An air-gapped Bitcoin seed plate engraver. SeedTapper is a Raspberry Pi 5 appliance that scans a SeedQR (or lets you type or build one), verifies it on screen, and permanently engraves it onto a metal plate with a fiber laser — QR code on the front, human-readable words and wallet metadata on the back.
Version: v2.3b · License: MIT
SeedTapper was built for my personal use. It works — it's the tool I use — but you should treat it accordingly:
- Not verified. No third-party review, no formal test suite, and no security audit has ever been performed on this code.
- Rough around the edges. This is personal dev code: there are bugs, unpolished corners, and leftover comments from development that may be outdated or plain misleading. Trust the code, not the comments.
- Not actively maintained. It does what I built it to do. There is no roadmap and no promise of updates — issues and PRs may go unanswered.
- Verify everything yourself. Test the full workflow with a throwaway seed first. Before trusting any plate, scan it back and confirm it matches your wallet exactly. For real funds, treat this as one tool in your process — never an authority.
So why release it? Because when it comes to storing funds, open source is the only acceptable standard. The recent Coldcard hack is the latest sad reminder that "trust us" is not a security model for seed storage. Any code that touches seed material — generating it, displaying it, engraving it — should be readable, verifiable, and forkable by the people whose money depends on it. SeedTapper handles seeds, so SeedTapper is open. If it's useful to you as-is, or as a starting point for something better: it's yours. MIT licensed.
- Full run-through — start to finish, air-gapped — the complete workflow on the real unit: boot, scan a SeedQR, verify words + fingerprint on screen, and engrave the plate — no network, no PC, SD card out.
- QR scan & verify — reading a SeedQR with the camera and the verification screen: full word list, regenerated QR, and wallet fingerprint check.
- Multisig descriptor scan & engrave — scanning a wallet output descriptor (animated UR QR) alongside the seed, verifying both together, and engraving the descriptor QR onto the plate back — full multisig recovery data on metal.
- Full laser demo — the engraving process up close: guide-light preview, hold-to-fire, multi-pass deep engraving with rotating hatch angles, and the finished plate.
- Quick laser demo — a short clip of the laser doing its thing, if you just want to see it engrave.
- Scan a Standard SeedQR or CompactSeedQR with the camera — or enter the words on an on-screen keyboard, or build a QR square-by-square from a paper backup
- Verify — the seed is decoded and shown with all words, a regenerated QR, and its BIP-32 wallet fingerprint; multisig flows additionally scan the wallet descriptor (single or animated UR QR, e.g. from Sparrow)
- Engrave — safety-glasses checklist, hold-to-fire confirmation, live progress, hold-to-stop abort. Front side gets the QR; back side gets fingerprint, notes, format info, seed words, and (for multisig) the descriptor QR
Getting a seed in
- Scan SeedQR — Standard SeedQR (25×25 / 29×29) and CompactSeedQR (21×21 / 25×25), 12 or 24 words, with live camera preview, crosshair, freeze-on-detect, and a camera brightness slider
- Type the words — guided word-by-word entry with BIP-39 autocomplete suggestions and a numbered word grid (12 or 24 words)
- Build the QR by hand — section-by-section grid editor with position/alignment markers pre-locked, 21/25/29 sizes, live preview; transcribe a paper QR backup square by square
Verification before anything touches metal
- Full word list displayed with a regenerated QR in the same format that was scanned
- BIP-32 wallet fingerprint derived and shown (embit) — match it against your wallet
- Multisig: seed + wallet output descriptor verified together before engraving
Multisig support
- Scan the wallet descriptor as a single QR or animated UR (BCR-2020-005 multi-frame, as emitted by Sparrow and friends) with live frame-progress display
- Descriptor QR engraved on the plate back — your multisig recovery data lives on the plate, not in your memory
- Plate-size guards: descriptor layouts are blocked on plates too small to scan back reliably
Engraving
- Three modes: front (SeedQR), back (metadata), or both with a flip-the-plate prompt between sides
- Back side carries: wallet fingerprint, free-text notes (on-screen QWERTY keyboard), QR format info, optional seed words on/off toggle, and the descriptor QR for multisig
- Multi-pass deep engraving with rotating hatch angles (0°/45°/90°/135°) for flat-bottomed, permanent marks
- Live progress synced to actual hardware execution, elapsed timer
Laser control
- Material presets: stainless steel, aluminum, brass, titanium — tuned power/speed/frequency/passes/hatch for each
- Every parameter adjustable: power (%), speed (up to 15,000 mm/s), frequency (20–60 kHz), passes (up to 100), hatch spacing (mm)
- Guide light preview — red-pointer outline of the engrave area on the plate before firing
- Test-pattern engrave for dialing in focus and alignment
- Lens toggle: 110 mm / 220 mm field lens support
- Plate presets: 41.5 / 56 / 66 / 85 / 100 mm square plates
Safety
- Safety-glasses checklist gate before any laser operation
- Hold-to-fire (3-second hold) to start, hold-to-stop (1-second hold) to abort
- Abort checked at every row and pass, plus hardware-level kill of the galvo command queue
- Pre-flight checklist screen before every job
System
- Fully air-gapped, runs 100% from RAM, zero disk writes — SD card removable after boot
- Boots straight into the app; hardware status indicators (camera / laser / touch) on the home screen
- Air-gapped: no networking — WiFi and Bluetooth are disabled at the device-tree level (
disable-wifi/disable-btoverlays) and the OS ships no network userspace, no SSH, no wireless tools - Stateless: the entire OS runs from RAM (initramfs on a single FAT32 boot partition). The application performs zero disk writes — no logs, no temp files, no persistence. The SD card can be removed after boot
- Verify before engraving: every seed is displayed in full, with its wallet fingerprint, before the laser is ever armed
Note: this release includes a local serial/HDMI console for development and debugging. As with any signing device, physical access to the unit is trusted by design.
