Sparrow Wallet

What it is

Sparrow describes itself as "a Bitcoin wallet for those who value financial self sovereignty," with an emphasis on "security, privacy and usability" (sparrowwallet.com). It runs on macOS, Windows and Linux, with a separate Sparrow Server build for headless machines (downloads). It is licensed under Apache 2 (GitHub).

At a glance

It is developed by Craig Raw, who publishes the releases on GitHub and signs every release manifest with his PGP key (releases, Keybase).

Current security status

OK: Recommended desktop coordinator. Minimum version: 2.5.5+. Checked 2026-10-16 on our security watch.

• 2.5.4 and 2.5.5 shipped review-driven hardening fixes. Verify the signed manifest before installing.
• Source: Sparrow releases
• Source: Decrypt

Key features

• PSBT: "standards based including full PSBT support," so unsigned transactions can move to a signer by USB, QR code or microSD file (sparrowwallet.com).
• Multisig: "full support for single sig and multisig wallets on common script types" (sparrowwallet.com). See our multisig guide.
• Coin control: "full coin and fee control with comprehensive coin selection," plus labels on every transaction, input and output (sparrowwallet.com).
• Your own node: connect to public servers, to Bitcoin Core directly, or to a private Electrum server (sparrowwallet.com, Connect to Bitcoin Core). Sparrow's own docs note Bitcoin Core over Tor is "fairly slow" and suggest a private Electrum server for remote use.
• Built-in Tor, a transaction editor that doubles as a blockchain explorer, PayNym (BIP47) payments, and testnet, regtest and signet support (sparrowwallet.com).
• Silent Payments receiving wallets were added in 2.5.0 (release notes).

Whirlpool is gone

Sparrow once included a Whirlpool CoinJoin client that relied on Samourai's servers. After US authorities charged Samourai's founders and seized its servers and domains in April 2024 (BleepingComputer), Sparrow 1.9.0 (April 25, 2024) removed "the Whirlpool client, and other Soroban related features" (release 1.9.0). Current versions have no CoinJoin. Treat any download that still offers Whirlpool as outdated or fake.

Hardware wallet support

Sparrow supports "all common hardware wallets in USB and airgapped modes" (sparrowwallet.com). Recent release notes name fixes and support for BitBox02, Trezor (including Safe 7), Ledger (including Nano Gen5), COLDCARD-format multisig imports, Jade, Krux and Keycard (releases). See each device page in our wallets hub.

Setup walkthrough (overview)

1. Download from sparrowwallet.com/download only, then verify the signed manifest (next section).
2. Choose a server: your own node is best for privacy; a public server is easiest to start.
3. File → New Wallet, name it, then import your hardware wallet's keystore (USB, QR or microSD). Your seed stays on the device.
4. Record the master fingerprint, and check the first receive address on the device screen.
5. Send in a small test amount, then do a test spend that you confirm on the device.

Sparrow's Quick Start and Best Practices guides cover each step. Our hardware wallet module walks through it with a device.

Verify the download

Download three files to one folder: the installer, `sparrow-<version>-manifest.txt` and `sparrow-<version>-manifest.txt.asc`. If you already run Sparrow 1.8.3 or later, drag them onto Sparrow to open its Verify Download dialog. Otherwise import Craig Raw's key, run `gpg --verify` on the manifest, then check the installer's SHA-256 against it (`shasum --check` on macOS, `sha256sum --check` on Linux, `CertUtil -hashfile` on Windows). The expected signer is "Craig Raw <craig@sparrowwallet.com>", key D4D0D3202FC06849A257B38DE94618334C674B40 (official instructions, Keybase).

Pros and cons

Security track record

The 2.5.4 and 2.5.5 releases (Aug 27 and Sep 17, 2026) shipped a long list of review-driven hardening changes, including verifying proof of work and merkle proofs from servers and tighter checks on PSBTs and imports (release notes, Decrypt). In our Oct 16, 2026 review of the release notes and security news we did not find a reported theft caused by a flaw in Sparrow itself. The main real-world risk is a fake download, which signature checks prevent.