The best Bitcoin wallets for privacy, after Samourai
A privacy wallet keeps your coins, your addresses, and your IP address from being stitched together by whoever runs the server you connect to or reads the blockchain.
Sparrow is the best Bitcoin privacy wallet for most people: coin control, labels, Tor, your own node, and silent payments, and it works with nearly every hardware wallet I rank. It has had no CoinJoin since 2024, so for mixing use JoinMarket NG (or Jam, its web interface), which has no central coordinator, or Wasabi with a third-party coordinator. Mix in a hot wallet, then send the coins to a fresh address on a hardware wallet.
Disclosure: I work at Blockstream, the company that makes the Jade wallets mentioned here. I joined after many years as a satisfied user. There are no affiliate links on this site.
What a privacy wallet does
Bitcoin is a public ledger. A privacy wallet gives you tools to keep the links between your coins from piling up. My guide to coin control, silent payments, and CoinJoin explains each technique in detail. In short:
- Coin control and labels: you choose which coins pay for each transaction, so you never accidentally spend a coin from a KYC exchange alongside one bought privately.
- Your own node: a wallet that asks someone else's server about your addresses tells that server which addresses belong together. Electrum's own FAQ says the client sacrifices some privacy to the server for this reason.
- Tor: hides your IP address from the server and the network.
- Silent payments (BIP352): one reusable address that produces a fresh on-chain address for every payment.
- CoinJoin: many people combine coins into one transaction with equal-value outputs, which breaks the trail from input to output.
I only rank Bitcoin-only, open-source wallets that do at least two of these. The privacy you get also depends on where the coins came from: see my guide to buying bitcoin without ID.
Best Bitcoin privacy wallets compared
| Rank | Wallet | Platform | CoinJoin | Own node | Tor | Silent payments | Hardware wallets | Latest release |
|---|---|---|---|---|---|---|---|---|
| 1 | Sparrow | macOS, Windows, Linux | No (removed in 1.9.0) | Bitcoin Core or Electrum server | Built in | Send and receive | Yes, USB and QR | 2.5.6, Oct 29, 2026 |
| 2 | JoinMarket NG | Command line or terminal menu | Yes, no central coordinator | Bitcoin Core or Neutrino | Built in | No | No (hot wallet) | 0.43.0, Nov 5, 2026 |
| 3 | Jam | Web app on a node | Yes, through JoinMarket NG | Runs on your node | Through JoinMarket NG | No | No (hot wallet) | v2.0.0-beta.4, Sep 30, 2026 |
| 4 | Electrum | Windows, macOS, Linux, Android | No | Your own Electrum server | Through a proxy | No | Yes, desktop | 4.8.4, Nov 6, 2026 |
| 5 | Wasabi | Windows, macOS, Linux | Yes, third-party coordinators | Yes | All traffic | Send only | Yes, but not for CoinJoin | v2.8.5, Oct 27, 2026 |
| 6 | Ashigaru | Android, plus a terminal app | Yes, Ashigaru Whirlpool | Your own Dojo | Built in | No | No | Mobile v1.2.0, Nov 4, 2026 |
Software wallets have no review pages on this site, so each name links to the project itself. My privacy tools page rates CoinJoin tools alongside VPNs and messengers.
1. Sparrow: best privacy wallet for most people
Sparrow connects straight to your own Bitcoin Core node or to an Electrum server such as Fulcrum or Electrs, over SSL and built-in Tor. Every transaction, input, output, and address can be labelled, and coin control lets you pick exactly which coins a payment spends. It also handles payjoin, and version 2.5.6 added a check that verifies payjoin receiver input signatures.
Silent payments arrived in two steps: sending in 2.3.0 (October 2025) and receiving wallets in 2.5.0 (May 2026), including support for air-gapped hardware wallet signers.
What it no longer does: CoinJoin. Version 1.9.0, released April 25, 2024, removed the Whirlpool client after the Samourai shutdown. Plenty of "best privacy wallet" pages still say otherwise. My Sparrow setup guide walks through verifying the download and connecting your own node.
2. JoinMarket NG: CoinJoin with no coordinator
JoinMarket organizes CoinJoins as an open market. Makers offer liquidity and earn fees, and takers start a CoinJoin whenever they want and pay the makers they pick. Per JoinMarket NG's README, there is "no single service that schedules every round, selects every participant, or holds users' funds."
JoinMarket NG is an independent, MIT-licensed implementation that is wire-compatible with the original, so both share one market. It runs on Bitcoin Core or a lighter Neutrino backend, with Tor throughout. The original joinmarket-clientserver repository is archived after its last release, v0.9.12, in April 2026, and its README now says "DO NOT USE THIS CODE." It also warns that every release with PayJoin (v0.7.0 through v0.9.12) can let a malicious receiver take the full value of the coins you spend in a payjoin send.
The limit: you run it from the command line or a terminal menu. If that sounds unpleasant, Jam is the browser interface.
3. Jam: JoinMarket with a web interface
Jam is a web interface for JoinMarket NG, and its README lists node platforms such as Umbrel, Start9, RaspiBlitz, and Citadel. If you already run a node at home, Jam is the easiest way into JoinMarket's maker and taker market.
