What Sanctuary does.

Single-sig & multisig

Sanctuary coordinates both single-signature and multi-signature wallets. Import an output descriptor, connect devices directly, or scan xpub QR codes — then build and sign transactions across every co-signer from the same interface.

• › Output-descriptor import (e.g. wpkh([fingerprint/84'/0'/0']xpub.../0/*))
• › JSON import from Sparrow, Specter, and other compatible wallets
• › Multi-wallet, multi-network (mainnet, testnet, signet) with per-network Electrum connections
• › Real-time sync via Electrum subscriptions — balances and new transactions appear without refresh

PSBT workflow

Every transaction Sanctuary builds is a Partially Signed Bitcoin Transaction — the BIP-174 standard format hardware wallets and co-signers speak natively. PSBTs are portable: you can sign one on a device physically disconnected from the internet, then import the signed result back via file or QR code.

• › Fee-rate control via an interactive mempool visualizer (click a block to adopt that fee rate)
• › Sub-sat/vB precision — fee rates support decimals as low as 0.1 sat/vB
• › UTXO selection for privacy-conscious coin control
• › Transaction drafts — save unsigned PSBTs, lock selected UTXOs, and coordinate shared signing flows
• › Verify every output on your hardware wallet before broadcasting

RBF & CPFP

If a transaction stalls in the mempool, you don't need to wait. Replace-By-Fee creates a replacement with a higher fee; Child-Pays-For-Parent attaches a high-fee child that pulls the parent through.

Role-based access

Share a wallet's visibility without sharing its custody. Sanctuary defines three roles per wallet, and groups let you apply the same permissions to a whole family or team.

Admins can disable public registration so only invited users get accounts. Groups make it easy to give everyone the same access at once.

Air-gapped signing

For devices that never connect over USB — ColdCard, ColdCard Q, Keystone, Passport — Sanctuary speaks both QR codes and files.

Tor & private Electrum

By default Sanctuary uses public Electrum servers, which means someone on the other end sees which addresses you query. Swap that out for your own server — or route everything through Tor — and the network profile of your wallet usage disappears.

$ ./start.sh --with-tor

Point Sanctuary at Fulcrum, electrs, or ElectrumX over SSL or TCP via ELECTRUM_HOST in your .env.

2FA & audit logging

Opt-in TOTP-based two-factor authentication, backed by 10 single-use backup codes. Disabling 2FA requires both your password and a valid 2FA code — intentionally harder than enabling it.

Sanctuary also maintains an audit log of security-relevant events — logins, permission changes, wallet shares, gateway/mobile API activity — visible to administrators.

Notifications

Wallet activity can reach you on your terms:

• › Telegram — your own bot; per-wallet toggles for sent, received, consolidation events
• › In-browser sounds — 20 presets, configurable per event (receive, send, confirmation)
• › Push — via the optional mobile API gateway (iOS via APNs, Android via FCM)
• › Confirmation milestones — notifications at 1, 3, and 6 confirmations

Backup & restore

Export every piece of state Sanctuary holds — wallets, devices, users, 2FA settings, labels, groups, sharing permissions, audit logs — as a single JSON file. Restore onto the same instance to get everything back; restore onto a different instance and Sanctuary cleanly handles the encryption-boundary case.

Migrating servers? Copy ENCRYPTION_KEY and ENCRYPTION_SALT to the new instance before restoring — encrypted data comes along for the ride.

Hardware wallet support

Sanctuary talks to the major hardware wallet vendors over USB, HID, Serial, or — for air-gapped devices — QR codes and files.

Browser support: WebUSB / WebHID / WebSerial work in Chrome, Edge, and Brave. Firefox and Safari don't implement these APIs, so they're limited to air-gapped (QR/file) flows.

Untested: BitBox02 and Blockstream Jade integrations are implemented against their vendor SDKs but haven't yet been verified end-to-end on physical hardware. If you have one and try it, please report results on Codeberg — success or failure both help.

Built so far

46 tagged releases in 4.5 months. Day-one watch-only, hardware-signed throughout. Larger dots are major milestones; hover or focus the smaller dots to peek at minor releases. Tap any point to expand its detail below.