Paste an output descriptor (wsh(…) / tr(…)), a concrete policy, or a miniscript. It is lifted to a policy and rebuilt as blocks; recompiling may produce a different (often smaller) script.
wsh(…)
tr(…)
Name each signer so you can tell them apart. Compare each LifeHash and fingerprint with the device that holds the key.
Paste the extended public key exported by your hardware wallet or coordinator (Sparrow, Liana, Coldcard, Jade, Ledger, Trezor…). Public keys only: never paste seed words or private keys here, or anywhere online.
Load a Key Ownership Manifest (.kom.json): a list of public keys grouped by signer. Tick the signers you control, and every key in the design is labelled with its signer’s name: green for signers you control, blue for signers you know but don’t control, or unknown. A key that claims a known signer’s fingerprint and path but doesn’t match it is flagged as a conflict. Public keys only. The file stays in this tab’s memory: it is never saved, uploaded or put in share links. Format spec
.kom.json
Multi-vendor threshold multisig isn’t a silver bullet for self-custody on its own. Resilience comes from trading interactivity (how many parties must cooperate) for fault tolerance: fallback paths that give you a way out under the worst circumstances.
Miniscript makes those trade-offs expressible and analysable. This studio makes them visible: every block is a real spending condition, every wire a real logical relationship, and everything compiles live in your browser.
older(n)
after(n)
sha256(h)
Ownership loads a Key Ownership Manifest (.kom.json): your organisation’s public keys, grouped by signer. Tick the signers you control and every key in the design is labelled with its signer’s name: green if you control that signer, blue if you know it but don’t control it. A key from a known device but an unlisted account says other account, and anything else is unknown. A conflict means a key claims a known signer’s fingerprint and path but its key material is different: treat it as a possible key substitution. Paths then shows which spending paths you can sign alone. Click a badge to see the manifest entry next to the descriptor’s key. If the descriptor blinds the origin (a 00000000 or decoy fingerprint, a different path, or no origin), the key still matches by its key material. The true fingerprint, path and xpub are shown, and Restore true origin fixes the key without changing the script or addresses.
00000000
This is a design and learning tool. Demo keys come from public seeds. Verify any real wallet with your signing devices before funding it.