Set up a hardware wallet

What the device is for

A hardware wallet stores the private keys on a device that is not your everyday computer, and it asks you to confirm a transaction on that device's own screen or, for a card, on a flow that the card itself completes. The computer can be full of malware and still be unable to sign, as long as the keys never left the device and you refuse prompts you do not recognise. The computer remains able to lie about what you are about to confirm. Reading the device is the habit. Buying a particular brand is not.

This is a setup order, not a review. Prices, current model names, and certification stamps are omitted. The hardware overview page names the products in this set and points at their profiles. Ledger, Trezor, Keystone, BitBox, COLDCARD, and Tangem are not the same backup story. COLDCARD is Bitcoin-only. Tangem's usual setup does not show you a phrase at all. If a step below says 'write the words', it applies when the device shows you words. Skip it when the product's backup is extra cards, and do not invent a phrase the product did not create.

Buy it from the maker

Order from the vendor's own site, typed or bookmarked after you have read the host. A marketplace listing can be a used device, a resealed box, or a box that includes a printed recovery phrase 'for your convenience'. That printed phrase is the attack. Someone else may already hold the matching keys. A factory seal is a sticker. Stickers can be replaced. Treat an intact seal as a mild comfort and a pre-written phrase as a reason to refuse the device.

When the device powers on, it should offer to create a new wallet. It should not boot into a wallet that is already initialized, and it should not ship with words already filled in on a card you did not watch it generate. If it does, stop using it for real funds. Buy another from the maker, or follow that maker's published way to wipe and generate again, and assume the old words are compromised. This site has not bought each model this month and does not claim a hands-on unboxing. The rule is about what you observe on the device you are holding.

Generate the phrase on the device

Choose a new wallet in the device menu, or in the companion app while the device is connected and the words appear on the device screen rather than only on the computer. The standard phrase for many of these products is 12 or 24 words drawn from a published wordlist, commonly BIP-39. The device picks them. You write them down. You do not choose your own sentence, you do not 'improve' a word, and you do not let a website, a chat, or a support agent supply the words.

Write them in order, numbered, on paper or on a metal plate you are willing to store. The order is part of the secret. A word in the wrong slot restores a different wallet, or restores nothing. Check your handwriting while the device still shows the words. Then confirm the backup the way the device asks, which usually means entering the words back into the device, not into the computer. If the device offers a quiz, do the quiz. A phrase you have not proved you can read is a phrase you will misread later under stress.

Do not photograph the card. Do not type it into a notes app, a password manager, an email draft, or a form that says it will 'sync your hardware wallet to the web'. The moment the words exist on an internet-connected machine, you have built a hot wallet and called it hardware. Anyone who asks for the words is stealing them. The maker's support staff do not need them to replace a broken device. The words are how you replace the device yourself.

Where the paper lives

Keep one copy at home and another somewhere else that is not a cloud drive. Both are secrets. Splitting the words so each place holds a few of them is how people destroy a wallet by losing one place. If the device offers a formal split such as SLIP-39, follow its restore drill. Do not invent a scheme on a sticky note.

An optional passphrase, sometimes described as a twenty-fifth word, is extra text you add on top of the phrase. The plain phrase still opens a wallet. The phrase plus the passphrase opens a different wallet. The passphrase is not written on the card unless you decide to write it, and writing it on the same card removes the point of having it. If you forget it, nobody can recover that second wallet, including the vendor. Set it only after you have restored the plain wallet once and you understand that you are creating a second secret you must not lose. Skip it on the first afternoon if you are still learning the receive-address screen. A passphrase you set by accident and do not record looks exactly like a broken device.

Install the companion app from the right host

Ledger's companion is the Ledger Wallet app. Trezor uses Trezor Suite. Other makers ship their own. The names change, and the profile is where this site points at the vendor. Download from that vendor's host after you read it. Decline an installer that arrived as an email attachment or as a search ad. The URL guide is the longer version of that refusal.

The app builds the transaction. The device signs. Firmware updates belong in that official app, on a prompt the device also shows. A website you have not bookmarked, demanding the phrase in order to 'patch a vulnerability', is a theft page. Unplug the device and open the vendor from a bookmark. An air-gapped device, moving the transaction by QR code or a card, still needs you to read both screens. Keystone is in this set as that kind of product.

Confirm the receive address on the device

In the app, choose receive, select the asset and the network, and look at the address on the computer. Then look at the address on the device. They should match, character for character, or you should use the device's own QR code so the exchange or the other wallet scans what the device displayed. A compromised computer can show a substituted address on its screen while hoping you never check the device. This is the step that makes the hardware worth the trouble. Skipping it reduces the device to an expensive dongle.

