Self-custody based on a seed phrase and an air-gapped computer maximizes control over one's tokens. The downside is that it requires significant technical skills and effort to set it up securely and to use it.
The core idea of this method is to maintain the private keys on a computer that is air-gapped, ie. not connected to the Internet, and thus safe from remote attacks. The computer can sign the transactions but not send them to the network. The signed transactions are instead displayed on the computer screen as QR codes, and a mobile phone is used to scan and decode the QR code and send the transaction to the network. As the phone only forwards the already signed transaction and does not touch sensitive cryptographic keys, the security of this method depends entirely on the air-gapped computer.
Preparing your hardware and software
The hardware requirements are fairly low. Common options are an old laptop or a Raspberry Pi. The below description assumes that you have set up macOS or some variant of Linux.
- Install quill by downloading the appropriate version from the releases page (or building it from source code, if you prefer).
- Make sure to deactivate any and all network connections on the computer in order to air-gap it.
Generate the seed phrase and private key
On your air-gapped computer, run the following command:
% quill generateThe command will as you for a password, print the seed phrase on the screen, and generate a file identity.pem that is password-encrypted and contains the private key. Write down the seed phrase and store it in a safe place.
The command will also print your principal id and your legacy account id. These are your public addresses, you will need them to receive tokens. The legacy account id is only used for ICP tokens, such as if you send ICP tokens from a centralized exchange. The principal id is used for all tokens except for ICP. The If you want to copy the addresses to your phone, you can use the command
% quill --pem-file identity.pem public-ids | quill qr-code --file /dev/stdinand scan the resulting QR code with your phone. Paste the result to a note or text file on your phone.
Final steps
The method uses a seed phrase to encode the private key. The seed phrase serves as a backup in case the computer breaks or is otherwise inaccessible. Never show your seed phrase to anyone. Do not store your seed phrase on any electronic device other than the air-gapped computer.
Write your seed phrase on a sheet of paper or use a more durable option such as a steel wallet like the Billfodl. As you only need your seed phrase to recover the private key on your air-gapped computer, you should store it safely in a place like a bank vault or a private safe.
You of course also need to protect your air-gapped computer from physical access as well as using appropriate measures like strong passwords and disk encryption.
Additional tools
- Harpo is an open-source tool that allows to split a seed phrase in multiple shares.
- The readme file in the quill repository will guide you through the use of quill.