicked, before adding their own outcome events, and include a notice if older events have been removed. Requests and completed operations are distinguished; a download starting does not confirm that the file was saved. The exported report keeps the existing format and remains readable through Open report. Clear debug log offers Export first, Clear, and Cancel. Export first keeps the log and dialog open so you can check the downloaded file before explicitly clearing. Clear removes only the log and its discarded count, then records one clear event. Cancelling an export still being prepared prevents its download handoff. Nothing is stored in the browser; download a file to keep it. Closing the page discards the sitting.

Runs a quick barrage of startup sanity checks on the host browser (secure context, CSPRNG, BigInt, UTF-8 encoding, NFKD, and WebAssembly). If any check fails, the page is replaced with a failure report listing the failed checks, because wallet output from a broken host cannot be trusted. iPhone/iPad/Mac Lockdown Mode blocks WebAssembly (the secp256k1 engine): exclude the site in Safari's page menu, or open the saved HTML in Firefox on an air-gapped computer. There is no JavaScript secp256k1 fallback.

Before any input is wired, runs published test vectors (BIP39 encoding and seed, BIP32 private and public derivation, the BIP44/49/84/86 first receive addresses, and an RFC 6979 ECDSA signature and its verification) through the same WebAssembly engine the calculator uses, and kills the page the same way if this browser computes any of them wrong. The separate PSBT module gets the same treatment once it loads: BIP-174 and BIP-370 decodes, a byte-exact rebuild through the editor's own path, rejection of an invalid file, and the BIP-341 Taproot sighash-byte rule. It catches a miscompiling engine or a corrupted copy; it cannot catch an exploit aimed at the vectors themselves, so for anything that matters, compare the master fingerprint and first address against a second browser or signing device too.

Produces recovery information that can be saved or printed for offline use.

Exports a Bitcoin Core wallet.dat (SQLite descriptor wallet) with every derived output descriptor already imported — receive and change for each script type, active and ready for address generation. The default download is watch-only; while private recovery material is shown on screen, the export becomes the spending variant (account xprvs as descriptor keys) and the button says so. The descriptor birthday defaults to genesis so recovered keys are discovered by Bitcoin Core's initial scan; choose the "New keys" birthday only for entropy created at that moment. If a loaded wallet looks empty, repair it with rescanblockchain 0 in Bitcoin Core. Generated database files match Bitcoin Core's own record layout byte-for-byte (verified against Bitcoin Core v28.3.0).

A derived multisig can export a watch-only Bitcoin Core wallet.dat (same SQLite descriptor wallet as Key Station, never with private keys) and the importdescriptors JSON for a blank disable_private_keys wallet. Drop the .dat in wallets/<name>/ and loadwallet, or feed the JSON to bitcoin-cli importdescriptors. A derived multisig also prints and saves a one-page watch-only policy sheet (network, m-of-n, co-signer fingerprints, descriptor checksum, receive address 0) so every signer can verify the policy before funding, and a BIP 388 wallet policy (template + xpubs) for wallets that register policies. Calculator export, not a generator.

On a derived key, Edit Input loads its inputs into Key Station. Derive New Key creates a separate tab, including for identical inputs. The secondary action, Update Existing Key, replaces only that source tab after successful derivation. Custom tab names survive updates; a tab still named for its fingerprint follows the key if that fingerprint changes.

MS Station keeps a session key selected when its co-signer derivation path changes. Clicking that selected key removes it; using it on another co-signer still requires opting into key reuse and distinct derivation paths. On a derived multisig, Edit Input loads its inputs into MS Station. Derive New Multisig creates a separate tab and preserves existing multisigs, even when the inputs are identical. The secondary action, Update Existing Multisig, replaces that source tab after successful derivation. Multisig tabs display their saved names, including renames; updating an existing multisig preserves its name, and the edit note identifies it by its current tab name.

An optional Sync entropy across methods checkbox (off by default) keeps direct dice, card, number-base, seed-word, and private-key representations in sync while input is entered. Each destination waits for enough bits to emit its next complete character. Hashed inputs update the non-hashed methods in one direction; edits to non-hashed methods never overwrite hashed inputs. With sync off, every dice-roll method retains its own independent transcript.

SLIP-132 extended-key display is a prefix swap only (same payload, new version bytes and checksum). Import/derive shows the key as pasted, the account xpub/tpub, any account private-key export, and the descriptor (script in the descriptor, not the prefix). The master xpub/tpub is at m; the account xpub/tpub is at the selected account path. A generic xprv is re-prefixed only when the path/script match: x = legacy, y = nested BIP49, z = native BIP84, Y = nested BIP48 multisig, Z = native BIP48 native-msig. Testnet uses t / u / v / U / V. There is no Taproot SLIP prefix.

Displayed private recovery material cannot be highlighted. Use the clipboard icon beside its label (or in its table row) to copy it. This covers seed-word previews, WIFs, extended private keys, private descriptors, entropy and seed hex, BIP-85 children, Silent Payments and Lightning secrets, and Journal readouts. Clipboard icons appear only when their private values are revealed; successful copying briefly shows a green checkmark. Editable input fields retain normal text editing.

Public derivation values remain highlightable and copy when clicked. Their labels provide a compact clipboard icon where there is no QR button; QR-backed values keep their QR action without a duplicate clipboard icon. This includes fingerprints, public keys, extended public keys, descriptors, and addresses across the derivation tools.

Gates each release behind a two-step disclaimer: the first step warns that the software is experimental, and the second names what the browser cannot protect (keys paged to disk, clipboard history, memory surviving close) and unlocks only after the reader types a proof digit — derived from how long the warning was read, never from a CSPRNG. Acceptance is remembered per version, so each new release asks again.

Guards the session with just-in-time warnings: deriving from less entropy than recommended requires an explicit confirmation, and a newly derived key whose master fingerprint matches another open key asks before it is kept. While the page is offline, external reference links open as QR codes to scan with an online device instead of navigating.

Offers optional on-screen keyboards for mouse-only entry of seed words, passphrases, private keys, and Base64/Base32 text, and a footer toggle between dark and light themes.

Speaks five languages: a header selector switches the interface between English, German, Spanish, French, and Portuguese, with untranslated strings falling back to English.