Sparrow Wallet

Desktop Bitcoin wallet built for self-sovereignty — Apache-2.0, Tor-native, multisig + hardware-wallet ready, PSBT-first, with full coin control + BIP47 PayNym support. Maintained publicly by Craig Raw since 2021 and shipped through `github.com/sparrowwallet/sparrow`. Listed at Grade A because Sparrow is the canonical answer to "I want a Bitcoin wallet that doesn't lie to me" — every dependency on third parties (Electrum server, mempool data, exchange rate) is visible and swappable, every transaction can be reviewed at the input/output/script level before signing, and the binary is GPG-signed by an identifiable maintainer with verifiable releases. No telemetry, no account, no operator on the data path.

What it is. Sparrow is a JavaFX desktop Bitcoin wallet that connects to either a public Electrum server, your own Bitcoin Core node, or a private Electrum server (Electrs / Fulcrum). It supports every standard Bitcoin script type (legacy, nested segwit, native segwit, Taproot), single and multi-signature wallets, every major hardware wallet (Ledger, Trezor, Coldcard, BitBox, Jade, Foundation, etc.) in both USB and airgapped (PSBT-over-QR / SD-card) modes, PSBT at every step (you can sign one device → save → sign on another), coin control with detailed UTXO selection, BIP47 PayNyms (reusable payment codes), a transaction editor that lets you craft and inspect raw transactions before broadcast, and a built-in mini block explorer scoped to your own wallet's UTXOs. Tor connectivity is built in — point it at a local Tor daemon and every server connection routes through Tor.

Background. Sparrow was started by Craig Raw in 2021 to fill a specific gap in the Bitcoin wallet ecosystem: a desktop wallet that combined Electrum's coin-control + multisig capabilities with Specter Desktop's hardware-wallet support and JoinMarket's privacy posture, all in a single polished JavaFX app that ran on macOS, Windows, and Linux out of the box. Craig is publicly identified, signs every release with the GPG key `D4D0D3202FC06849A257B38DE94618334C674B40` (`craig@sparrowwallet.com`), and runs the project as a single-maintainer effort funded primarily by donations. The project crossed mainstream privacy-wallet awareness in 2022-2023 when Samourai Wallet and JoinMarket users adopted it as their desktop counterpart, and again in 2024 when several Bitcoin privacy-tooling shutdowns left Sparrow as the most-actively-maintained desktop option in its tier.

What you trust.

• Apache-2.0 open source. Codebase at `github.com/sparrowwallet/sparrow` is fully auditable. The build is JavaFX + Java; you can compile from source on your own hardware if you don't trust the binaries.
• Single-maintainer accountability. Craig Raw is publicly identified, accessible via the project's Telegram / Twitter, and signs every release manifest with a long-standing GPG key. "Single maintainer" cuts both ways (see Caveats) but it means every code change has one accountable signature.
• No account, no signup. Download the installer → verify the signature → run it. Sparrow itself collects nothing. The Electrum server you connect to sees your wallet's xpubs (more on this below); your local Bitcoin Core node sees nothing because it's yours.
• Reproducible-ish releases. The release manifests are GPG-signed; the build infrastructure is published; the JavaFX dependency tree is auditable. Sparrow doesn't yet ship the formal Guix-style reproducible-build pipeline that Bitcoin Core ships, but the build is straightforward to reproduce manually.
• Tor built in. The wallet's network panel exposes a Tor toggle; once enabled, every outbound connection (Electrum server fetch, mempool query, exchange rate) routes through your local Tor SOCKS proxy. No conditional fallback to clearnet for "convenience."
• PSBT-first. Every signing step uses the Partially Signed Bitcoin Transaction standard. You can sign one input on a hardware wallet, another on an airgapped machine, broadcast from a third — keys never have to live on the broadcasting machine.
• No custodial layer. Sparrow holds no keys for you. The seed phrase you generate lives in your wallet file (optionally encrypted with a password) on disk.

Operational specs.

• Install. Download from `sparrowwallet.com/download/` — macOS (Apple Silicon + Intel, 11+), Windows (.msi installer or .zip standalone, 10+), Linux (.deb / .rpm / .tar.gz, x86_64 + ARM64). Verify the SHA256 manifest with `gpg --verify` against Craig's key fingerprint `D4D0D3202FC06849A257B38DE94618334C674B40`. From Sparrow 1.8.3+, drag-and-drop verification works inside the app itself.
• Server modes. (1) Public Electrum server — Sparrow ships a vetted server list; you can pick any or rotate. (2) Your own Bitcoin Core node — direct RPC; full sovereignty. (3) Private Electrum server (Electrs / Fulcrum) running on your own infrastructure — best balance of full-node sovereignty + Electrum's wallet-side performance.
• Hardware wallets. Ledger, Trezor, Coldcard, BitBox, Foundation Passport, Jade, Krux, SeedSigner, Specter DIY — USB and airgapped flows.
• Privacy features. Built-in Tor (point at `127.0.0.1:9050`), per-wallet server selection, mixing coordinator integrations dropped when those upstream tools (Whirlpool, JoinMarket coordinator) became unreliable. Current privacy posture relies on PSBT + airgapped signing + your own Electrum server, not protocol-level mixing inside Sparrow.
• Headless server build. A `sparrowserver` headless Linux build (same `.deb` / `.rpm` / `.tar.gz` formats) supports running Sparrow's wallet-watch + transaction-broadcast functions on a server without the JavaFX UI. Useful for treasury monitoring + automated payouts.
• Update cadence. Currently 2.5.1 (May 2026). Releases historically every 2-4 months. Manual update — replace the binary, restart, wallet file format is forward-compatible.
• Support. Project Telegram, GitHub Issues, and a community-run Matrix room. No commercial support tier.

