Air-Gapped Hardware Wallets: 2026 Guide

An air-gapped hardware wallet never connects to your computer or phone by cable or wireless link. Transactions pass between them as QR codes or on a microSD card, so a compromised computer has no direct channel to the device. This guide explains how that works, which devices offer it and how to set one up. If you plan to combine several devices, see our hardware wallet multisig setup guide.

Air-gapping used to be awkward. Current devices make it easier with a camera for QR codes, a microSD slot and, on some models, optional NFC (a short-range radio link you can switch off). An air gap removes the USB or Bluetooth link as an attack channel, but you still check every transaction on the device’s own screen. If you are moving an existing wallet onto a new device, read our guide to moving a seed phrase between hardware wallets.

Some devices, such as the Coldcard Q, also have a full keyboard, which makes typing a long passphrase or restoring a seed phrase much easier than with a few buttons. An air gap does not stop malicious firmware from leaking your seed inside its signatures; our article on the Dark Skippy attack explains how that works and what stops it.

From Paper Wallets to Modern Hardware Cards

The methods for securing Bitcoin have progressed from basic paper wallets to increasingly sophisticated hardware solutions, each offering unique benefits and tradeoffs. Early solutions like paper wallets kept keys offline but were easy to damage and hard to spend from safely. Hardware wallets came next and balance security with usability far better.

More recent innovations have focused on making hardware-based security more accessible and user-friendly while maintaining robust protection. Modern solutions like smart cards and specialized Bitcoin storage cards leverage secure element technology - the same type of chips used in credit cards and secure government IDs - to provide hardware-level security in a familiar form factor. Signing cards such as TAPSIGNER create the key in the secure element and sign there, so normal use never exposes it to the phone or computer. Bearer cards such as SATSCARD hand a slot’s key to the phone or computer that unseals and sweeps it, so use a device you trust for that step.

Wallet Interoperability and Software Integration

Wallet interoperability has become increasingly crucial as the cryptocurrency ecosystem expands. Modern hardware wallets must seamlessly integrate with various software solutions, from desktop applications to mobile wallets. This compatibility layer is essential for providing users with flexibility while maintaining security. The ability to work with multiple software interfaces ensures that users aren’t locked into specific ecosystems and can choose tools that best fit their needs.

The implementation of different Bitcoin address formats represents a critical consideration in the compatibility of storage solutions with various wallet software and exchanges. Native SegWit addresses (starting with bc1q) are the usual default today and cost less to spend from than older formats; Taproot addresses (bc1p) are newer, so check that your wallet software and the services you use support the type you choose. Integration with the broader Bitcoin ecosystem requires careful attention to standards and compatibility, including support for various address formats, transaction signing protocols, and key derivation schemes.

Multisig and Advanced Security Configurations

Multi-signature (multisig) setups are a strong option for anyone securing significant savings. The ability to use multiple hardware wallets in a coordinated fashion provides an additional layer of security through distribution of trust. With a 2-of-3 threshold, no single key, lost or stolen, can cost you the coins, as long as each key comes from its own independently generated seed and you keep a copy of the wallet descriptor with every seed backup. In a 2-of-2, losing either key loses the coins.

Seed management and backup strategies represent another critical aspect of hardware wallet implementation. The ability to securely transfer existing seeds between devices or generate new ones with high-quality entropy sources is fundamental to maintaining long-term security. Best practices typically involve maintaining backup devices or seeds stored in geographically distributed locations, providing redundancy against device failure or loss.

The Future of Air-Gapped Security

The intersection of security and usability continues to drive innovation in the hardware wallet space. Features like secure elements, tamper-evident packaging, and robust firmware update mechanisms all contribute to a comprehensive security model. PSBTs (partially signed Bitcoin transactions, BIP 174) are already the standard way air-gapped devices exchange transactions with your wallet software, and some devices, such as the Coldcard, also support BIP-85 for deriving extra seeds from one master seed.

The continued evolution of Bitcoin storage solutions will likely focus on convergence between different approaches, combining the best aspects of air-gapped hardware wallets with modern smart card convenience. The integration of new communication protocols, enhanced display technologies, and improved user interfaces will shape the next generation of devices while maintaining backward compatibility with the evolving protocol and infrastructure.

Step-by-Step Guide to Setting Up an Air-Gapped Hardware Wallet

An air-gapped hardware wallet provides the highest level of isolation for your Bitcoin private keys by eliminating all direct electronic connections with networked devices. This guide walks through the complete setup and transaction signing workflow.

Step 1: Choose an air-gapped hardware wallet. Select a device specifically designed for air-gapped operation. Current options (November 2026): the Coldcard Mk5, which replaced the Mk4 and signs via microSD card (NFC is optional); the Coldcard Q, which adds QR codes through its camera and a full keyboard; the Keystone 3 Pro, which signs by QR code on a 4-inch touchscreen; and the Blockstream Jade, the most affordable option, which signs by QR code and can also use USB or Bluetooth (choose the original Jade or the Jade Plus: the newer Jade Core has no camera). Foundation’s Passport Core (QR and microSD) is no longer sold. SeedSigner (a Raspberry Pi Zero with a camera) and Krux (firmware for Kendryte K210 boards such as the M5StickV) are open-source do-it-yourself alternatives. Buy a ready-made device new, from the maker’s own store; Ledger vs Trezor and Beyond compares these devices with current prices.