If the device can hold several accounts, write down which account you used, on a note that does not include the phrase. A Bitcoin address, an Ethereum address, and a Solana address are different strings. Read the asset name on the device before you withdraw.

A first withdrawal you can afford to lose

From the exchange, withdraw a small amount to the address the device just displayed. Use the network the receive screen named. Wait for it to show up in the companion app as confirmed. If it does not appear, do not send a second, larger payment into the mystery. Check the network, the account, and the transaction id on a block explorer you opened yourself. A missing test is a puzzle with a cheap stake. A missing rent payment is not.

When the test is visible, send the amount you actually want to move, again from a fresh copy of the receive address on the device. Do not reuse an address from a chat, a PDF an employee mailed you, or a history line in the exchange that you did not just compare. After the larger send confirms, you can leave the device unplugged. The coins are not inside the device. They are on the chain. The device holds the keys that can move them next time. Losing the device is survivable if the phrase is real and stored. Losing the phrase and the device together is the end of that wallet.

Optional, and worth doing before the balance grows: wipe the device after the small test, restore from the paper, and confirm the same receive address comes back. That address is the proof the paper matches the keys. A different address means the paper is wrong. Do the wipe only when the words are in your hand and you accept that a mistake locks the test amount.

Seedless cards

Tangem's published setup generates keys in the card and keeps them there. The usual backup is one or more extra cards created at the same time, not a phrase you can write on paper. A phrase is optional in their own description, and if you opt into it you are back on the written-secret rules above. If you stay seedless, the cards are the backup. Lose every card and there is nothing to restore on a new device. Add the backup cards in the same sitting as the first card, before you deposit an amount you care about. Do not let a shop or a marketplace pre-link cards you did not see generated.

The phone app is still software. It can show you a payment request. The card has to complete the signature over NFC, which is the moment you are supposed to look at the phone and know which asset and which amount you agreed to. A card in your pocket does not review contracts. If a site asks you to tap in order to 'verify ownership' of an airdrop, that tap can be a signature. Refuse it with the same energy you would refuse a seed phrase form.

After the coins are there

You will be asked to sign again: a swap, a token approval, a contract call, a message login. The device makes the ask visible. It does not make the ask wise. Read the asset and the destination. For an approval, prefer a spender you recognise and an amount you understand. Unlimited approvals are a convenience that outlive the website you thought you were using. The drainer page is what that looks like when the website is hostile. The token checker is where a contract address can be read without connecting anything. The hardware wallet does not replace either one.

Update firmware from the official app, on a day you can read the prompt. If a prompt appears that you did not start, unplug the device and open the app from the bookmark. The PIN stops a casual finder. The phrase bypasses the PIN on a new device, so the phrase does not ride in the same bag as the hardware.

Questions

Can I set the wallet up on a computer I do not trust? You can generate the words if they appear only on the device and you never type them into that computer. You should not install random software beside the companion app, and you should not use a machine that already asked you for a seed once. If the computer is actively hostile, prefer a clean phone or a clean machine for the companion app. The device cannot tell that the address on the monitor was swapped if you do not compare it.

Is 24 words safer than 12? Both are standard lengths from the same wordlist idea. Twenty-four words is a longer secret. Twelve words is already a large space when the words were generated properly. The failure people actually hit is a photo of the card, a phrase supplied by an attacker, or a word written out of order. Length will not repair those. Use the length the device generated. Do not convert a 12-word phrase into a 24-word phrase yourself.

What if I already started with a phrase that came in the box? Stop. Do not send funds to it. Wipe the device using the maker's documented reset, create a new phrase while watching the screen, and discard the printed card. If funds were already sent to the pre-printed phrase, move them immediately to the new wallet you just created, from a computer you trust, and assume the old keys are in someone else's hands.

Does a hardware wallet protect a stablecoin from a freeze? It protects the keys. An issuer who can blacklist an address can still blacklist the address the device generated. You will see the freeze on the chain, and the device will not be able to talk the issuer out of it. Self-custody and a hardware device solve a different problem from a centrally issued token's admin key.

Do I need to practice a restore if the test deposit already arrived? The arrival proves the address you sent to was the one on the screen. A restore proves the paper in the drawer regenerates that address after the device is gone. They are different proofs. Do the restore when you can do it carefully, before the balance grows, or accept that your first real restore will be the day the device breaks.