Generate or paste a recovery phrase, split it into Shamir backup shares, follow it down the BIP32 tree, and see the Bitcoin addresses it controls, legacy through Taproot. Runs entirely in this file, in your browser.
Generate a fresh phrase or type an existing one. The last word carries a checksum, so a phrase invented by hand will almost never validate.
Split the entropy behind the phrase into SLIP-39 shares, the Shamir standard used by Trezor. Choose how many shares to make and how many are needed to recover; any set that meets the threshold rebuilds the exact phrase above, while fewer shares reveal nothing at all.
The phrase and passphrase are stretched into a 512-bit seed, and the seed becomes the BIP32 master key at the root of the tree.
BIP85 turns one master key into any number of independent secrets: new BIP39 phrases, WIF keys, xprvs or raw bytes. The result is not used anywhere else on this page. To use a derived phrase, paste it into the phrase field above.
Pick the BIP standard your wallet uses. Each one walks a different branch of the same tree and produces a different address format.
The account extended keys can be imported into most wallets that follow this standard. Share only the public one.
Paste into Bitcoin Core (importdescriptors), Sparrow or any descriptor wallet to watch this account. Public keys only, checksum included.
This is what you hand to the person setting up the multisig wallet: your master fingerprint, the path, and the public account key. It cannot spend anything. Share it; never share the private one.
Children of the path above, derived from the extended key. Click any address or key to copy it.
| Path | Address | Public key | Private key (WIF) |
|---|
Combine the cosigner xpubs of several people or devices into one wallet that needs, say, 2 of 3 of them to spend. KeyPath builds the descriptor every wallet app needs, a setup file for hardware wallets, and the first addresses so every cosigner can confirm they match. Paste the xpubs of a wallet you already have to check its addresses or recover its descriptor.
Each cosigner makes their own recovery phrase on their own device, ideally a hardware wallet. Nobody ever sees anyone else's phrase.
Each cosigner exports their multisig public key: the BIP48 tab above shows yours as one line with the fingerprint and path. Public keys are safe to send by email or chat.
One person pastes every cosigner line below, picks how many signatures are needed, and gets the descriptor and setup file. Load the descriptor into Sparrow, Bitcoin Core or Nunchuk, or the setup file into a hardware wallet.
Every cosigner checks that the first receive address shown here is the one their own device shows for the wallet. If one device disagrees, stop: a key or the threshold is wrong.
Keep a copy of the descriptor or setup file with every phrase backup. Recovering a multisig wallet needs the threshold of phrases and the descriptor; with all the phrases but no descriptor the coins are still lost.
Creates a fresh recovery phrase (seed) for every cosigner, fills in their xpubs below and builds the wallet. Write each phrase down separately and store them apart. For the strongest setup, make each phrase on its own device instead; creating them all here puts every key on this one computer for a moment.
Paste into Sparrow (New wallet → Import), Bitcoin Core (importdescriptors) or Nunchuk. One line covers both receive and change addresses; the two separate lines are for software that wants them apart.
The text format Coldcard, Passport, Keystone and Sparrow import. Save it as multisig.txt.
Every cosigner should see this exact first address on their own device. If they do, the wallet is set up correctly.
| Index | Address |
|---|
Every term used on this page, in plain language. The same explanations appear when you click any mark above. The menu at the top right turns those marks off if you no longer need them.
Notes for the entropy panel.
Entropy values should not include the BIP39 checksum. It is added automatically.
Entropy must come from a strong source of randomness: flipping a fair coin, rolling a fair dice, noise measurements. Not phrases from books, song lyrics, your birthday or street address, or keyboard mashing. Chances are overwhelming it is not random enough.
Do not store entropy. Keeping a deck of cards in a specific shuffled order is unreliable compared to storing the phrase. Store the mnemonic generated from the entropy instead.
The Generate button uses the browser's cryptographically secure random number generator, which can generally be trusted more than your own intuition about randomness.
When dice are detected, KeyPath hashes the rolls exactly as typed (digits 1 to 6) and takes the word count from the Words selector, which is the convention of hardware wallets that accept dice. A wallet that hashes dice the same way will produce the same phrase. Choose "Raw entropy" in the Mnemonic length menu only if you specifically want the unhashed base-6 conversion, which no hardware wallet reproduces.
Card entropy assumes cards are replaced after each draw, not drawn one after another. A full deck with replacement gives 232 bits of entropy (21 words); without replacement, 225 bits.
The estimate assumes an attacker who knows your method and tries every possibility at ten billion guesses per second. It reflects the number of bits, not whether your dice were fair.
What this file does to protect you, and what only you can do. Short version: work offline, verify the hash, keep secrets off the clipboard and off camera.
One self-contained file with no external scripts, fonts or images. A Content Security Policy baked into the page blocks every outbound connection and refuses to run any script other than the two it was built with, so an injected script cannot run. Nothing you type leaves this page.
Your phrase, seed and keys are never written to disk. The only things remembered between visits are the theme and the tooltip setting. Fields are wiped when you leave the page, and private values are blurred automatically whenever a phrase is generated and again after five minutes without activity.
Copying a secret puts it on your system clipboard, which some clipboard managers and phone-to-computer sync features upload. KeyPath clears its copy from the clipboard after 60 seconds. Copy secrets only when you must, and never on a machine that syncs its clipboard.
Generate uses the browser's cryptographically secure random number generator. Cryptography comes from the audited noble and scure libraries; address derivation, Shamir sharing and Seed QR were checked against the official test vectors of each standard.
Only trust a copy of this file whose SHA-256 hash matches the one published with the release. On a Mac or Linux: shasum -a 256 keypath.html. On Windows PowerShell: Get-FileHash keypath.html. The expected value is in SHA256SUMS.txt next to the download. A page cannot vouch for itself; the hash is how you know it has not been tampered with.
For real funds: save this file, move it to a computer that is disconnected from the internet, and open it in a fresh browser profile with no extensions. Extensions can read every page, including this one. Do not print, screenshot or photograph secrets, and close the tab when you are done. Nothing here protects you from malware already on the computer.
Download the file, check its hash, and open it on a computer that is not connected to the internet. The download always comes from the latest GitHub release, saved as keypath.html.
This page is KeyPath v2.1.3. After downloading, run shasum -a 256 keypath.html (Mac/Linux) or Get-FileHash keypath.html (Windows) and compare the result with the line for keypath.html in SHA256SUMS.txt. Do not use your browser's "Save page as", which rewrites the file and changes its hash.
Scan with SeedSigner, Krux, Sparrow, Passport or any wallet that reads SeedQR. This code is your entire phrase. Anyone who photographs it owns your coins.