Sovereign Bitcoin Toolstack Index

Remote front-end to your own Lightning node(s). Excellent when you already run LND/CLN and want full control from phone or desktop. Higher operational complexity: you must secure RPC endpoints, TLS, and Tor.

Android client focused on controlling your own LND node. Strong for operators who already understand LND; inherits every risk of your LND setup and is not a beginner wallet.

Mobile Lightning wallet running a lightweight node (Neutrino) on-device. High autonomy and privacy versus custodial apps, but depends on phone security and Neutrino. Treat as a serious hot wallet, not cold storage.

UX-first Lightning wallet with managed channels and on-the-fly swaps. Keys stay on device but channel management is outsourced. Ideal for small daily payments; trades topology control and some privacy for simplicity.

Modular, scriptable Lightning implementation. Ideal when you treat Lightning as programmable infrastructure. Requires disciplined ops for backups, plugins, and upgrades.

Library-first stack used to embed Lightning into your own apps or services. Perfect for building custom sovereign clients; all UX, safety, and backup responsibility resides with your implementation.

Production-grade LN implementation backing Phoenix and other ACINQ tools. Robust and battle-tested, but stewardship is centralized; good reliability, less governance diversity.

Widely deployed implementation with rich tooling. Also the default corporate/VC-aligned stack, likely early target for “safety” and capture attempts. Fine for experiments and liquidity; avoid making it your only dependency.

Self-hosted watchtower to protect channels from fraud. Treat as mandatory for serious Lightning operations; run on your own hardware, ideally behind Tor, and monitor it like any other critical service.

LND’s native watchtower stack. Good if you are already committed to LND. Use in parallel with other mitigations—multiple towers and regular channel backups.

Peer-to-peer swaps between Lightning and on-chain directly between nodes. Highly aligned with a sovereignty mindset; UX is still power-user-oriented and liquidity can be uneven.

Non-custodial submarine swaps bridging Lightning and on-chain. Great for inbound liquidity and non-KYC rebalancing. Dependence on a few servers: tactical tool, not an ultimate trust anchor.

Marketplace for non-custodial swaps. Adds price discovery and competition but also more counterparty behavior to model. Use with clear limits on exposure per trade.

Market-based coinjoin where you can earn yield as a maker. Most sovereignty-aligned of coinjoin options: no central coordinator. Complex configuration and strict hygiene (Tor, separate OS, careful coin labeling) are mandatory.

Coordinator-based Zerolink implementation with strong practical privacy. Coordinator and surrounding stack are high-profile legal targets; powerful but politically hot infrastructure. Use with clear threat modelling.

Payjoin support baked into BTCPay. You run the coordinator for your own merchant/payment flows. Excellent low-friction entropy injection for everyday transactions when both peers support it.

Coinjoin mechanisms focused on Lightning channels. Improves graph privacy by mixing with channel opens, but increases operational complexity. For operators who already understand Lightning topology well.

Run-it-yourself mempool visualizer and explorer. Canonical choice for sovereign fee estimation. Requires full node backend and hardware; removes reliance on third-party explorers once running.

Public instance of the same software with excellent UX. Treat queries as public metadata: useful for reference, not for private wallet lookups.

Self-hosted BTCPay with LNbits/BOLT extensions for POS. Only makes sense when you control the server: no SaaS. Audit every plugin, minimize bloat, and treat backups and monitoring as core business functions.

Policy-driven multisig and inheritance wallet. Ideal for flexible multisig schemes, time-locks, and inheritance flows. Watch any cloud-assisted features and keep independent backups of keys and descriptors.

High-control desktop wallet with excellent coin control and PSBT/multisig support. Combined with your own node over Tor, it is a strong default sovereign desktop wallet.

Official full node with integrated wallet UI. Minimal and conservative. Great as a reference wallet or cold-ish operator console; less UX polish than dedicated wallets.

Advanced policy wallet with strong focus on recovery and inheritance. Ideal for “if I disappear, unlock this way” logic. Newer codebase—use as one component in a multi-path recovery design, not as your only wallet.

Mobile companion to Nunchuck multisig/policy wallet. Works well as one key plus coordinator UI; avoid treating a single phone as the entire security model.

Veteran SPV wallet with many options. Sovereign setup means running your own Electrum server; default public servers are metadata-heavy and should not see your full history.

Flexible mobile wallet supporting onchain and Lightning. Confirm which mode you’re using (self-custodial vs custodial LNDHub) and ensure you control the backend when sovereignty matters.

Onchain wallet with clean UX. Good candidate for a small hot wallet; link it to your broader stack and avoid treating it as deep cold storage.

NixOS-based declarative Bitcoin stack. Extremely reproducible and auditable but comes with the Nix learning curve. Ideal for long-term, reproducible infrastructure.

