₿ Winnow

Early access · open source

A Bitcoin wallet for your iPhone.

Send and receive bitcoin, keep track of payments, and save with other people.

Download on the App Store

Pre-release builds ship through TestFlight.

Your phone connects directly to Bitcoin.

Two ways to protect your bitcoin

Protect your key.

Stolen hardware-wallet key

Stolen hardware-wallet keyAn attacker gets the hardware wallet’s key and tries to spend. The iPhone has not approved, so the payment stays blocked and nothing is sent to Bitcoin. iPhoneHardware walletKey stolen! Waiting Blocked
On BitcoinNo payment sent

Both keys are needed.The hardware-wallet key is stolen.The phone hasn’t approved.Blocked. Nothing sent.

A payment you approve

A payment you approveFor a separate, normal payment, you check the address, amount, and fee on your iPhone. The iPhone and hardware wallet both sign. Bitcoin sees one ordinary signature, without revealing the two devices. iPhoneHardware wallet Waiting Approved
On BitcoinOne ordinary signature

A new payment. Both keys needed.You check and approve on your phone.The hardware wallet signs too.Two devices. One signature.

About two-device signing →

Share control.

One person is away

One person is awayYou and Alex approve while a third person is away. Any two of the three keys can approve. Spending reveals three public keys, the two-approval rule, and two signatures, but no names. YouAlexAway Waiting Approved
On Bitcoin
Key 1Key 2Key 3
2 required · 2 signatures

Three people. Two approvals needed.You approve.Alex approves. One person stays away.Two approve. The payment can go.

Returning loan collateral

Returning loan collateralA possible future lending arrangement. After repayment, you and the lender approve returning your bitcoin. The independent key agent does not need to participate. The lender and key agent could also move the bitcoin together. YouLenderKey agent Waiting Returned
On Bitcoin
Key 1Key 2Key 3
2 required · 2 signatures

The loan has been repaid.You approve the return.The lender approves too.Your bitcoin is returned.

Possible future use. A lender could provide stablecoins against this bitcoin. We have no lending partner yet. The lender and key agent could also move the funds together. About lending partners

About shared signing →

Protect your key in a shared wallet

iPhone + hardware wallet↓Your approval
Partner’s key↓Partner’s approval
Third person’s key↓Their approval

Any two columns can approve. Your column needs both your devices. The other two people can also approve together without you.

On Bitcoin, your two devices appear as one key and one signature within the shared wallet’s three-key rule.

How the two signing methods fit together

Set up your wallet

Create a wallet and write down your recovery words. If you stop partway through, you can finish the backup when you return.

Winnow: Set up your wallet.

Save a backup file too. Winnow needs it to find your past payments when you restore the wallet.

How we test: Set up your wallet

  1. Create a wallet while it connects to the network.
  2. Leave the backup unfinished, reopen the app, and finish it. Check that viewing the recovery words requires unlocking.

Test code: test01OnboardingCreateWallet, test09BackupResumeAndReveal . View test results.

The ordered tests use the app on a private Bitcoin test network. Screenshots show test funds. Open a test run to see which version was checked, what passed, and what failed.

Read the logs and screenshots · What still needs testing

Receive bitcoin

Label who an address is for, or what the payment is for, before sharing it. You can skip. Matching payments carry the local note in your wallet.

Winnow: Receive bitcoin.

An address label does not verify the sender or create a payment destination. Labels stay on this device and are not included in wallet backups.

How we test: Receive bitcoin

  1. Save a receive address label, request a new address and skip its label. Reopen the app and confirm that a payment to the old address still carries its note.
  2. Confirm a payment on the test network and check that it appears in the wallet.
  3. Watch a new payment arrive on Receive before it is confirmed, then check that its status updates after confirmation.

Test code: test02ReceiveAndFunding, test14IncomingPaymentBeforeConfirmation . View test results.

The ordered tests use the app on a private Bitcoin test network. Screenshots show test funds. Open a test run to see which version was checked, what passed, and what failed.

Read the logs and screenshots · What still needs testing

Send bitcoin

Choose an account, recipient, and amount. Check the address, fee, and total before sending or continuing to the account’s approvals.

Winnow: Send bitcoin.

How we test: Send bitcoin

  1. Enter an address and amount on the simple send screen.
  2. Edit a reviewed payment, then verify the new amount, full address, fee, and total before sending.
  3. Check that Bitcoin Core received the payment, open its details, and wait for the app to show it as confirmed.

Test code: test03Send . View test results.

The ordered tests use the app on a private Bitcoin test network. Screenshots show test funds. Open a test run to see which version was checked, what passed, and what failed.

