Why two devices

The threats an offline signer answers (a hacked computer, address-swapping malware, remote key theft), how QR-only signing stops them, and its honest limits.

#The attack that can't get across

Picture a bad week for your everyday laptop. Something got in, through a browser extension or a pirated app, and it has been sitting quietly, reading what you copy and watching what you type. With an ordinary wallet, that's close to game over: the key lives on the same machine as the malware, a few steps away.

Now move the key to an old phone that has been in airplane mode since the day you set it up. The malware still owns the laptop, and it can still lie to you on the laptop's screen. What it can't do is reach the phone, because the only thing that ever travels from the laptop to the phone is a QR code, and the phone reads that code as text, checks it, and shows you in plain words what it would pay before anything is signed. It's a surprisingly low-tech wall (a camera and a screen) and that's exactly why it's hard to get through.

#What it protects you from

• A hacked online computer or phone. Your everyday device never holds the keys of the wallets it watches. It can prepare payments, but only the offline device can sign them.
• Malware that swaps addresses or amounts. If something changes the recipient, the amount or the fee on the way, the offline device shows what the transaction really does, read from the bytes it's about to sign. You catch the swap on the offline screen.
• Remote key theft. There's no network path to the keys. AirWallet in Offline signer mode refuses every connection, and the hardened AirWallet Offline can't connect at all (on Android it has no internet permission, so Android itself blocks it).
• Blind signing. The signer refuses anything it can't show you completely. For Ethereum, that means plain payments, token transfers and Safe multisig transactions it can show line by line, never token approvals or arbitrary contract calls. The one exception is approving a Squads multisig proposal someone else made, because what it does is on the blockchain, not in the code. The signer says so, names the proposal's number to check in the Squads app, and asks once more. Per coin: What the signer checks.
• Fee tricks. A very high fee is flagged, and a far higher one than usual makes you press Sign a second time. For Bitcoin, the signer also checks each coin's amount, so a lying online device can't quietly inflate the fee.

#How QR-only signing stops these

For each payment, two codes cross between your devices, and you see both of them:

1. The everyday device prepares an unsigned payment and shows it as a QR code.
2. The offline device scans it, shows what it does, and signs only if you tap Sign.
3. The offline device shows the signed transaction as a QR code.
4. The everyday device scans that and sends it to the network.

The signed transaction becomes public anyway once it's sent. Apart from payments, only a few other codes ever cross, all of them on screen where you can see them: the code you scan once at setup so the everyday device can watch the wallet (addresses, plus a view key for Monero and Zcash), balance updates going to the offline device, and, before your first Monero send, a list of which coins are spent. None of them holds a key that can spend.

The balances your everyday device sends are for display only: what gets signed never depends on them.

#How it compares to a hardware wallet

Same goal, different trade. A typical hardware wallet, such as a Ledger, keeps keys in a secure chip and connects to your online computer by cable or Bluetooth to sign; you confirm on a small screen. Here the signer is an ordinary phone or laptop with its network blocked, and the only channel is a camera: no cable, no Bluetooth, no companion app in the loop, and a full-size screen that shows the whole address, the amount and the fee every time.

What you give up is the secure chip. A stolen device that's unlocked is easier to dig keys out of than a hardware wallet, so turn on the app lock and keep the device boring and offline.

#What it doesn't protect you from

• Someone with your unlocked offline device. The keys are on it. Turn on the app lock (Settings → App lock): a PIN or password that encrypts the wallet when the app is locked. Without it, anyone who picks up the device and opens the app can sign.
• Someone with your recovery phrase. Your written words are the wallet. Whoever has them can take the money on any device, air gap or not. Keep them on paper, somewhere safe and private, never as a photo or a screenshot.
• Not reading the offline screen. The signer shows you the truth about what it signs, but it can't know who you meant to pay. Read the recipient and the amount on the offline screen, and compare the address with the one your recipient actually gave you. If malware swapped the address before you even started (say, in something you copied), the offline screen will show the swapped address faithfully. It also warns when an address only looks like one you've paid before.
• An offline device that goes back online. Once it connects, its keys are no longer air-gapped. AirWallet warns you before you switch an offline signer that holds keys back to an everyday wallet, but the choice is yours.
• A fake receive address. A hacked everyday device could show you someone else's address to receive on. To check one, scan it with the offline device (Scan): it says whether the address belongs to one of its wallets.
• A fake copy of the app. The protection is only as good as the AirWallet you installed. Check your download against the signed list of release files.

For the deeper details (how keys are stored, deterministic signatures you can check, what each signer refuses), see Security model.