Bitcoin Watch-Only Wallet Comparison

Watch-Only Wallets Compared

A watch-only wallet monitors Bitcoin balances, generates receiving addresses, and constructs unsigned transactions without ever touching private keys. By importing only an extended public key (xpub, ypub, or zpub), you get full visibility into your holdings while keeping signing authority on a separate, air-gapped device. This separation is the foundation of any serious cold storage setup.

Five wallets dominate the watch-only space: BlueWallet, Sentinel, Sparrow Wallet, Blockstream Green, and Electrum. They differ in platform support, privacy features, and how deeply they integrate with hardware wallets through the PSBT standard. The table below provides a quick comparison.

For help choosing a signing device to pair with your watch-only setup, see the Bitcoin hardware wallet comparison.

Why Separate Watching from Signing

The core security model of a watch-only wallet rests on a simple principle: the device that sees your balances should never hold the keys that spend them. A compromised phone or laptop running a watch-only wallet exposes your transaction history and balances (a privacy loss), but an attacker cannot move funds because no private key material exists on that device.

This separation renders entire categories of attacks ineffective. Keyloggers, clipboard hijackers, remote access trojans, and malicious browser extensions can all be present on the watch-only device without putting funds at risk. The signing device (typically a hardware wallet or air-gapped computer) stays isolated from network-based threats. For a deeper look at these attack vectors, see our research on hardware wallet attack vectors.

The tradeoff is workflow complexity. Spending requires moving unsigned transactions to the signing device, verifying details on its screen, signing, and returning the signed transaction to the online wallet for broadcast. The PSBT standard (BIP 174) formalizes this round-trip, and every wallet on this list supports it to varying degrees.

UTXO Management and Coin Control

Bitcoin operates on the UTXO model: each transaction creates discrete outputs that must be spent in full. Effective coin control in a watch-only wallet lets you choose which UTXOs to include in a transaction, freeze others to prevent accidental spending, and label outputs for tracking purposes. This directly impacts both privacy and fee efficiency.

Sparrow stands out with its visual UTXO provenance graph, which maps transaction flows across addresses and helps identify connections between outputs. This is particularly valuable for privacy-conscious users managing UTXO consolidation or evaluating the effectiveness of CoinJoin rounds. For strategies on managing your UTXO set, see our UTXO management guide.

Privacy Features

A watch-only wallet that leaks your xpub to a third-party server effectively deanonymizes your entire wallet. The server learns every address you have ever used, your current balance, and all future transactions. Connecting to your own node eliminates this leak entirely.

Sparrow and Blockstream Green offer the most complete privacy setups out of the box: both include built-in Tor without requiring external software. BlueWallet removed its internal Tor proxy in December 2023, so Android users must install Orbot separately, and iOS users have limited options. For a broader look at Bitcoin privacy techniques, see our research on the Bitcoin privacy landscape.

PSBT Workflow and Hardware Wallet Integration

The Partially Signed Bitcoin Transaction (PSBT) standard defines how unsigned transactions move between a watch-only wallet and a signing device. The workflow follows four steps:

1. The watch-only wallet constructs a transaction: selecting UTXOs, setting destination addresses, amounts, and fees. It outputs an unsigned PSBT containing all the metadata the signing device needs.
2. The unsigned PSBT transfers to the signing device via SD card (Coldcard, Passport), animated QR codes in UR format (SeedSigner, Jade, Keystone), USB (Trezor, Ledger, BitBox02), or NFC.
3. The signing device displays the transaction details for verification, then signs the PSBT with the stored private keys. The signed PSBT exports back through the same transport channel.
4. The watch-only wallet imports the signed PSBT, finalizes the transaction, and broadcasts it to the Bitcoin network.

Sparrow Wallet was architected around this workflow from the start. It supports animated QR codes (UR format), file-based transfer, and direct USB connections with Coldcard, Trezor, Ledger, BitBox02, Jade, Keystone, Passport, and SeedSigner. Electrum provides equivalent PSBT functionality through file and QR export, though its QR support is less polished than Sparrow's animated UR implementation. BlueWallet handles PSBT creation and import on mobile, making it the strongest option for constructing transactions on the go. For a step-by-step guide, see the PSBT workflow guide.

A Note on Sentinel

Sentinel was developed by the Samourai Wallet team as a dedicated watch-only companion app. Following the arrest of Samourai's founders in April 2024 and the FBI seizure of the samouraiwallet.com domain, Sentinel's backend infrastructure went offline. The domain was subsequently hijacked by scammers running a phishing site. No releases have been made since the shutdown.

Sentinel's fate illustrates a critical point: a watch-only wallet that depends on a centralized backend inherits the risk of that backend's operator. Users who relied on Samourai's servers (rather than running their own Dojo node) sent their xpubs to infrastructure that is now compromised. Former Sentinel users should migrate to Sparrow, Electrum, or BlueWallet and connect to their own node.

xpub Privacy Risks

An xpub (or ypub/zpub) can derive every current and future address for a wallet. Anyone who obtains your xpub can reconstruct your complete transaction history, current balance, and all future activity. This makes xpubs sensitive data that should be treated with the same caution as passwords.

