Partially Signed Bitcoin Transactions let different devices or people contribute signatures without passing private keys through an online coordinator. The final-signing step is where a human should confirm what will be spent and where it will go. A valid signature proves that a key authorized a transaction; it does not prove the recipient is correct. The checklist below is designed for a multisignature or air-gapped workflow.
Freeze the policy version
Write down the wallet policy, quorum, cosigner fingerprints, network, and descriptor or derivation range used to create the PSBT. A policy change can make an otherwise valid signature unusable or route funds to an unexpected script. Compare fingerprints and device labels, not just names such as “Ledger one.” Keep the original PSBT immutable and calculate a working copy hash so a coordinator can detect an altered file.
Inspect every input
For each input, verify the previous transaction, output index, amount, script type, confirmation state, and whether the wallet identifies it as change. A signer should know which UTXO it is authorizing. Missing witness or non-witness data can make a hardware wallet refuse to sign or display incomplete information. Watch for an input that belongs to a different account or a frozen coin that was not intended for this payment.
Inspect every output and fee
Read the recipient script or address on a trusted device, then compare amount and network. Identify change outputs using the wallet policy, not by assuming the second output is change. Calculate the fee as total inputs minus total outputs and compare it with the expected fee rate and virtual size. A large unexplained fee is a stop signal. The PSBT should not contain a hidden output added by a coordinator.
Compare the signing device display
Hardware devices may show a human-readable address, amount, and fee; an offline software signer may show raw scripts. Use more than one independent check for a high-value transfer. If the device shows a different address or amount, reject the PSBT and preserve both files for investigation. Never approve a blind signature merely because the coordinator says it is a routine update.
Track partial signatures
Record which fingerprint signed, the signature count for each input, and the policy threshold. A signature from an unexpected fingerprint is a governance incident even if the transaction remains valid. Do not delete the unsigned original after a signer exports a new PSBT; keep versions numbered and write a short change note. A failed finalization may indicate missing key-path data, incompatible script information, or a policy mismatch.
Finalize offline and verify
Finalize only after all required signatures pass validation. Decode the final transaction offline or through a trusted tool and compare its txid, inputs, outputs, and fee with the approved review. If finalization changes the txid, that is expected when witness data is added, but the economic fields must remain identical. Keep the final hex and review record before broadcasting.
Broadcast and close the record
Use an authorized node or documented service to broadcast, then record acceptance, txid, first-seen time, and confirmation policy. A broadcast response is not settlement. If the transaction is replaced or remains unconfirmed, follow the wallet’s documented RBF policy rather than creating an improvised second payment. Shred temporary private material and keep only the public audit packet.
Worked example: two cosigners
A two-of-three wallet can receive a PSBT with two signatures while the third device remains offline. The coordinator should show the original unsigned file hash, each signer fingerprint, and a final transaction summary. Cosigner one checks input ownership and change; cosigner two checks recipient, fee, and network. If either sees a different output, stop and compare the PSBT maps byte by byte. After finalization, verify that witness data changed only the txid and not the economic fields. The policy record should name the missing cosigner and explain why the threshold is satisfied.
Frequently asked question
Does a valid PSBT signature guarantee a safe payment?
No. It confirms authorization under a policy. People still must verify the recipient, amount, fee, network, and change. The signing record should show those checks independently of the cryptographic validity result.