The limit: the README says "Jam is beta software. Use with caution," and the current release is v2.0.0-beta.4. Start with small amounts.
4. Electrum: coin control and your own server
Electrum has done coin control for years: you can freeze addresses so they are never spent, and you can run your own server instead of trusting a public one. Its docs cover routing it through Tor with a proxy. It has no CoinJoin and no silent payments.
Update to 4.8.4. The 4.8.3 security release fixed a high-severity flaw where a malicious server could replace a just-broadcast transaction and try to trick you into fee-bumping it, which is one more reason to connect only to a server you run.
5. Wasabi: CoinJoin on the desktop, with third-party coordinators
Wasabi routes all traffic through Tor, syncs with compact block filters instead of asking a server about your addresses, and mixes coins with the WabiSabi protocol. It is desktop only. zkSNACKs, the company that built it, stopped running its own coordinator on June 1, 2024, so you now pick a third-party coordinator. Wasabi's FAQ lists ways to find one: Wasabi Nostr, which reads coordinator announcements from Nostr relays, and community statistics sites such as Liquisabi and Wabisator.
Version 2.8.5 removed support for sending BIP78 payjoin transactions "to reduce code complexity and attack surface." Wasabi can still send to silent payment addresses.
The hardware wallet catch: Wasabi supports hardware wallets through HWI, but its FAQ says you cannot CoinJoin coins on a hardware wallet, because the keys need to be on a hot computer. You mix in a hot Wasabi wallet, then send to a new address on the hardware wallet. Those coins show an anonymity score of 1 there, because that wallet does not know their CoinJoin history, so label them when you receive.
6. Ashigaru: where the Samourai users went
Ashigaru was set up after the Justice Department charged Samourai Wallet's founders. Its anonymous team describes itself as former Samourai users with "no association or relationship with the core team." The code is GPLv3, and the code repository is reachable over Tor only.
It ships two apps from ashigaru.rs/download: Ashigaru Mobile for Android (v1.2.0, November 4, 2026) and Ashigaru Terminal (v1.0.0, June 23, 2025), a terminal app for joining CoinJoin pools. The download page says you need Tor Browser to download either one. The mobile app talks to a wallet server you run yourself (Dojo), and the docs cover setting one up.
On June 23, 2025, Ashigaru relaunched Whirlpool, the Zerolink CoinJoin protocol Samourai used. Ashigaru Whirlpool is Tor only, runs 0.25 BTC and 0.025 BTC pools, and charges an anti-Sybil fee fixed at 5% of the pool size (0.0125 BTC to enter the larger pool).
A separate build called "Ashigaru Desktop" sits on a personal GitHub account. Ashigaru's official site does not link it, so I don't either. Download only from ashigaru.rs and verify the signature it publishes. The limit: Android only, a Dojo to run, and a 5% entry fee.
Which hardware wallet to pair with it
Every CoinJoin wallet above is a hot wallet. Mix there, then send the coins to a fresh address on a hardware wallet and label them. Sparrow, Electrum, and Wasabi can also act as the coordinator for a hardware wallet day to day.
For the hardware itself, the privacy leaks sit around the device: the companion app's default server, any data the app sends home, and the shop's customer list. Here is how the devices I rank compare, in ranking order.
| Rank | Device | Companion app and default server | Own node and Tor | Air-gapped signing | 2026 customer-data incident |
|---|---|---|---|---|---|
| 1 | SeedSigner | None. You pair it with a coordinator such as Sparrow | Through your coordinator | Yes, QR | None: you buy generic parts |
| 2 | Jade Plus | Blockstream app. In PIN mode, unlocking uses Blockstream's blind oracle unless you run your own | Tor toggle in the app, or use Sparrow on your node | Yes, QR | None in my log |
| 3 | Krux | None. Firmware for off-the-shelf K210 devices | Through your coordinator | Yes, QR | None: you buy off-the-shelf hardware |
| 4 | Jade | Blockstream app, same oracle model as Jade Plus | Tor toggle in the app, or use Sparrow on your node | Yes, QR | None in my log |
| 5 | Specter DIY | None. Pairs with Specter Desktop or Sparrow | Through your coordinator | Yes, QR | None in my log |
| 6 | Jade Core | Blockstream app, same oracle model | Tor toggle in the app | No: USB or Bluetooth (no camera) | None in my log |
| 7 | Passport Prime | Envoy, connected to Foundation's server by default | Personal node option and a Tor toggle in Envoy | QR after setup (setup uses Bluetooth) | Phishing from Foundation's domains with order tables reachable (October) |
| 8 | BitBox02 Bitcoin-only | BitBoxApp, on Shift's servers by default | "Connect your own full node" and a Tor proxy setting | No: USB | Newsletter list exposed, email addresses only (September) |
SeedSigner leaves the smallest trail. It is an air-gapped, stateless signer you build from inexpensive, publicly available parts, with no WiFi or Bluetooth hardware on the recommended board, and no company holds a customer record for it. Krux has the same advantage. Compare them in Krux vs SeedSigner.
