---
title: "How Does Multisig Work for Bitcoin? 2-of-3 Explained"
url: "https://bip39-phrase.com/multisig-work-for-bitcoin/"
language: "en"
published: "2025-07-20T00:00:00+00:00"
updated: "2026-10-19T00:00:00+00:00"
---

[ Wallets ](/topics/wallets/) Published July 20, 2025 Updated October 19, 2026 

# How Does Multisig Work for Bitcoin? 2-of-3 Explained

Читать по-русски: [Мультиподпись (multisig) в биткоине: как работает схема 2 из 3](/ru/multisig-bitkoin/) 

![How Does Multisig Work for Bitcoin? 2-of-3 Explained](/wp-content/uploads/2025/07/How-does-multisig-work-for-Bitcoin-hero.webp) 

A Bitcoin multisig wallet locks coins with a script that lists several public keys and how many of them must sign, written as M-of-N. In a 2-of-3 wallet, any two of the three keys can spend and no single key can, so a stolen key cannot move the funds and a lost key does not lock them. Each key is created on its own device, often a hardware wallet from a different maker, and kept in a different place. This guide explains how the script works, which setup to pick, how signing and backups work in practice, and what multisig costs.

## Multisig Setups at a Glance

| Setup  | Signatures needed | What it survives                     | Typical use                                           |
| ------ | ----------------- | ------------------------------------ | ----------------------------------------------------- |
| 2-of-2 | Both keys         | One stolen key, but not one lost key | Two people or devices that must both agree            |
| 2-of-3 | Any 2 of 3        | One lost key or one stolen key       | Personal savings, family funds, a service as cosigner |
| 3-of-5 | Any 3 of 5        | Two lost keys or two stolen keys     | Company treasuries and larger groups                  |

[Bitcoin.org’s security guide](https://bitcoin.org/en/secure-your-wallet) gives both kinds of example: an organization that lets its members reach the treasury only when 3 of 5 sign, and an individual who uses multisig so that a thief who compromises one device or location cannot steal the funds.

![Diagram of a 2-of-3 Bitcoin multisig wallet: three keys from separate seed phrases, a wsh(sortedmulti(2, …)) descriptor with three xpubs, the 105-byte witness script and a 62-character P2WSH address.](/images/diagrams/multisig-2-of-3.webp) 

2-of-3 multisig: any two of the three keys can sign, one cannot. Back up every seed phrase and the descriptor, because the address commits to all three public keys.

## How Does a Multisig Script Work?

Bitcoin has supported multisig since its early years. [BIP11](https://github.com/bitcoin/bips/blob/master/bip-0011.mediawiki) (2011) made M-of-N scripts standard in the form `m <pubkey> … <pubkey> n OP_CHECKMULTISIG`, with escrow (buyer, seller and a dispute agent in a 2-of-3) and wallet protection services (a 2-of-2 with a cosigning service) as its motivating cases. A spending transaction supplies the required signatures, and every node checks them against the listed keys; with fewer valid signatures than the threshold, the transaction is invalid.

Putting all the keys in the output made payments to multisig awkward, so [BIP16](https://github.com/bitcoin/bips/blob/master/bip-0016.mediawiki) (pay-to-script-hash, 2012) let the sender pay to a 20-byte hash of the script instead. The address starts with 3, and the full script, called the redeem script, is revealed only when the coins are spent. SegWit’s P2WSH does the same with a 32-byte script hash: its addresses start with bc1q like single-key SegWit addresses, but are longer, 62 characters instead of 42.

Two later standards matter for wallets:

- **Key order.** A script with the same keys in a different order gives a different address. [BIP67](https://github.com/bitcoin/bips/blob/master/bip-0067.mediawiki) sorts the public keys, so every compliant wallet derives the same address from the same keys and threshold; descriptors write this as `sortedmulti()` ([BIP383](https://github.com/bitcoin/bips/blob/master/bip-0383.mediawiki)).
- **Taproot.** [BIP342](https://github.com/bitcoin/bips/blob/master/bip-0342.mediawiki) disables `OP_CHECKMULTISIG` in Taproot scripts and adds `OP_CHECKSIGADD` for the same policies. [MuSig2](https://github.com/bitcoin/bips/blob/master/bip-0327.mediawiki) goes further for N-of-N setups: the signers combine their keys into one public key and produce one ordinary signature, so the spend looks like a single-key payment on chain.

## Which Setup Should You Use: 2-of-2, 2-of-3 or 3-of-5?

The threshold balances two failures: theft, which needs M keys, and loss, which happens once more than N − M keys are gone.

- **2-of-2** stops a thief who has one key but turns each key into a single point of failure: lose either one and the funds are stuck. It suits two parties who must both approve, provided both keep good backups.
- **2-of-3** is the usual choice for personal savings. You can lose one key, or have one stolen, and still keep the funds. [Sparrow Wallet’s best practices](https://sparrowwallet.com/docs/best-practices.html) for serious cold storage call for at least a 2-of-3 multisig, hardware wallets from different vendors, and devices and backups stored in different locations.
- **3-of-5** and larger quorums suit organizations, where no one person should be able to move funds and several can be unavailable at once.

