BTCPay Server Vault is a free, open source bridge that lets web applications reach a hardware wallet connected to your computer. It is aimed at developers, merchants and self-hosting operators who run BTCPay Server or similar web tools and want transaction approval to happen on a physical device. The project is released under the MIT license, and its most recent code update is dated July 8, 2026.
Vault is a connection layer, not a full wallet. It does not manage your balances, and the private keys stay on the hardware device itself. If you want a desktop app with its own interface, compare the alternatives covered below. This page explains what the program does, how to install it on Windows, and where caution is needed before you connect real funds.
What Is a Hardware Wallet Bridge?
A hardware wallet keeps private keys inside a small device that signs transactions only after you confirm them. The device is secure, but a web page in your browser cannot talk to it directly. Something on your computer has to translate between the browser and the USB connection. That translator is what people call a bridge.
Bridges are usually small local services. They listen on your machine, accept requests from an application, and pass commands to the device through a standard tool. Because the translation happens locally, the keys never need to leave the hardware.
Vault follows this pattern. It uses the HWI project's command-line tooling underneath and exposes the result through a local web server. For a merchant or developer, a payment page or admin panel can request a signature while the actual approval happens on the device.
Who Is BTCPay Server Vault For?
The program is most relevant to three groups. The first is developers who want to add hardware wallet signing to a .NET application. The NuGet library handles the command-line layer, so they can focus on the user flow.
The second group is operators who run BTCPay Server or similar self-hosted tools and want their team or customers to authorize payments with a hardware device. A local bridge means each signer uses their own computer and their own device rather than sharing credentials.
The third group is power users who prefer reading code before trusting it. Because the project is open source under the MIT license, anyone can inspect how requests are handled. People who only want a balance screen and a send button will likely find a full desktop wallet more comfortable.
Real-World Use Cases for Local Device Signing
Consider a small online shop that accepts Bitcoin and runs its own payment server. The owner keeps the signing key on a hardware wallet at home. When the shop needs to move funds, the admin page in a browser asks Vault for a signature, the owner confirms on the device, and the transaction goes out. No seed phrase is typed into the web page.
A second scenario involves a developer building an internal tool for a treasury team. Each team member connects their own hardware wallet to their own machine. The library handles device communication through HWI, and the web interface never sees the private key.
A third case is testing. Before using real funds, a developer can run the bridge with a spare or test device, confirm that the web flow works, and review the code paths that matter to their project.
Key features
Hardware Wallet Library for .NET
Local Web Server for Device Access
Official Announcement and Documentation
Supported coins
The documentation mentions Bitcoin (BTC) as the supported network. Because Vault connects to hardware wallets through HWI, what you can sign depends on the device and on the application that sends the request. Check the project documentation before relying on a specific network or token.
How to install BTCPay Server Vault on Windows
- 1
Choose the Right Release
Open the project repository at github.com/btcpayserver/btcpayserver.vault and go to the Releases page. The latest tag is Vault/v3.0.1, and newer tags may appear later. Download only from the official website or the GitHub Releases page linked from the project repository.
- 2
Confirm a Windows Build
The project lists Windows builds as likely rather than certain, so open the assets attached to the release and look for a Windows package. If none is attached, the software may need to be built from source, which is a task for developers rather than everyday users.
- 3
Verify the File
Compare the SHA-256 checksum of the downloaded file with the value published on the release page. You can calculate it with the built-in Get-FileHash command in PowerShell. If a signature file is provided, check it as well, and do not run a file whose hash does not match.
-
Install and Run
Extract the archive or run the installer, depending on how the release is packaged. Start the program and keep it running while a web application needs to reach your hardware wallet. Connect the device by USB before opening the web page that requests a signature.
System requirements
- A hardware wallet physically connected to the computer, reached through the HWI tooling
How to use BTCPay Server Vault
Once the bridge is installed, using it follows a simple pattern: start the local service, connect the device, and let the web application make its requests. The exact screens depend on the application you pair with Vault, so treat these steps as a general guide.
- Connect your hardware wallet to the computer with its USB cable and unlock it with your PIN.
- Start BTCPay Server Vault and confirm that it is running on your machine.
