When your hardware wallet signs, your computer and the device are passing a Partially Signed Bitcoin Transaction (BIP 174) back and forth. Understanding it explains why the device can be trusted even when the computer cannot.
The format
A PSBT holds the unsigned transaction plus, for each input, everything a signer needs to sign it safely: the previous output being spent (so the signer can verify amounts and compute fees), the script or witness script, derivation paths for the keys involved, and any signatures collected so far. It is Base64 text or binary, and it can be carried over USB, a QR code sequence, a microSD card or copy-paste.
The roles
- Creator: the wallet software builds the unsigned transaction.
- Updater: adds UTXO data, scripts and key paths.
- Signer: a hardware wallet (or several, in multisig) checks the details on its own screen and adds its signature.
- Finalizer: assembles the signatures into the final scriptSig/witness.
- Extractor: produces the network-ready transaction and broadcasts it.
Each role can be a different device. Signers can be fully air-gapped, receiving the PSBT by QR code and returning a signed one the same way, so no cable ever connects the keys to a networked machine.
Why it matters
- Verification on the device. Because the PSBT carries the previous outputs, the signer can show you the true amounts and fee; a compromised computer cannot lie about them.
- Multisig across devices. Each co-signer adds a signature to the same file, in any order, in any place.
- Interoperability. Any wallet that speaks PSBT can coordinate any hardware that speaks PSBT.
Related
Message signing (proving you control an address without spending) uses a separate standard. Output descriptors, mentioned in lesson 6, are what wallets exchange so each party knows the full script, and they travel alongside PSBTs in multisig setups.