Skip to content
Plebum Dominium

11 · Plebum Dominium

Hide the wallet map

Encrypt the descriptor. The passphrase is not a seed and not a plate.

Download PDF

You are here after the descriptor exists and before it sits in a drawer in plain text. The map watches the money. It cannot spend. Anyone who can read it can see the balance. Encrypt it. The passphrase that opens the file is not a seed and not a plate.

What you need

  • The descriptor file from the 2-of-3, on the data USB. Call it map.txt only while you are working.
  • A passphrase you can remember and also write down. It is not one of the 24-word lists. It is not the decoy passphrase.
  • Tails, networking off. Do not do this on the everyday computer.

Do this

  1. 01 · Boot Tails. Networking Disabled. Copy map.txt to the Desktop. Do not open it on a phone.
  2. 02 · Open Terminal. Run the line below. It asks for a passphrase twice. If the two entries differ, it will not make the file.
  3. 03 · You now have map.txt.gpg. Copy that file to two USBs. Delete map.txt from the Desktop and from the USB. Empty the trash.
  4. 04 · Write the passphrase on paper. Keep that paper away from the plates and away from the USBs.
  5. 05 · On a later offline boot, decrypt once. Confirm the map opens and the first address matches what you wrote down. Encrypt it again if you made a plain copy. Delete the plain copy.
$ gpg --symmetric --cipher-algo AES256 map.txt

Stop if

  • You are about to write the xpubs on paper “just in case.” Do not.
  • You are about to invent a letter code or a homemade cipher. Use the command above.
  • The passphrase is one of the seeds, or it is stamped on a plate. Start over with a different passphrase.

If this passphrase is lost, the coins are not gone. Two plates can rebuild the map. The path is m/48'/0'/0'/2'. Write that path on the inheritance sheet. It is not a secret.

Next. If I am gone. That page is for a spouse. It does not contain words.