Two ways across the air gap. QR codes: the device's camera reads a code on your computer screen, and the device shows the signed transaction as a code for your webcam; a big transaction plays as a short series of codes. Devices that do it: Coldcard Q, Keystone 3 Pro, Blockstream Jade (the original or the Plus; not the Jade Core, which has no camera), and SeedSigner or Krux if you build your own. microSD card: you save the transaction to the card, the device writes the signed file back to it, and you carry it home. Devices: Coldcard Mk5 and Coldcard Q, which has two card slots. Use one card only for this, and format it on the device. Several of these also have USB, Bluetooth or NFC: leave those links off, so the QR code or the card is the only link. — **Choose how your transactions will cross: by QR code or on a microSD card.** The Coldcard Q does both. A device with a cable or radio link can still be used air-gapped, as long as you leave those links off.

Step 2: Initialize the device in a secure location. Remove the device from its tamper-evident packaging and verify the integrity of seals. Power the device using batteries or a USB power bank (never a computer USB port). If the device asks for a PIN first, set a strong one now; a Coldcard does, and it supports PINs up to 12 digits. Before you create or restore a seed or deposit anything, check the installed firmware version and install the maker’s current signed release, following its own update guide (see the FAQ below). On a Coldcard, firmware updates require a PIN, and the current release is 5.6.3 for the Mk5 and 1.5.3Q for the Q (November 2026). Then follow the device prompts to generate a new seed phrase. On a Coldcard, current firmware asks for your own randomness (dice rolls, coin flips or key presses) before it creates the seed; choose dice. If a Coldcard made your seed on older firmware, read our Coldcard advisory: updating the firmware does not repair that seed. Write down the seed phrase on steel plates or archival paper immediately. Verify each word against the device display, then test the backup before your first deposit: the words you wrote must bring back this same wallet. If you add a passphrase, back it up exactly and separately from the words: the same words with a missing or mistyped passphrase open a different, empty wallet, with no error. Write down the master fingerprint the device shows once the passphrase is applied, then re-enter the passphrase and check that the same fingerprint appears before you deposit.

Step 3: Configure the wallet settings. If your device did not ask for a PIN in Step 2, set a strong one now. A Coldcard also offers a login countdown (a forced wait before it unlocks) and scrambled keys for entering the PIN. Leave its destructive trick PINs off unless you need them and have tested restoring from your backup: a Brick Self PIN destroys the device for good the moment it is entered. Configure the device for your preferred address type — native SegWit (bech32) is recommended for lower transaction fees and improved error detection.

Step 4: Export the public key to your coordinator software. On the hardware wallet, navigate to the export function and save the wallet’s extended public key (xpub) to a microSD card, or display it as a QR code. Import this public key into Sparrow Wallet or another coordinator application on your computer. The coordinator can now generate receiving addresses and construct unsigned transactions without access to private keys. The xpub cannot spend, but it shows your whole balance and history, so keep it private and out of third-party services.

Two sides of the air gap. Your computer, online and running Sparrow, holds only your public keys, the extended public key or xpub, which crosses the gap once, at setup. With it the computer can show your balance, make receiving addresses, build unsigned transactions and send signed ones to the network, but it can't sign, because it has no private key. Your hardware wallet, offline, holds the private keys made from your seed; they never cross the gap. It can show each receiving address, show what it will sign, and sign inside. Your words, on paper or metal, and your passphrase if you use one, can rebuild these keys. The xpub lets your computer watch and prepare; only the device can sign. The xpub can't spend, but it shows your whole balance, so keep it private. — **Your computer only ever sees your public keys.** That is enough to watch your wallet and prepare payments, but not to spend: every signature has to come from the device. Keep the xpub private all the same, because it shows your whole balance and history.

Step 5: Receive your first deposit. Use the coordinator software to generate a receiving address. Verify this address on the hardware wallet’s display by navigating to the address explorer feature. Only send funds to an address confirmed on both the coordinator and the hardware wallet screen. This dual verification prevents address substitution attacks.

Step 6: Sign a transaction using the air-gapped workflow. When you need to send bitcoin, create an unsigned PSBT (Partially Signed Bitcoin Transaction) in your coordinator software. Save the PSBT to a microSD card or encode it as a QR code. Transfer the PSBT to the hardware wallet via the microSD card or by scanning the QR code with the device’s camera. Review every transaction detail on the hardware wallet screen — recipient address, amount, and fee — before confirming the signature.

Step 7: Broadcast the signed transaction. After the hardware wallet signs the PSBT, export the signed transaction back to the coordinator via microSD or QR code. The coordinator software broadcasts the signed transaction to the Bitcoin network through your connected node or a public server. Verify the transaction appears in the mempool and is eventually confirmed.

