BitBox02

shiftcrypto.ch
BitBox02

Open source hardware wallet, supporting secure multisig with the option for making encrypted backups on a MicroSD card.

Open Source

BitBox02 Source Code

Author

BitBoxSwiss

Description

The BitBoxApp for desktop and mobile.

#bech32#bitcoin#hardware-wallet#litecoin#segwit#wallet

Homepage

https://bitbox.swiss/app

Repository

  • LicenseApache-2.0
  • Created02 Aug 18
  • Primary languageGo
  • Size1,109,261 KB
  • Stars327
  • Forks126
  • Watchers327

Language Usage

Language Usage

Project Health

  • Last commit6 days ago
  • Open issues108
  • Latest releasev4.51.4

Recent Commits

  • thisconnect(24 Aug 26)

    Merge branch 'frontend-decimals'

  • thisconnect(21 Aug 26)

    frontend: add issupportederc20 helper function So that amount component does not have to maintain an extra list

  • thisconnect(17 Aug 26)

    frontend: fix maxdecimals for eth tokens

  • thisconnect(17 Aug 26)

    frontend: test maxdecimals

  • thisconnect(24 Aug 26)

    Merge branch 'frontend-upgrade-fw-during-setup'

  • thisconnect(24 Aug 26)

    frontend: disable back in blocking upgrade firmware dialog

  • Nikolas De Giorgis(20 Aug 26)

    tests: allow Playwright tests to skip fw upgrade. If the tests are not using the latest fw, the screen that prompts for fw upgrade show up before the "create wallet" button is visibile. If it shows up, skip it.

  • thisconnect(18 Aug 26)

    frontend: allow users to upgrade firmware before setup In some cases users have installed a firmware but did not setup a wallet yet. Added a separate upgrade firmware step before the wallet setup, so users can upgrade the firmware before setting up a wallet. Added a separate step to not clutter the setup wallet UI and that users don't miss it. This also fixed an issue with the upgrade dialog which was closable but should be blocking. Additionally added a point-to-device graphic to indicate to continue on the device.

  • thisconnect(18 Aug 26)

    frontend: remove closing button on blocking dialog

  • beerosagos(24 Aug 26)

    Merge branch 'feat-gate-ln-mobile-only'

  • thisconnect(24 Aug 26)

    Merge remote-tracking branch 'upstream/staging-spark'

  • beerosagos(24 Aug 26)

    Merge branch 'merge-master-staging-spark' into staging-spark

  • beerosagos(24 Aug 26)

    Merge branch 'master' into merge-master-staging-spark Conflicts resolved: Android app/build.gradle: keep version code 73 and the Spark flavor and icon configuration while adopting API level 36. asset-balance-with-unit-price.tsx: retain the account balance layout and showUnitPrice option, and apply the BTC and sat display-currency rule consistently to rendering and vertical alignment. asset-balance-with-unit-price.test.tsx: combine both independently added test suites to cover display-currency hiding, explicit hiding, coin-code forwarding, and asset logo styling. total-balance-for-all-keystores.test.tsx: provide a MemoryRouter for the Spark branch's navigation dependency.

  • sl(24 Aug 26)

    Merge branch 'frontend-ln-settings-change' into staging-spark

  • sl(24 Aug 26)

    frontend: rename shutdown to disable wallet (LN) and rearrange

  • sl(24 Aug 26)

    Merge branch 'adjust-unit-price'

  • sl(12 Aug 26)

    backend: normalize bitcoin unit rates CoinGecko can return values like 0.999 BTC for 1 BTC. Thus, we set BTC/BTC and BTC/sat rates ourselves in the backend so all callers get the correct values.

  • sl(12 Aug 26)

    frontend: hide unit price in accountsummary for btc (edge case) 1. if user's default currency is btc/sat, don't show the unit price 2. in the account summary for their btc assets

  • Marko Bencun(24 Aug 26)

    Merge remote-tracking branch 'agent/benma-agent/android-target-api-36'

  • benma's agent(23 Jul 26)

    android: target API level 36 Google Play requires app updates to target Android 16 (API level 36) or higher starting August 31, 2026. Raise compileSdk and targetSdkVersion to 36 and install the Android 36 SDK platform in the development container. Use Android Gradle Plugin 8.10.1, the first stable AGP line with explicit API 36 support, with its required Gradle 8.11.1 runtime. These versions differ because AGP is a plugin and Gradle is the runtime that executes it. Keep SDK Build Tools 35.0.0 because it is AGP 8.10's supported default. The SDK platform, compileSdk, and targetSdkVersion determine the Android API level, so Build Tools 36 is not required and no explicit version pin needs to be restored. Android 16's behavior changes were reviewed against the app. It already uses OnBackPressedDispatcher, handles edge-to-edge insets, declares no orientation or aspect-ratio restrictions, and produces 16 KB-aligned native libraries. It does not use the affected scheduling, health, MediaStore, companion-device, or Android Bluetooth APIs, so no app source changes or compatibility opt-outs are needed. References: https://developer.android.com/about/versions/16/behavior-changes-all https://developer.android.com/about/versions/16/behavior-changes-16 https://developer.android.com/build/releases/agp-8-10-0-release-notes

  • Marko Bencun(24 Aug 26)

    Merge remote-tracking branch 'benma/txnote-tombstone'

  • Marko Bencun(03 Jul 26)

    notes: track transaction note metadata Empty notes become tombstones, and we add modified timestamps. This is necessary so BitBoxSync can merge conflicts and sync deletions.

  • Marko Bencun(24 Aug 26)

    Merge remote-tracking branch 'agent/benma-agent/private-export-files'

  • benma's agent(04 Aug 26)

    backend: secure exports before truncating Open existing export destinations without truncating them, restrict their permissions, and only then truncate them. This preserves their contents when tightening permissions fails.

