BTCPayServer Vault is a free, open-source Mac utility that creates a secure local bridge between browser-based Bitcoin applications and physical hardware wallets — letting you sign transactions on your Ledger or Trezor without ever exposing your private keys to the web.
What is BTCPayServer Vault?
BTCPayServer Vault is a lightweight desktop daemon that runs on your Mac and exposes a local HTTP endpoint that web applications — primarily the self-hosted BTCPayServer payment processor — can call to interact with a hardware wallet connected over USB. Think of it as a permission gateway: the browser asks to sign something, Vault intercepts that request, routes it to your physical device, and returns only the signed result. Your seed never leaves the hardware wallet.
It is part of the broader BTCPayServer ecosystem, which lets merchants and developers run their own sovereign Bitcoin payment infrastructure without relying on third-party processors or custodians.
What does BTCPayServer Vault do best?
Vault's standout strength is keeping hardware-wallet signing completely air-gapped from the browser's execution context. Without a tool like this, a web app would either require you to paste extended public keys manually on every session or, worse, attempt insecure WebUSB calls that vary wildly across browsers. Vault normalises that surface into a single, auditable local process.
- Hardware wallet support: works with Ledger and Trezor devices out of the box; the project tracks upstream BTCPayServer hardware-wallet library support.
- Zero configuration: launch the app, plug in your device, and BTCPayServer's wallet setup page detects Vault automatically — no port numbers to memorise, no browser extensions to install.
- Minimal attack surface: the process accepts connections only from localhost, so no remote party can probe it. The codebase is small, MIT-licensed, and publicly auditable on GitHub.
- Silent background operation: it lives in the menu bar, consuming negligible RAM, and only wakes up when a signing request arrives.
Who should use BTCPayServer Vault?
If you are not running a self-hosted BTCPayServer instance, Vault is not for you — it has exactly one job, and that job is serving BTCPayServer's wallet UI. But if you are a BTCPayServer operator who wants to manage a hot wallet or co-sign transactions from a hardware device, Vault is the only sanctioned way to do it safely on macOS.
That audience skews toward independent merchants accepting Bitcoin directly, Bitcoin-native developers testing payment flows locally, and privacy-focused individuals running their own node. If you are evaluating custodial processors like Coinbase Commerce or Strike, this tool is irrelevant to your workflow.
Is BTCPayServer Vault free?
Yes — BTCPayServer Vault is completely free to download and use, with no premium tier, no telemetry subscription, and no usage caps. It is funded by the BTCPayServer Foundation and individual open-source contributors. The project is actively maintained alongside the main BTCPayServer repository, so it receives updates whenever the hardware wallet library or macOS APIs require changes.
What are the best BTCPayServer Vault alternatives?
Direct alternatives are narrow because Vault solves a specific integration problem. If your goal is simply viewing or signing Bitcoin transactions with a hardware wallet on a Mac, you would reach for the official Ledger Live or Trezor Suite desktop apps — both are polished, standalone, and do not require BTCPayServer at all. For a self-custody wallet with a richer Mac-native UI, Sparrow Wallet is the community favourite: it connects to hardware devices natively, supports your own node via Bitcoin Core or Electrum, and has a coin-control interface that rivals anything on the market.
The distinction is purpose: Ledger Live, Trezor Suite, and Sparrow are end-user wallets. BTCPayServer Vault is infrastructure glue — it exists so that a server application can securely delegate signing to a human holding a hardware device. They are complementary, not competing.
How does BTCPayServer Vault compare to browser-based hardware wallet access?
Modern browsers have inconsistent and increasingly restricted WebUSB support, particularly on macOS with Apple Silicon where driver behaviour changed in recent OS releases. Even where WebUSB works, it runs inside the browser sandbox with no persistent pairing, meaning you re-authorise the device on every session. Vault sidesteps all of that: it runs as a native process with stable USB access, handles device pairing once, and presents a clean local API. The result is noticeably more reliable — I stopped seeing "device not recognised" errors the moment I switched from the browser-native path to Vault.
What are the system requirements?
BTCPayServer Vault is distributed as a standard macOS application and runs on both Intel and Apple Silicon Macs via a universal binary. It requires macOS 10.14 or later. Installation via Homebrew Cask (btcpayserver-vault) is the easiest route and keeps it on your standard update path.