One payment across the air gap. On your computer, which is online, Sparrow builds a PSBT: it lists the coin it spends, the address it pays and how much, and the fee, and its signature slot is empty. The unsigned PSBT crosses the gap as a QR code or on a microSD card. On the hardware wallet, which is offline, you check the address, amount and fee on its screen, and it signs inside. The same PSBT, now with a signature, crosses back the same way, and Sparrow sends it to the network. Your private key never crosses the gap. — **A PSBT crosses the gap twice: out without a signature, back with one.** The device signs exactly what its screen shows you, and the signature covers the whole transaction: if the computer changed anything on the way back, the signature would no longer be valid.

Step 8: Establish ongoing maintenance procedures. If your device runs on batteries, keep them charged or fresh. Check for firmware updates periodically and apply them following the manufacturer’s verified update procedure. Store the hardware wallet in a secure location when not in use, separate from your seed phrase backups.

Common Mistakes to Avoid

Connecting the hardware wallet to a computer via USB “just once.” A single USB connection opens a two-way data link that can carry far more than the transaction you see, and exposes the device to attacks on that link. Once you commit to an air-gapped workflow, maintain it consistently. Even brief connections undermine the security model that justifies the added complexity of air-gapped operation.

Using an unreliable microSD card for PSBT transfers. A failing card can corrupt the PSBT or the signed file, and the transfer then fails. Use a card from a well-known brand, formatted FAT32 (a Coldcard needs FAT32 or FAT12 and at least 512 MB), keep a spare, and replace any card that gives read or write errors.

Failing to verify addresses on the hardware wallet display. The coordinator software on your computer could be compromised by malware that substitutes addresses. Always verify the complete receiving address on the hardware wallet’s screen before sending any funds. This is the most critical step in the air-gapped workflow and should never be skipped.

Skipping the QR code or microSD card inspection. A microSD card can carry more than your transaction: a compromised computer could add other files to it, such as a fake firmware update. On the device, open only the PSBT you saved, and never start a firmware update you did not download and verify yourself; a genuine Coldcard installs no firmware that its maker has not signed. Keep one card just for this job, and format it on the hardware wallet rather than on your computer. A QR code can carry more than your transaction too: a Coldcard Q or a Jade also accepts a seed or a multisig setup by QR, so if the device offers to load or register anything when you meant to sign, cancel. A compromised computer can also put the wrong address or amount into the transaction, so check every detail on the hardware wallet’s screen before you sign.

Four things that could go wrong. Malware on your computer reaching the device through a cable or a radio link: the air gap stops it, as long as you never plug the device into a computer and leave NFC and Bluetooth off. Malware changing the address, amount or fee, or showing you a fake receiving address: the air gap doesn't stop it; check each address, amount and fee on the device's own screen. A compromised computer adding other files to the microSD card, such as fake firmware: the air gap doesn't stop it; open only the PSBT you saved, and the device installs only firmware its maker signed. Malicious firmware hiding your seed inside its signatures, the Dark Skippy attack: the air gap doesn't stop it; use genuine firmware on a device bought new from the maker. — **An air gap closes one way in, not all of them.** Whatever crosses the gap still has to be checked: the transaction on the device’s screen, the file you open from the card, and the firmware before you trust it.

Frequently Asked Questions

Is an air-gapped wallet significantly more secure than a USB-connected hardware wallet?

An air gap removes the USB or Bluetooth link, a two-way channel that can carry far more data than the transaction you see, and with it a whole class of attacks on that connection. The security improvement is most significant when combined with proper operational procedures. However, a USB-connected hardware wallet with a secure element still provides strong protection for most threat models, and the gap between any hardware wallet and a software wallet is far bigger than the gap between USB and air-gapped. An air gap also does not stop malicious firmware from hiding your seed inside the signatures it produces (the Dark Skippy attack), so it complements genuine firmware from a device bought from the maker rather than replacing it. Air-gapping is most valuable for high-value holdings or users facing advanced threat actors.

Can I use an air-gapped wallet for Lightning Network transactions?

Air-gapped wallets are designed for on-chain Bitcoin transactions. Lightning Network requires persistent online connectivity for channel management and routing, making it fundamentally incompatible with air-gapped signing. Use a separate, dedicated Lightning wallet for payment channel operations and keep your long-term savings in an air-gapped cold storage setup.

How do firmware updates work on an air-gapped device?

It depends on the device, so follow the maker’s own update guide. On a Coldcard, the update goes in on a microSD card: download the firmware file and Coinkite’s signed list of hashes on a computer, check the list’s PGP signature and then the file’s SHA-256 hash, copy the file to the card, insert the card into the device and follow its prompts. The Coldcard then checks the factory signature itself and installs nothing that a legitimate key has not signed. The Jade Plus takes a Blockstream-signed update as the .bin and .hash files on a FAT32 USB drive such as JadeLink or an SD card reader.

Related Resources

Part of our free Bitcoin course: This topic is covered in Hardware Wallets Explained: How Cold Wallets Protect Your Bitcoin, from the Bitcoin Wallets & Self-Custody course.

Filed under: Bitcoin Security