A common variant is collaborative custody: you hold two keys of a 2-of-3 and a service holds the third, cosigning on request and helping with recovery. BIP67 describes this model, in which the user keeps one key offline as a backup, signs with the other, and lets the service cosign. Because the service cannot spend alone, the setup stays self-custody ([custodial vs non-custodial wallets](/custodial-vs-non-custodial-wallet/) explains the difference). Single-key alternatives, from hot wallets to hardware devices, are compared in the [hardware, software and multisig wallet guides](/topics/wallets/).

## How Do You Set Up a 2-of-3 Wallet?

1. **Create three keys on three devices.** Use separate [hardware wallets](/hardware-wallets-explained/), ideally from different makers, each with its own recovery phrase. Generating all three keys on one computer defeats the purpose.
2. **Export each device’s extended public key** for the multisig path. [BIP48](https://github.com/bitcoin/bips/blob/master/bip-0048.mediawiki) defines `m/48'/0'/0'/2'` for native SegWit (P2WSH) multisig as the recommended default ([derivation paths explained](/derivation-path/)).
3. **Combine the keys in a coordinator wallet**, such as Sparrow or Electrum ([Electrum’s multisig guide](https://electrum.readthedocs.io/en/latest/multisig.html) starts with File → New → Multi-signature wallet), and choose 2 of 3\. The coordinator now knows all three [extended public keys (xpubs)](/xpub-ypub-zpub/) and can generate the addresses, but it cannot spend.
4. **Check the first receiving address on every device’s screen.** [BIP129](https://github.com/bitcoin/bips/blob/master/bip-0129.mediawiki), the secure multisig setup standard, warns that an attacker who can change the multisig configuration can steal or ransom funds by tricking you into sending them to the wrong address.
5. **Test before funding.** Receive a small amount, spend it with two of the keys, and only then move savings in.

The keys and the threshold are fixed in the address. To change either, for example to replace a lost key, create a new wallet and move the coins to it.

## How Does Signing Work in Practice?

Signers rarely sit in one room. One wallet creates the unsigned transaction as a PSBT, the format defined in [BIP174](https://github.com/bitcoin/bips/blob/master/bip-0174.mediawiki), which carries everything a signer needs, so the signer can stay offline. The PSBT travels to the first device by USB, memory card or QR code, comes back with one signature, goes to the second device for another, and is then combined and broadcast. Electrum’s guide shows the same flow with a saved file, a QR code or its cosigner plugin.

Each device should show you the amount and the destination before you approve; that screen, not the computer’s, is what you trust.

## What Do You Need to Back Up?

- **Every key’s recovery phrase**, each stored separately. Keeping two phrases in the same drawer turns a 2-of-3 into a single point of theft.
- **The wallet configuration**: all three xpubs with their key fingerprints and derivation paths, the script type and the threshold, usually saved as one output descriptor. The address is a hash of a script that contains all three public keys, so two recovery phrases alone cannot rebuild it without the third xpub. BIP129 treats this configuration as data every signer must store.
- **A copy of the configuration with each key backup.** It cannot spend, but it shows the wallet’s whole history and balance, so protect it the way you would a bank statement.

If the funds should outlive you, the people inheriting them need to know where the keys and the configuration are and how to use them; see [crypto inheritance](/crypto-inheritance/).

## What Are the Downsides of Multisig?

- **Higher fees.** A 2-of-3 P2WSH input carries two signatures and the full script, roughly 105 virtual bytes against about 68 for a single-key native SegWit input, so each input costs about half as much again in fees. MuSig2 Taproot spends avoid this for N-of-N setups.
- **More to manage.** Three devices, three phrases and a configuration file mean more firmware updates, more backups and more chances to make a mistake.
- **Less privacy.** Spending from a P2SH or P2WSH address reveals the script, so multisig is recognizable on chain.
- **Compatibility.** Not every wallet can spend from multisig, and moving between coordinators works smoothly only if both read the same descriptor or configuration format.

## Frequently Asked Questions

### Is multisig the same as a Shamir backup?

No. A Shamir backup ([SLIP-39](/slip39-vs-bip39/)) splits one secret into shares that are reassembled on a device to sign, while multisig keeps the keys apart for good: each device signs on its own and the key is never assembled anywhere. [Cold sharding](/cold-sharding-method-private-key-storage-strategy/) compares the two in more detail.

### Can I turn my existing wallet into a multisig wallet?

No. A single-key address can only be spent by that key. Create the multisig wallet, then send your coins to one of its addresses.

### Does multisig protect against phishing?

Partly. A phishing page that steals one recovery phrase gets one key, which is not enough to spend. It does not help if you approve a malicious transaction on the required number of devices, so read every screen ([protecting your wallet from phishing](/protect-crypto-wallet-from-phishing/)).

[ Back to Blog ](/blog/)