  • benma's agent(28 Jul 26)

    backend: restrict export file permissions Create notes, transaction, and log exports with private file permissions. Tighten existing destinations before writing and document the policy.

  • Sebastian Sutter(24 Aug 26)

    Merge remote-tracking branch 'slightsharp/master'

  • Marko Bencun(24 Aug 26)

    Merge remote-tracking branch 'agent/benma-agent/stabilize-websocket-test'

  • Marko Bencun(24 Aug 26)

    Merge remote-tracking branch 'agent/benma-agent/add-simulator-v9.26.5'

  • Sebastian Sutter(24 Aug 26)

    Merge branch 're-enable-usdt-btc-direct'

  • Sebastian Sutter(24 Aug 26)

    backend: enable btcdirect support for usdt BTC Direct now supports Tether USDT again.

BitBox02 Security

5.6/10

Repo Security Summary

Updated 17 Aug 26

  • Code-Review10/10
  • Maintained10/10
  • PackagingN/A
  • Dangerous-Workflow10/10
  • Token-Permissions0/10
  • CII-Best-Practices0/10
  • Security-Policy0/10
  • Binary-Artifacts9/10
  • License10/10
  • Branch-ProtectionN/A
  • Fuzzing0/10
  • Signed-Releases8/10
  • Pinned-Dependencies0/10
  • SAST0/10

BitBox02 Website

Website

301 Moved Permanently

Redirects

Redirects to https://bitbox.swiss/

Security Checks

3 security checks failed (62 passed)

  • External Redirect Detected
  • Domain Recently Created
  • Domain Very Recently Created

Server Details

  • IP Address172.67.157.94
  • LocationSan Francisco,California,United States of America,NA
  • ISPCloudFlare Inc.
  • ASNAS13335

Associated Countries

  • USUS
  • CACA

Safety Score

Website marked as safe

100%

Blacklist Check

shiftcrypto.ch was found on 0 blacklists

  • AntiSocial Blacklist
  • Artists Against 419
  • Badbitcoin
  • Bambenek Consulting
  • CERT Polska
  • CoinBlockerLists
  • CRDF
  • CryptoScamDB
  • EtherAddressLookup
  • EtherScamDB
  • Fake Website Buster
  • MetaMask EthPhishing
  • NABP Not Recommended Sites
  • OpenPhish
  • PetScams
  • PhishFeed
  • PhishFort
  • Phishing.Database
  • PhishStats
  • PhishTank
  • Phishunt
  • RPiList Not Serious
  • Scam.Directory
  • SecureReload Phishing List
  • Spam404
  • StopGunScams
  • Suspicious Hosting IP
  • ThreatFox
  • ThreatLog
  • TweetFeed
  • URLhaus
  • ViriBack C2 Tracker

Website Preview

Website preview

BitBox02 Reviews

More Crypto Wallets

  • A steel plate, with engraved letters which can be permanently screwed - CryptoSteel is a good fire-proof, shock-proof, water-proof, and stainless cryptocurrency backup solution.

  • Long-standing Python-based Bitcoin wallet with good security features. Private keys are encrypted and do not touch the internet and balance is checked with a watch-only wallet. Compatible with other wallets, so there is no tie-in, and funds can be recovered with your secret seed. It supports proof-checking to verify transactions using SPV, multi-sig, and add-ons for compatibility with hardware wallets. A decentralized server indexes ledger transactions, meaning it's fast and doesn't require much disk space. The potential security issue here would not be with the wallet, but rather your PC - you must ensure your computer is secure and your wallet has a long, strong passphrase to encrypt it with.

  • Sparrow is a Bitcoin wallet for those who value financial self-sovereignty. Sparrow’s emphasis is on security, privacy, and usability. Sparrow does not hide information from you - on the contrary, it attempts to provide as much detail as possible about your transactions and UTXOs, but in a way that is manageable and usable.

  • Trezor

    Trezor

    trezor.io

    Open source, cross-platform, offline, crypto wallet, compatible with 1000+ coins. Your private key is generated on the device, and never leaves it, all transactions are signed by the Trezor, which ensures your wallet is safe from theft. There are native apps for Windows, Linux, MacOS, Android, and iOS, but Trezor is also compatible with other wallets, such as Wasabi. You can back the Trezor up, either by writing down the seed, or by duplicating it to another device. It is simple and intuitive to use, but also incredibly customizable with a large range of advanced features.

  • An open source, native desktop wallet for Windows, Linux, and MacOS. Wasabi implements trustless CoinJoins over the Tor network. Neither an observer nor the participants can determine which output belongs to which input. This makes it difficult for outside parties to trace where a particular coin originated from and where it was sent to, which greatly improves privacy. Since it's trustless, the CoinJoin coordinator cannot breach the privacy of the participants. Wasabi is compatible with cold storage and hardware wallets, including OpenCard and Trezor.

About the Data: BitBox02

Edit BitBox02 Data

You can edit BitBox02's entry in this section of awesome-privacy.yml by submitting a PR to our GitHub repo.
Note that some of the information shown above has been aggregated from external sources, a list of these can be found data documentation.

Origin Data

Modify Data

API

You can access BitBox02's data programmatically via our API. Simply make a GET request to:

https://api.awesome-privacy.xyz/v1/services/bitbox02

The REST API is free, no-auth and CORS-enabled. To learn more, view the API Docs or read the API Usage Guide.

Share BitBox02

Help your friends compare Crypto Wallets, and pick privacy-respecting software and services.
Share BitBox02 and Awesome Privacy with your network!