To set up a hardware wallet safely, buy it directly from the manufacturer, create a brand-new wallet on the device itself, write the recovery phrase on paper offline, set a PIN, and test with a small transfer before moving real funds. The device keeps your private keys isolated from your internet-connected computer, which is why it is a popular choice for long-term storage.
This checklist walks through every stage, from choosing where to buy to practising a recovery. If you are still deciding between storage types, read hot wallet vs cold wallet first, and keep seed phrase security open as a companion.
Key takeaways
- Buy only from the official manufacturer or an authorised reseller; never from second-hand listings.
- Generate the recovery phrase on the device. A phrase that arrives pre-written in the box means the device is compromised.
- Write the phrase on paper or metal, offline, and never type it into a computer, phone or website.
- Test the full process with a small amount, including a recovery on a spare device or the manufacturer’s tool, before storing serious value.
- Always verify the receiving address on the hardware wallet’s own screen.
What a hardware wallet does and does not do
A hardware wallet is a small dedicated device that stores your private keys and signs transactions internally. Your computer or phone sends it a transaction to approve; you check the details on the device screen and press a button; the signed result goes back out. The keys never leave the device. That design shields you from most malware on your computer.
It does not make you immune to mistakes. Your coins live on the blockchain, not in the device, so the real backup is the recovery phrase. If someone gets that phrase, they can empty the wallet without ever touching your hardware. And if you approve a malicious transaction on the screen, the device will sign it faithfully.
Before you buy: choose and source carefully
- Pick an established brand with a track record, regular firmware updates and support for the coins you hold. Check the supported-assets list on the maker’s site.
- Buy from the official store or a reseller the manufacturer lists. Marketplace listings, second-hand devices and unusually cheap offers are the classic route for tampered devices.
- Check the packaging for broken seals or signs of opening, and read the maker’s guidance on what intact packaging looks like.
- Never use a device that comes with a filled-in recovery card or a pre-set PIN. Genuine devices are blank when new.
Step-by-step setup checklist
- Prepare a calm, private place. Switch off cameras and smart speakers in the room, and make sure nobody is watching. Allow an hour without interruptions.
- Download companion software only from the official website. Type the address yourself or use a verified bookmark. Fake wallet apps are a common scam; see our guide to crypto phishing.
- Connect the device and check authenticity. Follow the on-screen check the manufacturer provides. If it fails, stop and contact support.
- Install or confirm the official firmware when the app prompts you. Read what the device screen says during the update.
- Choose “create a new wallet”. Do not choose restore unless you are deliberately recovering your own earlier wallet.
- Set a PIN on the device. Pick a number that is not a birthday or a simple pattern. A wrong-PIN limit will wipe the device after repeated failures, which is fine because your phrase restores everything.
- Write down the recovery phrase as it appears on the device screen. Use the numbered card supplied. Write clearly, in order, and check each word twice. Never photograph it.
- Confirm the phrase when the device asks. This proves you copied it correctly.
- Optional: enable a passphrase (sometimes called the 25th word) only if you understand it. It adds protection but is also a second secret you can lose; without it, funds are unrecoverable.
- Label and store the backup. Choose a secure, dry, fireproof place away from the device, and consider a second copy in a different location.
Test before you trust
Before moving serious value, run a rehearsal. This small effort is the single best protection against nasty surprises.
- Receive a small amount to your first address. Confirm the address on the device screen matches what the app shows.
- Send a little back out to another address you control, and check the transaction on a block explorer.
- Reset the device to factory settings, then restore from your written phrase. Confirm the same address appears.
- Only then move the amount you plan to hold.
Treat the test amount as an example of the cost of learning: network fees apply, so pick a sum that makes the exercise worthwhile without being painful if something goes wrong.
Where to store the backup, and where not
| Storage option | Verdict | Why |
|---|---|---|
| Paper in a safe or lockbox | Good for most people | Cheap, offline; vulnerable to fire and water |
| Stamped metal plate | Better for long-term | Survives fire and flood; still needs a hidden location |
| Photo or screenshot | Never | Cloud sync and malware can expose it |
| Password manager or notes app | Never | Online storage defeats the purpose of cold storage |
| Email to yourself | Never | Email is a prime target |
| Splitting into pieces | Use with care | Can reduce theft risk but raises risk of losing a piece and of mistakes; research recognised methods first |
Common setup traps to avoid
- Fake support and fake apps. Scammers run ads and social accounts that imitate wallet makers. A site asking you to “validate” or “sync” your wallet by typing the phrase is stealing it.
- Rushing the backup. Many losses come from a misspelt or out-of-order word that is only noticed years later. Take the confirmation step seriously.
- Keeping everything in one place. Device and phrase stored together mean one burglar gets both. The PIN helps, but separate locations are stronger.
- Forgetting the passphrase or PIN rules. Write down what you need to recover, and tell a trusted person where instructions are kept, without revealing the secrets themselves.
Most of these traps share one theme: pressure and haste. A genuine setup never needs to be urgent, so slow down whenever something feels rushed.
Habits that keep it safe afterwards
- Verify every receiving and sending address on the device screen, not only on the computer.
- Ignore any message, even one claiming to be from support, that asks for your recovery phrase. No legitimate company needs it.
- Keep firmware updated using the official app, and beware of pop-ups urging urgent updates.
- Be careful with token approvals and unknown websites. The device signs what you tell it to sign.
- Plan for the future: make sure a trusted person could recover your funds if something happened to you. See crypto inheritance planning.
Can a hardware wallet be hacked?
Attacks on well-made devices are difficult and usually need physical access, but no device is perfect. Most real-world losses come from stolen recovery phrases, fake apps and approving malicious transactions.
What happens if my hardware wallet breaks or is lost?
Your coins are safe on the blockchain. Buy a new compatible device, choose restore and enter your recovery phrase. This is why a correct backup matters more than the device.
Is it safe to buy a used hardware wallet?
Avoid it. A used or reseller-sourced device may have been tampered with or pre-configured by an attacker. Buy new from the manufacturer.
Do I need a hardware wallet for small amounts?
Not necessarily. For small sums a reputable software wallet can be reasonable. Many people move to hardware once the amount would hurt to lose.
Should I keep the recovery phrase on the device’s companion app?
No. Write it only on the offline card or metal backup. The app should never be asked to store it.
Next step: learn how addresses work in what a crypto wallet address is and prepare for the unexpected with crypto inheritance.