Parts list:
| Part | Model / spec | Notes |
|---|---|---|
| Computer | Raspberry Pi 5 | 2 GB RAM is plenty — the whole OS runs in RAM |
| Power supply | Official Raspberry Pi 27 W USB-C PD | Pi 5 is picky about supplies |
| Display | Raspberry Pi Touch Display 2 (5", 720×1280) | DSI, integrated Goodix capacitive touch |
| Camera | Raspberry Pi Camera Module 2 (IMX219, 8 MP) | Needs a Pi 5 mini-CSI camera cable |
| Laser | ComMarker B4 20W fiber laser | BJJCZ LMC galvo controller, standard 110 mm lens |
| USB cable | USB-A → USB-B to the laser | Connect before powering the Pi |
| microSD card | Any ≥ 1 GB | Boot only; removable after boot |
| Plates | Stainless steel, titanium, aluminum, or brass | Square plates 41.5–100 mm; material presets built in |
| Safety glasses | Rated for your laser's wavelength (fiber = 1064 nm) | Non-negotiable |
Assembly:
- Display → DSI port 1 (touch comes through the same cable via I²C)
- Camera → CSI port CAM0 (the boot config pins the sensor to CAM0; using CAM1 requires editing
board/pi5/boot_config.txt) - Laser → any USB-A port; power the laser on before booting the Pi (the app probes USB once at startup)
Other BJJCZ-based galvo lasers supported by galvoplotter may work but are untested — laser tuning lives in rootfs-overlay/opt/seedtapper_pil/laser/commarker_b4.json. A fiber laser is a Class 4 device — always wear appropriate laser safety glasses and never leave engraving unattended.
The OS is a Buildroot external tree. Full details and troubleshooting in BUILDROOT_GUIDE.md.
# On a Debian/Ubuntu build machine
sudo apt-get install -y build-essential git rsync bc cpio python3 python3-dev \
unzip wget curl libncurses5-dev file bzip2 gzip perl
wget https://buildroot.org/downloads/buildroot-2025.08.3.tar.gz
tar xzf buildroot-2025.08.3.tar.gz
git clone <this-repo> seedtapper-os-pi5
cd seedtapper-os-pi5
./setup-buildroot.sh ../buildroot-2025.08.3 # installs the libcamera package overrides
cd ../buildroot-2025.08.3
make BR2_EXTERNAL=../seedtapper-os-pi5 seedtapper_pi5_defconfig
make # first build takes 2-3 hoursFlash output/images/seedtapper-os-pi5.img to a microSD card with Raspberry Pi Imager or dd.
seedtapper-os-pi5/
├── board/pi5/ # Boot config, cmdline, kernel config, image scripts
├── configs/ # Buildroot defconfig
├── package/ # Buildroot packages (libpisp, embit, galvoplotter)
├── package-overrides/ # RPi libcamera fork overrides (copied into buildroot)
├── rootfs-overlay/
│ ├── etc/ # inittab, fstab, init scripts
│ └── opt/seedtapper_pil/ # The application
│ ├── main.py # Entry point, touch event loop
│ ├── config.py # Display, materials, plate presets
│ ├── layout.py # Back-side layout engine
│ ├── camera/ # rpicam-vid MJPEG streaming
│ ├── laser/ # galvoplotter wrapper, batched engraving engine
│ ├── qr/ # SeedQR encode/decode, zbar ctypes scanner, fingerprint
│ ├── ur/ # Minimal BC-UR decoder (animated QR descriptors)
│ └── ui/ # PIL-rendered framebuffer screens
└── setup-buildroot.sh # One-shot environment setup
Notable implementation details:
- The UI is pure PIL rendered straight to the framebuffer — no X11, no Wayland, no GPU stack
- QR scanning uses a ctypes wrapper around libzbar with binary mode enabled (
ZBAR_CFG_BINARY) — without it, zbar corrupts CompactSeedQR binary payloads by treating them as text - Engraving is batched and synced to real hardware progress, with abort checks at every row and pass
- BUILDROOT_GUIDE.md — build system, package overrides, deployment, common errors
- PLATE_SIZES.md — supported plate sizes and layout rules
- NOTICE — third-party attributions and licenses
- SeedSigner — the SeedQR format specification and the inspiration for this project
- Blockchain Commons — the UR (BCR-2020-005) and Bytewords (BCR-2020-012) specifications
- embit, galvoplotter, zbar, Buildroot, and the Raspberry Pi libcamera stack
The mission is to liberate Bitcoin infrastructure from corporate dependencies through energy independence, sovereign communications, and experimental technology.
If you find SeedTapper useful and would like to support continued research and development, please consider supporting:
Every sat helps. ⚡
This software drives a laser and handles Bitcoin seed material. It is provided as-is, without warranty of any kind (see LICENSE). Verify every plate against your wallet before relying on it, and test your full backup/restore flow with a throwaway seed first.