Your seed lives on a card. Your signer forgets it.
Custos OS is an air-gapped bitcoin signer built on SeedSigner. It reads your seed from a PIN-protected SeedKeeper smartcard, by contact or NFC, signs your transaction, and keeps nothing once it powers off. Everything else is stock SeedSigner, on purpose.
No Wi-Fi
No Bluetooth
No seed storage
PIN-locked card
Contact or NFC
Bitcoin only
What it adds
SeedSigner, plus a smartcard
SeedSigner never stores your seed, so you bring it every time: as words, as a SeedQR, or with Custos, on a SeedKeeper card that only opens with your PIN.
Load a seed from a card
Choose a seed on your SeedKeeper and its 12 or 24 words go straight into memory. If the card holds a passphrase too, you decide whether to use it. Nothing is written to the device.
Save a seed to a card
Back up any loaded seed onto a SeedKeeper, labelled with its own fingerprint. The write is read back and checked before Custos calls it done.
Insert it or tap it
Use the contact slot or hold the card to the NFC reader. A live connection bar shows when a tapped card is steady enough, so it doesn’t drop out halfway.
A real PIN
4 to 16 characters typed on a full keyboard, so letters and symbols work. The PIN is masked on screen, so a glance over your shoulder doesn’t give it away.
Five strikes
Each wrong PIN shows how many tries are left. A card set up on Custos wipes itself after the fifth, so a lost or stolen card can’t be brute-forced.
Set up your own cards
Install the SeedKeeper applet on a blank JavaCard, set its PIN, or remove the applet again. The applet file ships inside the image and is checked against the upstream hash. Nothing is downloaded.
How it works
From cold to signed in four steps
Power on
The signer boots its image into RAM, with no network and no seed.
Present your card
Pick From SeedKeeper, then insert the card or hold it to the reader.
Unlock and choose
Enter your PIN, pick the seed, and check its fingerprint against your wallet.
Scan, sign, power off
Scan the transaction QR from your wallet, review it, show the signed QR back. Pull the power and the seed is gone.
Security model
Stateless by design
A signer that remembers nothing has nothing to give up. The secret stays on a card built to guard it, and the signer is kept small enough to read.
Nothing on the device
Seeds exist only in memory while the signer is on. There is no seed storage to steal, image or forensically recover.
No network, ever
Wi-Fi and Bluetooth are disabled in the build, and the Pi Zero v1.3 it targets has no wireless chip to begin with. Transactions move by QR code only.
NFC, honestly
NFC is the one radio link: a few centimetres, card only. If you don’t want it, switch the NFC reader off under Settings › Hardware › Smartcard interfaces, or don’t fit it.
A small, reviewable change
Only the card features were ported onto stock SeedSigner, rather than adopting a fork that is hundreds of commits ahead. Everything outside the smartcard code is upstream SeedSigner.
Card state, not guesses
Every card operation is confirmed by asking the card. If Custos can’t verify that something happened, it says “unconfirmed” instead of showing a green tick.
Can’t brick your card
Uninstall only offers Satochip-family applets. The card’s own JavaCard and GlobalPlatform packages are never listed, so a wrong pick can’t brick it.
Hardware
What it runs on
A standard SeedSigner build plus a smartcard reader. Parts are available from xmrstreet.store.
The computer
Raspberry Pi Zero v1.3
The board without Wi-Fi or Bluetooth. Custos OS loads from a microSD card and runs entirely from RAM.
Contact reader
SEC1210 smartcard HAT
A serial smartcard reader that sits on the Pi’s header. Insert the card and go.
Optional · contactless
PN532 NFC reader
Tap a card instead of inserting it. Fit one reader or both; each can be switched off in Settings.
Screen & camera
2.8″ display and Pi camera
Tuned for the 2.8-inch 320×240 panel. The classic 1.3-inch 240×240 SeedSigner screen still works. The camera scans QR codes.
Where the seed lives
A SeedKeeper card
Any JavaCard running Satochip’s SeedKeeper applet, such as the J3H145 or J3R180. Custos can install the applet on a blank card itself.
FAQ
Questions
What happens if I forget my PIN?
After five wrong attempts a card set up on Custos wipes itself, and the seed on it is gone. That’s the point: nobody else can guess their way in either. Always keep a second backup of your words or SeedQR somewhere safe.
Is my BIP-39 passphrase stored on the card?
When you save a seed that has a passphrase, the passphrase is written with it, and the confirm screen tells you so before anything is written. When you load a seed whose card holds a passphrase, you choose whether to use it or load the words only.
Can I still use words and SeedQR?
Yes. Everything stock SeedSigner does is still there: SeedQR scanning and export, entering 12 or 24 words, creating seeds from camera or dice entropy, multisig, message signing and address verification.
Which wallets work with it?
The same ones as stock SeedSigner, through QR-code PSBTs. Sparrow, Nunchuk, Specter Desktop and BlueWallet are common choices.
Isn’t NFC a radio?
Yes, and we’d rather say so. It is short-range (a few centimetres), it only talks to the card, and it is optional. Turn it off in Settings, or build without the PN532 and use the contact slot only.
Can I use a card I set up elsewhere?
Yes. Custos reads any SeedKeeper card, and PINs with letters and symbols work. A card set up with other tools may allow more PIN attempts than Custos’s five; the screen shows the card’s own count.
Is Custos OS open source? Where do I download it?
Custos OS is built on open-source SeedSigner and SeedSigner OS. The source and flashable images will be published here; until then, the hardware is available from xmrstreet.store.
Is this an official SeedSigner product?
No. Custos OS is an independent project built on SeedSigner’s code. SeedKeeper is an applet by Satochip. Neither project endorses Custos.
Keep the seed on the card
Built on SeedSigner and SeedSigner OS. Smartcard support ported from 3rdIteration’s SeedSigner fork. SeedKeeper by Satochip.