Encrypted Reply QR is the primary path — type a KEF encryption password on this second device and return it to SeedHand as a Reply QR encrypted to the session, so the password is never typed on the seed machine. The Transfer tools below move data in and out — Text2QR, PSBT (binary ↔ base64) and Scan2Text (decode any signer QR) — but they are not the passphrase path. Device (a Trezor xpub bridge) appears only in a browser with WebUSB. This page never sees your seed and never touches the network.
Ready — load a Session-Key QR from SeedHand.
Transfer tools
The password is wiped from this page once the QR is built. SeedHand shows the same 8-hex Integrity value for you to compare.
⚠ Plain QR — any camera that sees this screen reads your text. Prefer the Encrypted Reply QR tab when the text is a KEF Encryption password.
≤ 300 bytes → single QR (any camera). > 300 bytes → animated BBQr/UR set (larger modules, auto-advances; scan with SeedHand Wallet → Sign — not a phone camera). Move the Module size slider right for a low-resolution camera (more parts, bigger black blocks). Tap the QR to pause/resume. Hide, Clear, or Reset wipes it.
PSBT only — no seed. Re-encodes a PSBT between its binary form (KERN export, signed-3.psbt) and its base64 text form (Liana import, UTF-8). Pure re-encode — every field preserved, BIP-174 validated. No private keys leave this page.
Tap the QR to pause/resume. Auto-advances at 1800 ms (larger modules). Scan with Wallet → Sign scanner.
Binary → Liana: pick the KERN .psbt file, then Download as base64 text and import that file in Liana. Text → binary is the reverse. The file never touches the network.
Read a QR from an airgap signer or any other QR (Kern/Krux). Holds BBQr, UR, pMofN and plain text — animated or single. Decoded bytes are auto-recognized (PSBT shown as base64 text with Save as .psbt; a descriptor tr(…) is validated and left as raw text). Anything unrecognized still shows — raw text (or a lossy view for binary) with Save as .txt, plus Save as .bin when the payload is binary (e.g. a Compact SeedQR). No decryption — pure transport decode.
A QR image (screenshot/photo) is decoded locally via jsQR — you can also drop one anywhere on this card. Binary QRs (like a Compact SeedQR) must come through the camera or an image file, not paste.
PSBT → base64 shown; save as .psbt (binary) or -b64.psbt (text) or plain .txt. Descriptor/xpub/text → raw shown; save as .txt (filename: signed_{checksum}_{YYYY-MM-DD_HHMM}.txt).
Hardware-wallet I/O — local device I/O, not network (ADR 0033). The USB link to a device is not an HTTP request, so it still works on an air-gapped machine and is not governed by this page's connect-src 'none'. The seed never enters the Helper — this tab reads the device's public Features and relays public PSBTs to the device: the Trezor signs, the Helper never holds a seed or a private key.
Load SeedHand's Session-Key QR to have the Helper encrypt its reply to SeedHand. This is public data — it can encrypt to SeedHand but cannot decrypt anything, so it survives tab switches. It is cleared by Clear, Disconnect, and Reset.
Scan SeedHand's request QR (or paste its SH1/req JSON). An xpub request enables reading below; a sign request enables the Trezor sign flow in step 5. With a session key the Helper returns an encrypted reply QR for SeedHand. Without one it can only unlock the device and show its fingerprint — no xpub is displayed or exported.
Xpubs were read but not displayed or exported — no session key is loaded, so no reply QR was produced. Load a session key for a full encrypted xpub import.
Reply encrypted — compare the xpub on SeedHand's confirm gate against the Trezor screen.
Load SeedHand's sign request (in step 4), then press Sign on Trezor. Signing requires a session key so the reply stays encrypted. The Trezor's own screen is the signing authority — its 128×64 display is chunked, showing each output, amount, and the fee one field at a time, so verify details on the Trezor, not here. SeedHand is watch-only advisory: its review helps you prepare the PSBT, but the device signs. A cancel emits an encrypted error reply so SeedHand stops waiting.
Encrypted reply — scan it with SeedHand's sign scanner. Signed data only: SeedHand finalizes and broadcasts.
Requires a Chromium browser (Chrome / Edge) in a secure context — file:// qualifies, a plain-HTTP LAN IP does not. On a device with no WebUSB, use the QR tabs instead to move data.
Find your PIN digit on the Trezor's screen and click the cell here in the SAME row and column. The cells are spatial positions, not digits — do not type your PIN digits.
Positions: 7 8 9 / 4 5 6 / 1 2 3 — matches the Trezor's numeric keypad (top row = 7 8 9).
⚠ A wrong PIN counts toward your device's wipe limit. The Trezor screen shows the remaining attempts.
Enter your BIP39 passphrase — this is the device passphrase, not the KEF encryption password. It is sent straight to the device and never stored.
Hosted Helper — convenience mirror served from Cloudflare.
Code of record is the offline seedhand_helper.html on your USB / recovery kit.
Usable for real passwords: this page's embedded CSP blocks every network call
(connect-src 'none').
Canonical SHA-256 (shasum -a 256 seedhand_helper.html; this hosted page adds only this banner):
f9aa08d01783d73d9dbec36dfcc12b123e0eaff4ee25132931c14e41d96eb3a9
Helper build fingerprint declared in each Reply (a mismatch is refused; a compromised page can forge this declaration):
c905dde024885b74f85386e65fbe89ee3864d7f7d7432b15f369945f3dbdcad5