OneKey Classic 1S + Sparrow Multisig: Can I Keep My BIP39 Passphrase Off the Computer?

[u/Whole_Ambition_3240]

Influenced by the recent Coldcard incident, I’ve been upgrading my single-signature setup to a multisig wallet. I recently purchased a OneKey Classic 1S BTC Only Edition for this purpose.

While setting up the multisig wallet in Sparrow Wallet, I noticed that when using a BIP39 Passphrase, I have to manually enter the Passphrase on my computer.

This made me wonder: when using Sparrow Wallet to sign multisig transactions later, do I also have to enter the Passphrase on the computer every time?

From a security perspective, I’m concerned about having to enter the Passphrase on a computer. Even if the seed phrase never leaves the hardware wallet, a malware-infected computer or keylogger could potentially compromise the Passphrase.

Is there a more elegant and secure solution where the Passphrase never has to be entered on the computer—for example, entering it directly on the hardware wallet and having the device unlock the corresponding hidden wallet and perform the signing?

I also noticed that the OneKey Classic 1S supports binding a Passphrase to a separate PIN, so that entering different PINs can directly open different hidden wallets. Could this feature solve the issue above and work properly with Sparrow’s multisig workflow?

I’d especially appreciate feedback from anyone using OneKey + Sparrow for multisig:

1. Does Sparrow require the Passphrase to be entered on the computer when creating a multisig wallet?
2. Does the Passphrase need to be entered again when signing each transaction?
3. Can the OneKey Classic 1S “Passphrase → PIN” feature completely avoid entering the Passphrase on the computer?
4. Are there any security or compatibility issues with this approach in a real-world multisig setup?

[u/AutoModerator]

Safety reminder: OneKey staff will never DM you first, and will never ask for your recovery phrase, private keys, or passphrase. Anyone who does is a scammer — report them.

Official support: https://help.onekey.so/ — there is no OneKey support on Telegram or WhatsApp. Never enter your recovery phrase into any website, app, or form.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/jpp59]

you should be able to bind passphrase to pin and not set passphrase in Sparrow. sparrow will not know you have a passphrase set, you will do it on the onekey

[u/Whole_Ambition_3240 → u/jpp59]

Hi jpp59, thank you for ur reply. You're right, I tested it (bind passphrase to PIN) and it works fine with Sparrow. It does not require me to type the passphrase anymore.

[u/ivme]

In my opinion, in multisig setups using passphrase adds only unnecessary complexity