Read the logs and screenshots · What still needs testing

Pay someone again

Name someone you’ve paid, or save their payment card. Next time, choose them in Send.

Winnow: Pay someone again.

How we test: Pay someone again

  1. Send to a new address, open that payment in Wallet, save the recipient, and rename them.
  2. Reopen the app and check the name on the payment. Remove and re-add the saved recipient without losing the label.
  3. Choose a saved address in Send and check the address-reuse notice. Pay a saved card, then check that the next payment uses a fresh address.

Test code: test10SaveRecipientFromPayment . View test results.

The ordered tests use the app on a private Bitcoin test network. Screenshots show test funds. Open a test run to see which version was checked, what passed, and what failed.

Read the logs and screenshots · What still needs testing

Name who paid you

Give a received payment a local name without attaching an address. Add a payment card or explicitly choose a destination before sending.

Winnow: Name who paid you.

Funding addresses are unverified destinations, not proof of who paid you. Winnow never selects one automatically. Sending to an address again can reveal address reuse.

How we test: Name who paid you

  1. Save a name-only label on a received payment, relaunch and check that the label persists.
  2. Verify that a name-only person cannot send until a destination is attached.
  3. Explicitly select a locally reconstructed funding address and continue through the normal amount and confirmation flow.

Test code: test17SaveSenderFromReceivedPayment . View test results.

The ordered tests use the app on a private Bitcoin test network. Screenshots show test funds. Open a test run to see which version was checked, what passed, and what failed.

Read the logs and screenshots · What still needs testing

Choose a funding destination

If you choose to consult an explorer, review what is disclosed before asking. Then explicitly select any returned destination.

Winnow: Choose a funding destination.

The explorer receives the transaction ID and your connection's IP address. Returned addresses do not identify people.

How we test: Choose a funding destination

  1. Open the funding-address lookup and review the transaction ID and what the explorer learns before giving consent.
  2. Choose a returned address explicitly, even if the explorer returns only one.
  3. Save the destination with its unverified origin visible.

Test code: test18InferSenderWithExplorer . View test results.

The ordered tests use the app on a private Bitcoin test network. Screenshots show test funds. Open a test run to see which version was checked, what passed, and what failed.

Read the logs and screenshots · What still needs testing

Save with other people

Choose who shares the wallet and how many approvals a payment needs. With two approvals out of three, one person can be away and the other two can still pay.

Winnow: Save with other people.

For shared control, each person must keep their own key. If you choose just one required approval, any one of them can spend.

Read the guide

How we test: Save with other people

  1. Create shared savings from the wallet screen and choose who can approve payments.
  2. Back up the funded account from its detail screen, then open Send, choose a saved recipient, and check the account, amount, and fee.
  3. Continue straight to approvals without copying the request into another screen. Complete two approvals without the third person.

Test code: test12SharedSavingsCreateAndAsk, test07ApproveRequest . View test results.

The ordered tests use the app on a private Bitcoin test network. Screenshots show test funds. Open a test run to see which version was checked, what passed, and what failed.

Read the logs and screenshots · What still needs testing

Back up and restore

Save a backup file with your payment history and shared accounts. Keep your recovery words too. You need both to restore the wallet and sign again.

Keep both your recovery words and your backup file. The words alone won’t restore your payment history.

How we test: Back up and restore

  1. Export a backup with private keys and one without them.
  2. Restore a wallet that has funds and check that the backup is valid and the funds are found.

Test code: test06ImportBundleVerification, test08ExportBundle . View test results.

The ordered tests use the app on a private Bitcoin test network. Screenshots show test funds. Open a test run to see which version was checked, what passed, and what failed.

Read the logs and screenshots · What still needs testing

One screen, or the full set of controls

Beginner mode is one screen with no settings. Advanced mode, one tap from its corner, is the three-tab interface: fee controls, network connections, signing tools and every setting.

Winnow: One screen, or the full set of controls.

How we test: One screen, or the full set of controls

  1. Check that beginner mode is one screen: balance and status, Receive and Send, activity, one way into shared savings and the backup, with no tabs and nothing technical.
  2. Turn Advanced mode on and off, checking that the tabs, fee controls, vault tools and Settings appear and disappear, and that the switch is not a setting.

Test code: test11OneScreenHidesAdvancedControls . View test results.

The ordered tests use the app on a private Bitcoin test network. Screenshots show test funds. Open a test run to see which version was checked, what passed, and what failed.

Read the logs and screenshots · What still needs testing

How we test Winnow

Advanced features · What’s next