A hardware wallet is a small device that holds your Bitcoin keys offline. Your keys never touch your computer or phone, so malware on those devices can't steal them — every transaction has to be physically confirmed on the device itself. If you hold more bitcoin than you'd be comfortable losing, this is the standard answer.
Our position: we don't endorse or recommend one device over another — different tools fit different people, and reasonable members of our community use every wallet on this list. What follows is an honest tour of the leading options. Whatever you choose, buy it directly from the manufacturer, never from Amazon or eBay.
Trezor (Safe 3 / Safe 5)
One of the two original hardware wallet makers, fully open source hardware and software, with the most polished beginner experience in the category. The Safe 3 is one of the cheapest credible devices you can buy; the Safe 5 adds a color touchscreen. Both now include a secure element (an early criticism that's been addressed). Trezor supports other cryptocurrencies, which some Bitcoiners consider unnecessary attack surface — you can install Bitcoin-only firmware to strip that out.
Ledger (Nano S Plus / Nano X / Flex)
The best-selling hardware wallet in the world, with a strong secure-element design and support for everything under the sun. Two things you should know going in: Ledger's firmware is closed source, so its security is partly "trust us," and the 2023 announcement of Ledger Recover — an opt-in service that can extract an encrypted copy of your seed — upset many Bitcoiners because it proved the seed can leave the device. Millions of people use Ledgers without incident, but our community's enthusiasm cooled after that episode. Judge for yourself.
BitBox02 (Bitcoin-only edition)
From Swiss company Shift Crypto: small, understated, open source, with a dedicated Bitcoin-only firmware edition. Backup happens automatically to a microSD card, which removes a common beginner failure mode (writing the seed down wrong). USB-C only — no air gap — but a clean, well-audited design at a fair price. Something of a quiet favorite among people who want good security without a learning project.
Blockstream Jade / Jade Plus
The budget champion. Fully open source, Bitcoin-only, with camera-based QR air-gap operation similar to the Coldcard Q at a fraction of the price. Its distinctive trade-off: it has no secure element chip, instead using a novel "blind oracle" scheme where the PIN check happens against a Blockstream server (or your own, if you self-host). Clever design, small caveat, unbeatable price for an air-gapped device.
Coldcard Q
Under an active security advisory as of July 31, 2026. A firmware bug meant seeds generated on affected Coldcard firmware — all models, going back to March 2021 — had far less randomness than intended, and coins have been stolen as a result. Coinkite has shipped fixed firmware for every affected model. If you already own a Coldcard, read our explainer on the seed bug and check your device. If you're shopping for your first hardware wallet, this is a reasonable moment to wait and see how Coinkite's process changes in response.
With that said, here is the device on its merits. Coinkite's flagship and the most feature-dense option on this list: Bitcoin-only, air-gapped by design — it can operate with no cable at all, communicating through QR codes (it has a built-in camera and full QWERTY keyboard) or a microSD card. It supports duress PINs, brick-me PINs, seed vaults for multiple wallets, and about a dozen other power-user features nothing else matches. The physical security model — secure elements, tamper resistance, air gap — is still among the strongest in the category. The July 2026 bug wasn't a failure of that design; it was a failure to implement it correctly in firmware, which is arguably the more sobering lesson. The other trade-offs: it's one of the pricier options, the industrial calculator look isn't for everyone, and the sheer depth of features can overwhelm a first-time user. Pairs beautifully with Sparrow Wallet on desktop.
How to choose
- Bitcoin-only firmware means less code, fewer bugs, smaller attack surface. (Coldcard, Jade, and the Bitcoin-only editions of BitBox and Trezor.)
- Air gap (QR/microSD instead of USB) removes the cable as an attack path. Nice to have, not mandatory.
- Open source lets the world audit the code — but the label covers three quite different things on this page. Trezor, BitBox02 and Jade are genuinely free and open source. Ledger's firmware is closed. Coldcard sits in between: it was GPLv3 until 2020, when Coinkite relicensed to MIT plus a "Commons Clause" that bars selling or building a commercial service on the code. You can read every line and reproduce the build, but you can't freely fork it, and Coinkite itself now calls the firmware verifiable rather than open source. Worth knowing which one you're getting — and worth remembering that readable isn't the same as read. The Coldcard bug sat in a public repository for five years.
- Price matters less than practice. Any device on this list, used correctly, is a massive upgrade over coins on an exchange. The seed phrase on paper in your drawer is almost always the weakest link — not the device.
Still torn? Bring the question to a meetup. Odds are good that every device on this page will be in the room, and their owners will happily let you handle them before you spend a dollar.