How to set up MyEtherWallet for offline signing? (Maximum Privacy)

Offline Signing Fundamentals

1. Offline signing requires complete physical separation between the device generating the private key and any internet-connected system.

2. MyEtherWallet does not execute transactions directly on its interface when offline mode is used — it only generates unsigned transaction payloads.

3. The private key never leaves the air-gapped machine during the entire signing workflow.

4. Unsigned transaction data must be transferred via QR code, USB drive, or manual transcription — no network transmission is permitted.

5. A deterministic wallet derivation path (e.g., m/44'/60'/0'/0) must be consistently applied across both offline and online environments to ensure address compatibility.

Hardware Preparation Steps

1. Use a dedicated, factory-reset laptop or desktop with no persistent storage — boot from a clean, write-protected Linux live USB (e.g., Ubuntu 22.04 LTS).

2. Disable all wireless interfaces: Wi-Fi, Bluetooth, NFC, and cellular modems — physically remove or disable via BIOS if possible.

3. Install only essential tools: Node.js v18.x, MEW’s official CLI tool mew-cli, and a QR code generator library like qrencode.

4. Verify SHA256 checksums of all downloaded binaries against hashes published on MEW’s GitHub repository before execution.

5. Never connect the offline machine to any network — even briefly — after private key generation begins.

Transaction Payload Generation

1. On an online machine, prepare transaction details: recipient address, value in wei, gas price, gas limit, and data field (if interacting with a contract).

2. Export these parameters as a JSON object using MEW’s offline-transaction-builder module — ensure no private key or mnemonic appears in the output.

3. Encode the JSON payload into a QR code using a trusted open-source encoder; avoid web-based generators.

4. Transfer the QR code image to the offline device via air-gapped medium — printed paper or isolated display screen.

5. Scan the QR code using a local camera-equipped offline machine running mew-cli sign-offline with preloaded keystore or mnemonic.

Signature Finalization & Broadcast

1. The offline device returns a fully signed RLP-encoded transaction hex string — this contains v, r, and s signature components.

2. Encode the signed hex into another QR code for secure transfer back to the online environment.

3. Import the signed hex into MEW’s online interface using the “Send Offline Signed Transaction” option under the “Interact with Contract” tab.

4. Validate the decoded transaction fields — destination, value, nonce, and gas parameters — before final submission.

5. Broadcast the raw transaction via MEW’s integrated node or custom RPC endpoint; confirm inclusion using Etherscan or Blockchair.

Frequently Asked Questions

Q: Can I use MetaMask alongside MyEtherWallet for offline signing?A: No. MetaMask injects web3 into browser contexts and cannot operate in true air-gapped mode. Its architecture assumes continuous network access and exposes private keys to browser memory.

Q: Does MEW support BIP39 mnemonics for offline wallets?A: Yes. MEW accepts standard 12- or 24-word BIP39 phrases during offline key derivation, provided the same derivation path and password (if any) are reused across sessions.

Q: What happens if I lose the QR code containing the unsigned payload?A: You must regenerate the exact same transaction parameters — including identical nonce — on the online machine and repeat the full offline signing flow. Nonce reuse or skip will cause failure or fund loss.

Q: Is it safe to store the keystore file on the offline machine after signing?A: It is strongly discouraged. The keystore file must be deleted immediately after signing completes. Retention increases exposure risk if the device is later compromised or repurposed.