Jade Plus is the best assembled device for privacy. The Blockstream app's analytics are opt-in, and Blockstream lists what it never collects, including addresses, balances, and key material. With a SeedQR, Jade Plus also works as a stateless signer that needs no PIN and no contact with the companion app.
For Passport Prime, Envoy's privacy page lets you pick a personal node, and once you do, Envoy will not fall back to Foundation's server. Its Magic Backups send settings and metadata to Foundation's servers, so turn them off if that bothers you. For BitBox02, the BitBoxApp's settings take your own Electrum server, and the app's own instructions say your node is only added as a redundancy unless you remove the default servers. Compare the assembled options in Jade Plus vs Passport Prime and BitBox02 vs Jade Plus.
Whichever device you pick, the companion app is the leak. Point it at a server you run: my guide to running your own node covers the setup. Looking for Coldcard? I no longer recommend it; see the Coldcard advisory.
Buy it privately
A hardware wallet order puts your name and home address on a company's customer list. In 2026 several of those lists leaked:
- Ledger: customer names, contact details, and order details exposed through its checkout partner Global-e (January).
- Trezor: its shipping provider ShipMonk exposed 80,689 customers (August).
- SafePal: an order-tracking plug-in exposed 39,798 customers (August).
- Keystone: a website breach took 25,964 buyer records (October).
- BitBox and Foundation: the newsletter and phishing incidents in the table above.
The full list, with sources, is on my security incidents page. The fixes are simple: build a SeedSigner or Krux from parts bought at a general electronics shop, ship to a pickup point instead of your home, and treat any email, letter, or call about your wallet as phishing. Never type a seed phrase anywhere but the device itself.
Legal facts
On April 24, 2024, federal prosecutors in New York charged the founders of Samourai Wallet, which ran the Whirlpool CoinJoin service. Samourai's servers were seized or went offline. In November 2025 they were sentenced to five and four years in prison after pleading guilty to conspiring to operate a money transmitting business that knowingly transmitted criminal proceeds. About a week after the charges, zkSNACKs announced it would stop running Wasabi's coordinator from June 1, 2024.
The law differs by country. Most of Bitcoin privacy is ordinary practice: run your own node, never reuse addresses, and keep coins from different sources apart. Using any of these tools to move the proceeds of a crime is money laundering, and nothing here is advice on avoiding reporting or law enforcement. If you are unsure how your local law treats CoinJoin, ask a lawyer before you use one.
Not ranked (contrast)
| Product | Why it is not ranked |
|---|---|
| Samourai Wallet | Shut down in April 2024 after its founders were charged. |
| Original JoinMarket (joinmarket-clientserver) | Archived, with a do-not-use warning and an unpatched payjoin send flaw. |
| Bitkey | A good beginner wallet and a weak privacy wallet. Bitkey is 2-of-3 with a server key held by Block, and it requires a notification channel such as email. On wallets with its private wallet update, Block cannot see your transactions or balance except for a momentary view when its server co-signs, and you can set a custom Electrum server (SSL required). |
| Cake Wallet, Zashi, Feather, and other Monero or multi-coin wallets | Multi-coin. Altcoin privacy coins have no place near your bitcoin. |
| Zengo, Atomic Wallet, Exodus, Ledger Live | Multi-coin apps that show up on other "anonymous wallet" lists. |
Frequently asked questions
What is the most private Bitcoin wallet?
For most people, Sparrow connected to your own node over Tor, with coin control and labels, and a hardware wallet signing. For CoinJoin, JoinMarket NG has no central coordinator, and Wasabi mixes through third-party coordinators.
What is the best Samourai Wallet alternative?
Ashigaru is the closest match: an Android wallet and terminal app that relaunched Whirlpool in June 2025, downloaded only from ashigaru.rs. For CoinJoin without a central coordinator, use JoinMarket NG or Jam.
Does Sparrow still do CoinJoin?
No. Sparrow 1.9.0 removed the Whirlpool client in April 2024. It still offers coin control, labels, Tor, payjoin, your own node, and silent payments.
How do I find a Wasabi coordinator?
Wasabi's FAQ lists Wasabi Nostr, which reads coordinator announcements from Nostr relays, and community statistics sites such as Liquisabi and Wabisator. Coordinators can also advertise themselves. Wasabi says to use those sites with caution.
Is JoinMarket still maintained?
The original joinmarket-clientserver is archived and warns not to use it. JoinMarket NG is an independent, wire-compatible implementation that ships regular releases, and Jam now runs on top of it.
Is Ashigaru safe to download, and where?
Download it only from ashigaru.rs, using Tor Browser as the download page requires, and verify the signature the site publishes. Skip builds hosted on personal GitHub accounts that the official site does not link.
Is CoinJoin legal?
It depends on where you live. In the US, running a CoinJoin service led to prison sentences for the Samourai Wallet founders in 2025. Check your local law, and ask a lawyer if you are unsure.
Are hardware wallets anonymous?
Not by default. The companion app tells its server which addresses are yours unless you connect your own node, and buying one puts your address on a customer list. SeedSigner and Krux avoid the customer list because you build them from generic parts.