Hardening-oriented guide for building a node on minimal hardware. More of a prescription than an appliance. Time-intensive but gives deep understanding of each moving part.

Scripted installer that automates node and service setup. Reduces manual work but adds trust in the automation scripts. Good halfway between DIY and turnkey appliances.

Sovereignty-focused OS and app platform for self-hosted services, including Bitcoin. Excellent UX for running many apps on one box; the platform itself becomes a key dependency, so keep export paths and migration plans.

Bitcoin Core fork with additional policy tweaks and features. Suitable for operators who need those extra knobs. Extra features mean extra attack surface; only run if you know why you want it.

Reference implementation around which the ecosystem orbits. Intentionally conservative about changes. Baseline full node for most stacks and the best starting point for validation.

Camera-based, stateless signer built from off-the-shelf parts. Best used as part of a multisig quorum, not single-device custody. Regularly test recovery, rotate seeds, and be willing to physically destroy/replace units.

DIY signing firmware for generic hardware like M5Stack. Ideal when you want many cheap, reproducible signers for multisig. Security depends on diversity and strict air-gapping; expect more tinkering.

Fully DIY hardware wallet from commodity parts. Maximizes transparency and rebuildability; ideal as a “ghost” signer in multisig. Requires comfort with sourcing hardware and flashing firmware.

Open-source Bitcoin (and Liquid) signer with camera and companion app. Supports air-gapped QR flows, though many users default to USB/Bluetooth—treat those as convenience modes. Best as one key in a multisig setup.

Bitcoin-only, security-maximalist device with strong air-gap flows (microSD, NFC, QR on newer models). Excellent paranoid anchor in a multisig arrangement. UX is opinionated; not ideal for total beginners without guidance.

Air-gapped, Bitcoin-only, open-source signer with phone-like form factor (screen, keypad, camera). Strong fit for visually verifying transactions via QR. Works well as the human-readable signer in a multisig set; keep firmware and supply-chain checks part of your routine.

Cashu wallet and client. Still effectively beta; treat as an experimental hot tool, not a savings vehicle. Expect breaking changes; keep balances small and disposable.

Command-line Cashu wallet. Perfect for scripts, servers, and terminal users. Powerful and flexible but demands more care and understanding than GUI wallets.

User-friendly Cashu wallet. Clean interface for interacting with mints, but still inherits full mint risk. Use as a convenience layer, not a long-term vault.

Web-style Cashu wallet. Very convenient, but web UIs are surveillance-heavy. Use hardened browsers and strong OPSEC if you care about privacy.

Mint associated with Minibits. Never treat any mint—including this one—as safe or permanent. Always spread balances, rotate funds, withdraw on-chain often, and test melts yourself. Reputation and scores are not insurance.

Cashu mint run by the Coinos crew. Combines e-cash privacy with platform risk of a specific operator. Keep balances small and rotated; assume web traffic is observable.

Cashu mint focused on Lightning flows. More moving parts (LN plus e-cash). Fun for experimentation; not suitable for large or long-lived balances.

Regionally focused Cashu mint. Valuable for constrained jurisdictions but adds geopolitical and operator risk. Same rule: diversify and rotate funds aggressively.

Clean UX gateway into Fedimint community mints. Federations spread risk across guardians, but funds are still custody. Use for community spending, not deep savings.

Fedimint wallet focused on simple user experience. Evaluate the federation’s governance, jurisdiction, and disaster plan before committing meaningful balances.

Large, brand-forward Fedimint implementation and wallet. Strong resources and UX but also most likely to be pulled into mainstream compliance regimes. Good for communities; never for irrecoverable savings.

Decentralized P2P exchange using multisig escrows and a DAO. Gold standard for non-KYC fiat ↔ BTC at scale. Requires patience, liquidity hunting, and understanding of disputes and arbitration.

Non-custodial escrowed P2P marketplace. Platform itself remains a centralized coordination point with business and legal risk. Clear trades quickly, avoid idle funds on offers, and assume the site could disappear.

Nostr-based P2P trading protocol. Highly aligned with decentralized comms: orderbook and negotiation over Nostr, settlement in BTC. Early and experimental; expect rough edges and low liquidity in some regions.

Tor-hidden P2P exchange with Lightning escrows and avatar system. Excellent for small, quick, relatively private trades. Lightning capacity and routing volatility make it unsuitable for very large transactions.

Custodial Lightning (and sometimes onchain) wallet and platform. Convenient and feature-rich but keys are not yours. Useful as a bridge or for experiments; never a long-term store of value.

Custodial Lightning wallet often used for micro-payments and onboarding. Frictionless UX for small amounts, but full surveillance and freeze/confiscation potential. Treat as pocket change only.