Everything else

Reached from More on the wallet screen.

Backup

Seedless by default. A seedless backup carries your network, your label and your registered quorum descriptors, and no key. A backup with the seed is a second copy of the money under one passphrase; choosing it changes the button and says what it means first.

A seedless restore gives you descriptors, not a working wallet: with no seed, nothing can be derived or signed. The descriptors let you check whether an address belongs to your quorum, and re-register the quorum after restoring the seed from your mnemonic.

Restoring shows what the file claims before asking for a passphrase, and says all of it is unverified at that point.

Proving an address, and checking a proof

Proving signs a message with one of your addresses to show it is yours.

• Segwit, nested segwit and taproot produce a BIP-322 signature starting with smp, the variant prefix BIP-322 1.0.0 requires. An older verifier may want it removed first.
• A legacy address produces a signmessage signature, a different scheme over different bytes. The screen says so where you pick the type.
• Bitcoin Core checks only signmessage: its BIP-322 pull request (bitcoin/bitcoin#24058) was closed without being merged.

The address, message and signature leave together; a signature without its address proves nothing.

Read the message before you sign it. If somebody else chose the string and it means something elsewhere, you have authorised it. The device shows it in full and refuses one with characters that could display differently from what would be signed.

Checking takes an address, a message and a signature, pasted or scanned, and says whether they go together. It needs no key or open wallet, so it is on the wallet picker too. Scanning an armoured block (the -----BEGIN BITCOIN SIGNED MESSAGE----- format Electrum writes) fills all three fields.

A pass means whoever made the signature held the key for that address and agreed to exactly those bytes. It does not say when, that the address holds anything, or that the person who handed it to you made it. A failure is usually the message: a trailing space, a missing line break, or a smart quote where a straight one was signed. Compare it character for character.

What is not supported. The BIP-322 full variant, which a multisig quorum would produce. It is refused by name rather than approximated.

Dark or light

Under More. Dark is the default. The choice is stored beside your wallets with the device name, so the lock screen can use it before a passphrase. Like the device name it is unverified and decides nothing.

Locking itself

After ten minutes untouched, the device closes the wallet and forgets the seed. A countdown appears in the header a minute before; any touch clears it.

You lose the screen you were on: rescan a loaded transaction and unlock again. No key and nothing saved with the wallet is lost. A registration, removal or cosigner name held for this session only is, as the screen that made it said, and so are labels loaded from a file, which are never saved.

It protects against leaving the device, nothing else: someone at it just touches the screen, and someone who takes it unlocked has whatever was in memory. The window is not adjustable.

Labels

A BIP-329 file carries what no seed recreates: which output was the rent, which must never be spent. Its notes appear beside matching addresses in the address list and under matching outputs on the signing review.

They are only notes. The device decides change by re-deriving from your seed, never from a label, so a label claiming an address is yours changes nothing it says. Labels are held for the session, not sealed into the wallet: read the file again after a reboot.

Checking your backup

Before hiding the words, the device asks for three back, by position. Read them off your paper; if you have to remember one, you do not have a backup yet. A wrong answer returns you to the list and says so, with nothing lost or confirmed: write the words out again, check them against the screen, and retry.

The device picks the positions, so writing only the first three does not get you past it. It catches carelessness, but not a wrong word at a position it did not ask about, and it cannot tell paper from a photograph.

Changing the passphrase

Under Name or erase this wallet: the current passphrase, then the new one twice. The on-screen keyboard fills the outlined field, whichever you tapped last.

This changes what unlocks the file, not what derives your addresses. Every address, xpub and descriptor stays the same, and your mnemonic still recovers them. A BIP-39 passphrase is different: it feeds the seed, and nothing on this device can change it.

Write the new one down first: nothing on this device can recover it, and your mnemonic restores the seed but not the quorums registered here or your cosigner names. A wrong old passphrase changes nothing and does not count toward the ten attempts that erase the wallet.

Erasing a wallet

Type the wallet's name on the on-screen keyboard; a second tap is not enough. What you type shows in place of the keyboard's row of dots, to compare with the name in the header. Capitals and extra spaces are ignored.

Renaming requires the passphrase, because the name is sealed in the ciphertext. A wrong passphrase there costs nothing and does not count toward the attempts that erase the wallet.

Child seeds

BIP-85 derives further wallets from this one, on the second screen that deliberately shows key material. The path is shown with the words: a child written down without its path cannot be rederived.

A child is not independent of its parent. Anyone with this device's mnemonic can derive it and every other child. For a genuinely separate wallet, roll dice. Nothing is written to the device; to keep a child here, import it like any other mnemonic.