Operator philosophy. Craig Raw's stated position across Sparrow's blog posts and conference talks is "the wallet should make it easy to do the right thing and visible when you're not." Sparrow defaults to address-rotation on receive, fee-bumping (RBF) opt-in on every spend, network connection via Tor when enabled, and full-input/output review on every signed transaction. Where the wallet has had to compromise — e.g. dropping the Whirlpool integration after Samourai's 2024 takedown, dropping certain JoinMarket flows when the coordinator's reliability dropped — Craig has documented the reasoning in release notes rather than silently removing surface area. The project explicitly resists adding fiat on/off-ramps, token / NFT support, or chain-analysis-friendly defaults; the bet is that Sparrow's audience wants a Bitcoin-only sovereignty wallet and other wallets (Wasabi, Cake, BlueWallet) fill the broader-feature-set niche.

Grade rationale. Listed at Grade A because: (1) fully open-source under permissive licence (Apache-2.0, auditable, forkable); (2) named-operator accountability (Craig Raw, GPG-identifiable, 4+ years of consistent public signatures); (3) no account anywhere in the flow (download → verify → run, no Sparrow account exists); (4) Tor-native + your-own-server capable (no third party on the data path if you wire it that way); (5) PSBT-first + airgapped-signing support at the protocol level, not as a bolt-on; (6) hardware-wallet support breadth is the widest of any desktop wallet in this tier; (7) no security incident attributable to Sparrow-specific code in 4+ years of releases. The grade ceiling is Bitcoin-only scope — multi-chain users will need a second wallet for non-BTC assets — but for BTC the wallet earns A unconditionally.

Useful when:

• You hold Bitcoin and want a desktop wallet that doesn't talk to anyone except the server you point it at.
• You run (or want to run) your own Bitcoin Core node and want a wallet that natively understands that setup.
• You use hardware wallets and want one frontend that talks to Ledger / Trezor / Coldcard / BitBox / Jade / Foundation / etc., including airgapped PSBT-over-QR flows.
• You want multi-signature setup (2-of-3, 3-of-5, etc.) without the friction of running Electrum + Specter Desktop side-by-side.
• You need fine-grained coin control — selecting specific UTXOs to spend, marking outputs as do-not-spend, labelling for accounting + future-self.
• You use BIP47 PayNyms (reusable payment codes) and want a desktop wallet that supports the standard natively.
• You operate a business or treasury that needs PSBT workflows + hardware-wallet co-signing + auditable transaction history, but don't want to run a custodial provider.
• You're a Bitcoin-privacy advocate writing about or teaching wallet hygiene + Tor + airgapped signing — Sparrow is the canonical reference.

Caveats:

• Single-maintainer dependency. Craig Raw owns the release process; the project has accepted occasional outside contributions but the maintainer hat is one person. If Craig stopped releasing, the existing binary continues to work indefinitely (Bitcoin protocol doesn't break) but security fixes + new features would slow or fork.
• Bitcoin only. No Lightning, no Liquid, no altcoin support (intentional). If you need XMR alongside BTC, pair Sparrow with a separate Monero wallet (Feather, Monero GUI, Cake).
• JavaFX desktop only. No mobile, no web. Phone-based Bitcoin users should look at BlueWallet / Phoenix / Mutiny / Foundation Envoy depending on their flavour.
• Native protocol-level mixing dropped. Sparrow used to integrate Whirlpool (post-Samourai-shutdown maintenance burden) and JoinMarket coordinator flows; these are no longer first-class inside Sparrow as of recent releases. Privacy posture relies on PSBT + airgapped signing + your-own-server, not in-wallet coin mixing.
• Public-Electrum-server choice matters. If you don't run your own Electrum server, the public one you pick learns your xpubs (and therefore can correlate your addresses + balance). Sparrow makes this trade-off visible but doesn't eliminate it — running your own server is the only complete fix.
• Reproducible builds not fully formalised. Binaries are GPG-signed, but the formal Bitcoin-Core-style Guix reproducible-build pipeline that lets multiple independent builders reproduce the same byte-identical artifact is not yet in place. Build-from-source is the high-assurance path.
• JavaFX install size. ~150 MB on disk; the app bundles a JVM so users don't need to install Java separately. Heavier than CLI-first wallets like Bitcoin Core's bitcoin-cli.
• Initial sync depends on which server mode you pick. Public Electrum: seconds. Your own Bitcoin Core: 24-48 hours for the first chain download (one-time).