- Open the web application that needs device access, such as a BTCPay Server admin page.
- When the application asks for a signature, check the transaction details shown on the hardware wallet screen.
- Approve the request on the device only if the amounts and addresses match what you expect.
- Close the bridge when you finish, especially on a shared computer.
Pros & cons
- Free and open source under the MIT license
- Local server keeps the device connection on your own computer
- Recently updated, with the last code update dated July 8, 2026
- Includes a NuGet library for .NET developers
- Keys remain on the hardware wallet during signing
- Not a standalone wallet; it needs a web application or your own code on top
- Windows builds are expected but should be confirmed in the release assets
- Documentation mentions Bitcoin (BTC) only
- Library use requires programming knowledge
- Setup is more technical than consumer wallet apps
Is BTCPay Server Vault safe?
Treat Vault as security software. Download it only from the official website or the GitHub Releases page of the btcpayserver.vault repository, never from mirror sites or links sent in messages. Compare the SHA-256 checksum against the published value, and check the signature when one is offered. Confirm the latest version before installing.
Never enter your seed phrase into a website, a pop-up, or any tool that asks for it during setup. A legitimate signing flow only requires you to approve actions on the hardware device itself. Be careful with web pages that ask to reach a local service on your computer, and connect only applications you trust. Open source code can be reviewed, but reviewing it does not replace these checks.
- Official source only. Download from github.com/btcpayserver/btcpayserver.vault. Ignore ads and lookalike domains.
- Check the SHA-256. Compare the installer hash with the value the developer publishes before running it.
- Never share your seed phrase. No developer, support agent or website — including CryptApps — will ever ask for it.
Alternatives
Vault differs from most programs on this list because it is a bridge rather than a finished wallet. Trezor Bridge serves a similar purpose but is tied to Trezor devices, while Vault uses the HWI project's tooling and presents the result through a local web server for web applications. BitBoxApp, Trezor Suite and Ledger Wallet (Ledger Live) are full desktop companions with their own interfaces for managing accounts and sending funds. Keystone works with third-party wallets on a computer, which is closer to Vault's model of letting other software handle the user-facing work. If you want a complete app to manage a device, choose one of the companions. If you are building a web tool that needs signing, Vault is the more relevant option.
Specifications
- Price
- Free
- Type
- Open source
- License
- MIT
- Latest version
- Vault/v3.0.1
- Last update
- 8 Jul 2026
- Windows support
- Likely (builds for Windows; check releases)
- Source code
- github.com/btcpayserver/btcpayserver.vault
Frequently asked questions
Yes. BTCPay Server Vault is free and released under the MIT license, which allows you to use, study and modify the code. The source code is available on GitHub, so you can review what the program does before installing it. The license covers the software itself, not any services you connect it to.
Windows builds are listed as likely, so check the assets on the GitHub Releases page for a Windows package. If no Windows file is attached, a build from source may be required, which involves developer tools. Test the setup with a spare or small-balance device before relying on it for regular use.
It acts as a local bridge between web applications and a hardware wallet connected to your computer. A web page sends requests to the local server, which forwards them to the device through HWI tooling. The device then asks you to approve the action. The keys stay on the hardware wallet throughout.
The documentation mentions Bitcoin (BTC). Support for other networks depends on the hardware wallet and the HWI tooling underneath, so check the current documentation before planning around a specific asset. A device that works with one network does not automatically work with every network.
It can be used safely if you follow basic checks. Download it from the official GitHub repository, verify the SHA-256 checksum, and never enter your seed phrase on a website or in a prompt. The code is open source, so it can be reviewed. Use the bridge only with trusted web applications, and close it when you are done.
No. A seed phrase should never be entered into a bridge, a web page or any prompt that asks for it. Signing through a hardware wallet only requires approving actions on the device. If any tool asks for your seed phrase during setup, stop and treat the request as a warning sign.
Verdict
BTCPay Server Vault is a focused tool for a specific job: letting web applications request signatures from a hardware wallet on your own computer. It is free, MIT-licensed, open source and recently updated, which makes it attractive for developers and self-hosting operators. It is not a standalone wallet, and it suits people comfortable with a technical setup. If you want a complete app for managing balances, compare it with the companions listed above.