Before signing a Bitcoin PSBT, verify every output’s role, including the change that should return to your wallet. A correct recipient address does not establish that the remainder is also under your intended control. Review the transaction on the hardware signer, and stop if it cannot explain an output or presents an unexpected wallet-policy warning.
The recipient can be right while the remainder is wrong
A PSBT lets software assemble transaction information and pass it to a signer without moving the signer’s private keys into that software. It does not make the assembled transaction trustworthy. The computer creating the payment and the device approving it have different jobs. A convincing label on the computer is not the hardware signer’s verification of where the remainder goes.
The Bitcoin UTXO explanation covers why selected inputs are spent as whole outputs and why a payment can have change. Here the security question is narrower: does the output described as change belong to the intended wallet and spending policy? Do not answer it solely by checking that the amount looks like your expected remainder.
Consider a fictional transaction spending 100,000 sats. The intended recipient gets 30,000, the network fee is 1,000 and the remainder is 69,000. These are teaching numbers, not a current fee estimate. The arithmetic balances even if the 69,000-sat output is not controlled by your wallet. Correct totals therefore complement destination verification; they do not replace it.
Use a review worksheet for the whole spend
| Part of the fictional spend | Expected value | Verification question | Reason to stop |
|---|---|---|---|
| Selected inputs | 100,000 sats in total | Is this the intended wallet and spending context? | Unexpected account, inputs or signer context |
| Recipient output | 30,000 sats | Does the complete destination and amount match the agreed payment? | Address or amount differs from the independent instruction |
| Change output | 69,000 sats | Does the signer recognize the intended wallet policy for this remainder? | Unknown output presented as harmless change |
| Network fee | 1,000 sats | Does the displayed fee agree with the reviewed input-output difference? | Unexpected cost or a fee warning you cannot explain |
| Wallet policy | The policy you intended to use | For a shared wallet, are the expected participants and threshold represented? | New or unexplained policy registration or policy mismatch |
For a normal spend where the relevant input and output amounts are established, the miner fee is the input total minus the output total. Do not count the change as a fee. Do not subtract the fee twice because it appears on both the coordinator and the signer. If the two displays describe different totals or units, resolve the discrepancy before approving anything.
A change address can be unfamiliar because wallets derive additional addresses. Familiarity is therefore a weak test in either direction. ‘I have never seen this address’ does not alone prove theft, and ‘the software says change’ does not prove ownership. The useful evidence is how the signer checks the output against your wallet’s derivation and spending policy.
What PSBT metadata helps the signer verify
BIP174’s change-detection section describes using derivation information and public keys to recognize change. For a single-key output, the signer can derive and compare the relevant key. For a multiple-key output, it needs to consider the spending policy rather than recognizing one of its own keys and declaring the whole output safe.
In a shared wallet, change should remain under the intended shared policy. An output involving one familiar cosigner is not necessarily equivalent to the original arrangement. BIP388 discusses wallet policies and the challenge of reviewing change under complex scripts. The practical question is not whether a key appears somewhere, but whether the output preserves the control arrangement you meant to use.
The Ledger Bitcoin app’s wallet-policy documentation provides an implementation example: accounts are described through a policy template and key information. This is not a requirement to register a new policy every time you pay. An unexpected request to register a different wallet while making an ordinary payment deserves investigation, not automatic approval because the account name looks familiar.
A warning is evidence to investigate, not an obstacle to disable
COLDCARD’s transaction-review guide describes displaying destination amounts, fees and change, with specific alerts for fraudulent change and the wrong active key context. Those are that product’s documented checks. Do not assume every model, firmware or wallet integration shows identical screens or can recognize an arbitrary spending policy in the same way.
If a warning appears, cancel the signing attempt and preserve the unsigned transaction and the warning text for private troubleshooting. Check the selected account, passphrase context and supported wallet integration. A coordinator error or missing metadata can require rebuilding a request, but the proposed repair must explain the warning. Do not change a label, disable a safety check or enter a seed into a decoder merely to make the warning disappear.
Trezor’s change-address guide explains the wallet practice of returning the remainder to a wallet-controlled address. That helps explain a new address in a transaction, not identify an arbitrary address as yours. Use the manufacturer’s current supported review process rather than assuming an address with the expected prefix belongs to your wallet.
A signing procedure that leaves no unexplained output
- Start from an independently verified recipient instruction and the intended wallet account. Confirm the Bitcoin network and units.
- Create the PSBT through a supported coordinator without importing the hardware wallet’s recovery secret into that computer.
- Review the device’s payment destinations and amounts, then its change handling and the total fee. Inspect additional outputs rather than relying only on a summary.
- For multisignature or other custom accounts, verify the intended wallet policy and investigate any unexpected registration or mismatch.
- Reject an unexplained output, fee, key-context warning or changed transaction. Rebuild only after the cause has been identified.
- After the intended transaction is signed and broadcast through the supported workflow, verify its actual recipient, change and fee from the resulting transaction record.
A public PSBT decoder can expose transaction inputs, output amounts and wallet metadata even when it cannot spend the funds without signatures. Do not upload a wallet’s transaction package merely to find out what a warning means. Use supported local inspection or a trusted private support process, minimizing the material shared. Recovery words are never part of a PSBT review request.
Return to the fictional 100,000-sat spend. If the signer shows 30,000 to the correct recipient and an unexplained 69,000 output, the payment is not ready for approval. If it recognizes the intended change policy and the fee also matches the reviewed plan, those are meaningful checks. They still do not establish the legitimacy of the merchant or the condition of every component in the wallet setup.
For a no-account swap, the order’s BTC deposit instruction supplies the recipient context; it does not decide where the rest of your selected inputs should go. Keep those roles separate. The Bitcoin page provides asset background, while the signer must verify the spend you authorize. A swap quote, a familiar coordinator or an offline transfer method does not remove the need to review change.
FAQ
Can a Bitcoin PSBT decoder prove the change output is mine?
A decoder can display output data, but that alone does not establish your wallet’s control over the output. Use the signer’s supported verification of the intended wallet and policy, and avoid uploading private transaction metadata unnecessarily.
Does the PSBT format mean a Bitcoin transaction is safe to sign?
PSBT describes a transaction-information and signing workflow, not a security approval. You still need to verify the recipient, change handling, fee and relevant wallet policy.
Can a Bitcoin PSBT have a correct payment address and incorrect change?
Yes, checking the recipient does not establish where the remaining output goes. Reject unexplained outputs or policy warnings before signing.