Signet Wallet Safety

Use Test Keys Only

The built-in wallet page is designed for Signet experiments. Use a dedicated test-only key. Do not reuse a password, recovery phrase, or a key that has ever controlled mainnet bitcoin. A short or guessable passphrase can let someone else derive the same key.

Local Signing Model

The wallet JavaScript derives an address and signs test transactions in your browser without sending the passphrase or private key to the faucet server. Opening a wallet starts periodic balance lookups with mempool.space using the public address. Sending test coins transmits signed transaction bytes to mempool.space for broadcast. That service sees the queried address, public transaction data, and your connection metadata.

The wallet page does not load advertising or analytics trackers. That does not make browser signing isolated: page scripts, browser extensions, and a compromised device can expose keys. Local parsing in the Transaction Doctor does not transmit the pasted PSBT or raw transaction to the faucet server; its external lookup is a separate choice.

Known Limits

This is a legacy, lightweight test wallet, not a replacement for a dedicated wallet or a hardware-backed workflow. An accepted API request does not guarantee propagation or confirmation. Check the transaction outputs, fee, and selected network yourself; an address encoding cannot prove which Signet or testnet it belongs to.

Safer Alternatives

For larger demos or repeat testing, use a dedicated Signet wallet in Bitcoin Core or Sparrow. Keep it separate from mainnet, label it clearly, and verify the network before requesting faucet sats.

Source Code

The wallet code is based on a lightweight browser wallet modified for Signet. You can inspect the loaded scripts under /static/signet-wallet/ and compare behavior against the linked project from the wallet page.