Watch-only multisig wallet for Android and iOS

A multisig wallet is defined by an output descriptor: the script type, the threshold and every cosigner's extended public key. Paste that descriptor into Bag and your phone derives the wallet's addresses, checks their balance on a block explorer (optionally over Tor) and folds the result into your net worth and widget. No cosigner key, no signing device and no full wallet app are involved — it is strictly watch-only.

Updated 2026-09-10 · Applies to Bag 1.3 and later on Android and iOS

Bag Wallet & Privacy screen with a watch-only Cold Storage wallet, its balance, Scan Now and an add-wallet button — A watch-only wallet card in Bag. Multisig wallets show a summary such as 2-of-3 multisig · native segwit.

Output descriptors explained

Before descriptors, "import my multisig" meant collecting the xpubs, guessing the derivation paths, guessing whether the keys were sorted, and hoping the addresses matched. A descriptor (BIP380–386) writes all of that down in one line:

wsh(sortedmulti(2,
  [a1b2c3d4/48h/0h/0h/2h]xpub6E…/<0;1>/*,
  [e5f6a7b8/48h/0h/0h/2h]xpub6F…/<0;1>/*,
  [c9d0e1f2/48h/0h/0h/2h]xpub6G…/<0;1>/*
))#checksum

wsh(…) — the script is native segwit pay-to-witness-script-hash; addresses start with bc1q and are 62 characters long.
sortedmulti(2, …) — a 2-of-N multisig whose public keys are sorted (BIP67) before the script is built, so the cosigner order in the file does not matter.
[a1b2c3d4/48h/0h/0h/2h] — the key origin: the master fingerprint and the hardened path the signer used to reach this xpub. It is metadata for signers; a watch-only tracker does not need it.
xpub6E… — the cosigner's extended public key at that account.
/<0;1>/* — derive chain 0 (receive) and chain 1 (change), every index.
#checksum — eight characters that catch a typo anywhere in the line.

Bag understands wsh, sh(wsh(…)) (nested segwit, 3… addresses), bare sh (legacy P2SH multisig) and single-key wpkh / sh(wpkh) / pkh. Inside those it takes multi or sortedmulti with any threshold up to the key count.

Import from Sparrow, Nunchuk or Bitkey

Every serious multisig coordinator can export its descriptor. Where to find it:

Sparrow Wallet — open the wallet, Settings tab, Export, choose Output Descriptor. The file contains one <0;1> multipath descriptor and, under # comment lines, the separate receive and change descriptors. Paste the whole file; Bag strips the comments and merges the rest.
Nunchuk — the wallet's export options include the descriptor (and BSMS, whose descriptor line is the same format). Copy the descriptor text.
Bitkey — Settings → Exports → Export wallet descriptor. Two labelled lines, External: and Internal:, no checksum. Paste both. There is a dedicated Bitkey guide.
Anything else (Specter, Caravan, BlueWallet, Electrum with descriptor export) — as long as it produces a BIP380 descriptor using the scripts above, it pastes in the same way. A QR-scanned descriptor that arrived wrapped across several lines is fine too.

Add a multisig descriptor to Bag

Open Wallet & Privacy
Bag → Settings → Wallet & Privacy. Watch-only wallets are part of Pro.

Settings with the Wallet & Privacy entry.
Add holding → Multisig
Under WALLETS & HOLDINGS tap Add holding (labelled Add wallet before version 1.3) and select the Multisig kind. The field expands to several lines.
Paste the whole export
Label it, paste everything your coordinator exported and tap Connect Wallet. Bag verifies the checksum if there is one, rejects private keys and hardened steps after the xpub, checks that the cosigners agree on chains and that the threshold is not larger than the key count, then scans both chains.

The wallet card after the first scan.
Confirm the summary
The card shows a summary such as 2-of-3 multisig · native segwit. Compare the first receive address (via the card's menu → View descriptor, or simply by checking that the balance matches your coordinator) before you rely on it.

sortedmulti, multipath <0;1> and checksums

sortedmulti vs multi

With multi, the order of the public keys is part of the script, so listing cosigners in a different order produces different addresses. With sortedmulti, keys are sorted lexicographically (BIP67) after deriving each child key, per address index — which is what Bitkey, Sparrow and Nunchuk do by default. Bag applies exactly that rule and is tested against the BIP67 vectors. Consequence: for sortedmulti Bag treats two descriptors with the same keys in a different order as the same wallet; for multi it does not.

Multipath <0;1>

BIP389 lets one descriptor cover both chains: /<0;1>/* expands to /0/* and /1/*. Older exports give you two descriptors instead, one per chain. Bag accepts either form and normalises both into a single two-chain wallet, as long as every cosigner declares the same chains.

Checksums

The #xxxxxxxx suffix is a BIP380 checksum over the descriptor text. When it is present, Bag verifies it and a mismatch is fatal — a single mistyped character would otherwise mean silently watching addresses you do not own. When it is absent (Bitkey's export has none) the descriptor is accepted as is.

