PSBT 查看器

What a PSBT is

A PSBT — a partially signed Bitcoin transaction — is the file wallets pass around while a transaction is being built and signed: from the coordinator that picks the coins, to one or more signers (a hardware wallet, a multisig cosigner, a CoinJoin participant), and back to whoever broadcasts it. BIP-174 defined version 0, which carries the unsigned transaction in its global map; BIP-370 defined version 2, where each input and output carries its own fields so that parties can add them later; BIP-371 added the Taproot fields. The format starts with the magic bytes psbt\xff, which is why a base64 PSBT always begins with cHNidP8.

What makes a PSBT worth inspecting is that it holds more than the transaction: it holds the claims a signer relies on — how much each input is worth, which script it is locked by, which output returns change to the same wallet. A malicious or buggy coordinator can lie in exactly those fields.

Two passes over the same bytes

The first pass reads every key-value pair of the global map, of each input map and of each output map, and names its type — including unknown and proprietary keys, so nothing in the file stays invisible. The second pass is the strict parser of @scure/btc-signer, which enforces the BIP-174 and BIP-370 rules: key and value formats, the fields each version may and must carry, the counts. When it rejects the PSBT, its own message is shown verbatim; the raw pass still lists what it could read.

Inputs: what is really spent

For each input the inspector shows the previous output it spends, the amount and the script, and where those come from. A full previous transaction (non_witness_utxo) must hash to the spent transaction id — otherwise its amounts are invented. A witness UTXO alone gives an amount that nothing commits to before signing time; that let a coordinator lie about SegWit v0 amounts across two signing rounds (the 2020 fee attack), so the inspector notes when only the witness UTXO is present. A redeem script or witness script that does not hash to the spent output is a reason for a signer to refuse the input. Sighash types other than ALL (or DEFAULT for Taproot) are flagged, because the signature then covers less than the whole transaction; SIGHASH_SINGLE without a matching output signs the constant 1 and can be reused anywhere.

Partial signatures are verified against the signature hash the input commits to — legacy, BIP-143 for SegWit v0, BIP-341 for Taproot key paths — wherever the UTXO data allows; otherwise they are marked as not checkable rather than guessed. Strict DER and low-s are checked as nodes check them.

Outputs, change and the fee

Each output shows its amount, address (for the network chosen, or the one the derivation paths imply) and script type, OP_RETURN data in hex, and its BIP-32 derivations. An output counts as change when its key derives from the same master fingerprint as the inputs' keys — and, for single-key outputs, when that key really hashes to the output's script, since a derivation can be attached to any output. Outputs below the dust limit and coins burned in OP_RETURN are flagged.

The fee is the inputs' total minus the outputs' total, known only when every input carries its amount. The fee rate divides it by the transaction's virtual size: measured when every input is finalized, estimated from typical input sizes otherwise. A negative fee, a fee above a tenth of the amount sent and a rate above 1,000 sat/vB are all flagged.

Reading the verdict

"Do not sign" means a field contradicts what is being spent — an amount, a script, a signature — so the transaction can differ from what your wallet displays. "Review" means something unusual that can still be intended: replace-by-fee, unknown fields, a missing UTXO, a partial sighash. The inspector does not know your wallet: whether the outputs pay whom you meant to pay is for you to check against the addresses shown.

What runs locally

Everything: parsing, address encoding, signature hashes and checks run in your browser, and the page sends nothing anywhere. A PSBT carries no private key — signers keep theirs — and a WIF key, an xprv or a seed phrase pasted by mistake is refused before anything is processed. To see which addresses an extended public key of the PSBT derives, use the xpub inspector; to prove control of an address without moving coins, the Bitcoin message verifier checks BIP-322 signatures, which are built the same way.