The primary risk arises when a watch-only wallet sends the xpub to a third-party Electrum server for address lookups. That server operator can then link all of your addresses together, defeating the unlinkability that Bitcoin's address model is designed to provide. Running your own server (EPS, ElectrumX, electrs, or Fulcrum) eliminates this leak. Sparrow and Electrum also support connecting directly to Bitcoin Core via RPC, which provides the highest level of trust verification.

To inspect your xpub's derivation paths and verify address generation, use the xpub viewer tool.

How to Choose a Watch-Only Wallet

The right choice depends on your platform, privacy requirements, and how you plan to interact with your signing device.

• Desktop users who want the most complete feature set: Sparrow Wallet. Best-in-class UTXO visualization, built-in Tor, native PSBT workflow, and direct Bitcoin Core connection. The standard recommendation for cold storage management.
• Users who need mobile monitoring: BlueWallet on iOS or Android. Full PSBT support lets you construct unsigned transactions from your phone and transfer them to a hardware wallet for signing.
• Users who want cross-platform coverage with Liquid support: Blockstream Green. Available on iOS, Android, and desktop with native Liquid Network integration for confidential transactions.
• Long-time Bitcoin users comfortable with a proven codebase: Electrum. The oldest actively maintained Bitcoin wallet (since 2011), with full coin control, PSBT support, and a mature Electrum server ecosystem.
• Multisig cold storage setups: Sparrow or Electrum for full multisig watch-only with arbitrary quorum configurations. Blockstream Green offers a simpler 2-of-2 model with Blockstream as co-signer.

Watch-only wallets pair naturally with Bitcoin Layer 2 solutions for day-to-day spending. You can hold your long-term savings in cold storage monitored by Sparrow or Electrum while using a Lightning or Spark wallet for faster, lower-cost transactions.

Frequently Asked Questions

Can someone steal my Bitcoin with just an xpub?

No. An xpub contains only public keys, which cannot be used to sign transactions or move funds. However, an xpub reveals your complete transaction history, current balance, and all future addresses. This is a serious privacy risk, not a direct theft risk. Treat your xpub as confidential information and never share it publicly.

What is the difference between xpub, ypub, and zpub?

These prefixes correspond to different address types. An xpub derives Legacy (P2PKH) addresses starting with "1". A ypub derives Nested SegWit (P2SH-P2WPKH) addresses starting with "3". A zpub derives Native SegWit (P2WPKH) bech32 addresses starting with "bc1q". All three function identically for watch-only purposes: they allow a wallet to generate addresses and track balances without private keys.

Do I need to run my own node for a watch-only wallet to be private?

For maximum privacy, yes. When your watch-only wallet connects to a third-party Electrum server, that server sees every address you query, effectively learning your entire wallet history. Running your own server (ElectrumX, electrs, Fulcrum, or Electrum Personal Server) ensures that address lookups stay local. At minimum, use Tor to prevent the server operator from correlating your queries with your IP address.

Can I use a watch-only wallet with a multisig setup?

Yes. Sparrow and Electrum both support multisig watch-only wallets with arbitrary quorum configurations (2-of-3, 3-of-5, etc.). You import the xpubs from all cosigners to create the watch-only wallet, then distribute unsigned PSBTs to each signer for their portion of the signature set. Blockstream Green offers a simpler 2-of-2 model where Blockstream acts as a co-signer with time-locked recovery.

Is Sentinel still safe to use?

No. Sentinel's backend infrastructure has been offline since the Samourai Wallet seizure in April 2024, and the samouraiwallet.com domain was hijacked by scammers. Even if you have the app installed, it cannot fetch balance data from its original servers. Users should migrate to Sparrow, Electrum, or BlueWallet immediately.

How does a PSBT cold storage workflow protect against malware?

The PSBT workflow ensures that private keys never exist on an internet-connected device. Even if the watch-only wallet is fully compromised, malware can only observe transactions: it cannot forge signatures. The signing device (hardware wallet or air-gapped computer) verifies transaction details on its own screen before signing, so a compromised watch-only wallet cannot trick you into signing a different transaction than the one you intended. For more on this workflow, see the PSBT multisig workflow guide.

What happens if my watch-only wallet device is lost or stolen?

Losing the device running your watch-only wallet does not put funds at risk, because no private keys are stored on it. An attacker who gains access to the device can see your balances and transaction history, but cannot spend anything. You can restore the watch-only wallet on a new device by re-importing your xpub. Your seed phrase and signing device remain the only way to authorize transactions.

This tool is for informational purposes only and does not constitute financial advice. Data is approximate and based on publicly available information as of July 2026. Software features and availability change frequently: always verify current capabilities before making security decisions.