Change addresses and why receive-only descriptors are refused

Every spend from a multisig sends the change back to a fresh address on chain 1. If a tracker only watches chain 0, that change is invisible: after each payment the balance falls by the whole input that was consumed, not by the amount actually sent. A real Bitkey user hit exactly this with a wallet added from the External: line alone — the balance looked like it had lost a large sum after a small payment.

Bag therefore refuses to add a descriptor that covers only /0/*. The add sheet explains that the change chain is missing and asks for the full export. A wallet that was stored that way before the check existed still scans, but its card shows a receive-only summary and a standing warning until you re-add it with both chains. Watching chain 1 also lets Sentinel (Android) report the net amount of a spend correctly — outputs to your change address are subtracted, so an alert reads "−(amount + fee)" rather than "−(entire input)".

What Bag does not support

Taproot (tr(…)) descriptors, including Miniscript and MuSig setups — rejected with an explicit message.
Hardened derivation after the xpub (e.g. xpub…/0h/*) — impossible from a public key.
Raw public keys in place of extended keys — they would yield a single address, not a wallet.
Signing or building transactions. Bag is a monitor. It has no PSBT support and never will need your keys.

What it does do on top of the balance: the Portfolio Health Check runs across all your wallets together and scores address reuse, dust, coinjoin coverage and script consistency — useful for a multisig vault that receives from many sources.

Privacy

Bag is built around one rule: nothing that identifies your wallet leaves the phone. Extended public keys and descriptors are parsed on-device, and child addresses are derived on-device with plain BIP32 arithmetic. The only thing that reaches the network is a list of individual addresses, sent to the block explorer you chose (mempool.space, blockstream.info or your own Esplora-compatible node under NETWORK in Wallet & Privacy).

Turn on Route through Tor and every query goes through Orbot's SOCKS proxy (a system VPN on iOS). This is fail-closed: if Orbot is not running, Bag does not quietly fall back to the clear net — scans stop and the app tells you so. A .onion explorer address is supported.

Everything financial is encrypted at rest: the zpub or descriptor, wallet labels and cached balances, the manual BTC amount, the DCA log (AES-256 Hive box) and the health-check result all live in the platform keystore-backed secure storage, never in plain preferences. There is no account, no analytics SDK, no crash reporter and no server of ours that ever sees a key. The app is GPL-3.0 and the source is public, so you can verify each of these claims yourself.

Pricing

Free forever: manual BTC amount, net worth in up to 3 of 30 currencies, charts, the DCA tracker and the widget.

Pro is a one-time unlock, no subscription. It unlocks watch-only wallets — zpub, descriptors and multisig — plus manual balances, Tor routing, a custom Esplora node, the Bitcoin Health Check, Sentinel on Android and fee alerts. Buy it through Google Play or the App Store, or — if you installed from F-Droid or the APK — pay with bitcoin on bitbag.app/pro and receive a signed licence key that the app verifies offline. Nothing phones home after that.

Frequently asked questions

What is an output descriptor?

A one-line, standardised (BIP380–386) description of a wallet: the script type, the multisig threshold, every cosigner’s extended public key with its origin path, the chains to derive, and usually a checksum. Given the descriptor, any software derives exactly the same addresses.

Which descriptor types does Bag accept?

wsh, sh(wsh(…)), sh and the single-key wpkh, sh(wpkh(…)) and pkh, wrapping multi or sortedmulti with any threshold up to the key count. Keys may be xpub, ypub or zpub with or without an origin prefix. Chains can be written as BIP389 multipath <0;1> or as separate /0/* and /1/* descriptors. Taproot tr(…) is not supported.

Can Bag track a Bitkey 2-of-3 wallet?

Yes. Paste Bitkey’s wallet descriptor export — both the External and the Internal line — into Add holding → Multisig. Bag merges the two lines into one wallet and derives the same sortedmulti addresses Bitkey uses.

Why does Bag refuse my descriptor as receive-only?

Because it covers only the receive chain (/0/*). Change from your own spends goes to chain 1, so a receive-only wallet would appear to lose the entire input after every payment. Export the full descriptor with both chains — multipath <0;1> or the External and Internal lines — and add it again.

What does the checksum after # do?

It is a BIP380 checksum of the descriptor text. Bag verifies it when present and refuses the descriptor if it does not match, because a typo would otherwise mean watching addresses that are not yours. Descriptors without a checksum, such as Bitkey’s export, are accepted.

Does the order of cosigners matter?

For sortedmulti, no: keys are sorted per BIP67 after derivation, so Bag treats reordered cosigners as the same wallet. For multi, yes: key order is part of the script and reordering produces different addresses, so Bag treats them as different wallets.

Can Bag sign or spend from the multisig?

No. Bag holds only public keys and has no PSBT or signing feature. It derives addresses, reads balances and shows net worth. Spending still requires your cosigners and their signing devices.

Is the descriptor stored securely on the phone?

Yes. The descriptor, the wallet label and the cached balance are kept in the platform’s keystore-backed secure storage, encrypted at rest. Nothing is written to plain preferences, and nothing leaves the device except the individual addresses sent to your chosen block explorer.

Get Bag

Free on Google Play, the App Store and F-Droid. No account, no ads, no analytics. Source on GitHub.

Google Play App Store F-Droid