About
Why Sanctuary exists.
You should be able to use Bitcoin without asking anyone's permission, and without handing custody of anything — your keys, your data, your addresses — to a company or a server you don't control.
Sanctuary is a coordinator for that kind of setup. It gives you the interface of a modern wallet — multi-device, multi-user, real-time — without ever touching the keys that would make it a target. Those live on your hardware wallet, and you verify every transaction there before any signature exists.
It's designed for individuals who want a clean interface for their hardware wallet, families and small teams who need shared visibility into Bitcoin holdings without shared custody, and security-focused users who want full control over their wallet infrastructure.
Principles
No private keys
Sanctuary never sees, stores, or transmits private keys. Signing happens exclusively on your hardware wallet. If Sanctuary is compromised, the worst it can do is present a false transaction — which your device will show you before you sign.
Self-hosted
Runs on your hardware — laptop, home server, Umbrel, or a rented VPS you control. No Sanctuary-owned backend. No accounts on a third-party service. No background telemetry — diagnostic bundles are only produced when you explicitly generate one for support.
Don't trust. Verify.
The load-bearing security step is always your hardware-wallet screen, not the browser. Sanctuary builds the transaction; your device shows you what it actually is. Read it before you press confirm.
No installation required
Docker only. No elevated privileges, no system modifications, no package manager wars. The same one-command setup works on Linux, macOS, and Windows.
Standards, not lock-in
Output descriptors, PSBTs, Electrum protocol. If you outgrow Sanctuary or decide you'd rather use Sparrow or Specter, your wallets come with you — they're just descriptors pointing at xpubs.
Current status
Experimental, in active development
Sanctuary is in an early stage and under active development. Features may be incomplete, unstable, or change without notice. Start small while you get comfortable, and always verify transactions on your hardware wallet before signing.
Comfortable with those constraints? Great — testnet and signet are excellent playgrounds. Read the full disclaimer before running anything with real funds.
Acknowledgments
Sanctuary stands on a long list of open-source work:
- › Built with React, Node.js, PostgreSQL, Redis, and Docker
- › bitcoinjs-lib for Bitcoin primitives
- › The Electrum protocol and its server implementations — Fulcrum, electrs, ElectrumX
- › Ledger, Trezor, BitBox, Blockstream Jade, ColdCard, Keystone, and Foundation Devices for publishing SDKs that make hardware wallet integration possible
- › Inspired by Sparrow, Specter, and the broader Bitcoin self-custody ecosystem
Support the project
Sanctuary is free, open-source, and has no company behind it. The easiest way to help:
- › ⭐ Star the repository — it genuinely helps the project find an audience
- › 🐛 Report bugs — especially weird edge cases on uncommon hardware
- › 🧑💻 Contribute code — see CONTRIBUTING.md
Or send a donation directly:
Bitcoin (on-chain)
bc1qhxsgrh8v3awf3pyc42847z2e7zgygqe05lgekn
Lightning
[email protected]
A BOLT12 offer is also published in the README.