iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The strongest practical setup is to generate a new wallet on a genuine hardware wallet, keep its signing keys inside the device, and protect the recovery phrase as an offline backup. Write the words down exactly, verify the backup using the manufacturer’s check, and store it somewhere private, durable, and accessible to you. The device reduces key theft from a compromised computer; it does not make phishing, malicious approvals, coercion, or a stolen phrase harmless.
What a hardware wallet and recovery phrase actually protect
Cryptocurrency is recorded on blockchains, not inside the hardware wallet. The wallet holds (or derives) the private keys that authorize transactions. Whoever can use those keys can generally move the assets associated with them.
A recovery phrase is a human-readable backup from which a wallet can regenerate its accounts and keys. It is therefore a wallet-wide credential, not merely a password for one device. Anyone who obtains the complete phrase may be able to restore the wallet elsewhere and control its funds. Conversely, a device PIN normally protects access to that particular device; it does not replace the phrase and cannot recreate a wallet after the device and backup are gone.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsA hardware wallet is designed to keep signing keys in a dedicated device and require an on-device approval before a transaction is signed. A connected computer can still display malware or a fake website, but the private key is not supposed to be exported to that computer. MetaMask’s official guidance recommends hardware wallets for long-term storage and says to create a new phrase on the hardware wallet rather than import a phrase that was already used in an internet-connected software wallet.
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
This is a reduction in one class of risk, not a guarantee. Ledger’s security guidance states: “Using a hardware wallet doesn’t make you invincible against social engineering, physical threats, or human error.” A user can still approve a malicious contract, reveal the phrase, be coerced, or send funds to a wrong address.
Before setup: establish a safe starting point
Buy and inspect the device
- Obtain the device through a trustworthy sales channel and use the current setup instructions for the exact model.
- Do not use a device that arrives with a preconfigured PIN or a prewritten recovery phrase. Ledger warns that a completed phrase or PIN can indicate a pre-owned or potentially tampered device.
- Keep the computer and phone used for setup reasonably up to date, but never type the recovery words into either one. A clean computer helps with phishing and malware risk; it does not turn an online note into a safe backup.
Decide whether you are creating or migrating a wallet
For a new offline key boundary, initialize the hardware wallet and let it generate a fresh phrase. Do not import a phrase that was previously exposed to an online software wallet: importing preserves the old exposure and defeats the isolation you intended to gain. If you are migrating funds, create the new hardware-wallet account first, then send funds from the old wallet to newly derived addresses after checking every destination.
Prepare a private recording place
Have the supplied paper or another offline recording medium ready before generation. Work where cameras, visitors, smart speakers, and shared screens cannot observe the words. The phrase should never enter a photograph, cloud drive, email, password manager, chat, browser form, or support ticket.
Recommended Free Tools
Initialize the hardware wallet safely
- Start from the device itself. Follow the manufacturer’s official initialization path. Select the option to create a new wallet, not to restore an existing one, when establishing a new key set.
- Set a device PIN. Choose a unique PIN that is not reused elsewhere. The PIN limits local access to the device; it is not the recovery secret.
- Allow the device to generate the phrase. Read the words from the device display or the approved setup flow. Do not substitute words from an old wallet and do not let a website generate the phrase for you.
- Record every word in order. Copy spelling and sequence exactly. Do not omit repeated words, add punctuation as if it were a word, or create a partial note. A single error can make restoration fail or lead to a different wallet.
- Complete the device’s confirmation quiz. Many devices ask you to select words from the phrase. Treat this as an initial transcription check, not as the only backup test.
- Finish setup in the official companion software. Pair the device only with the manufacturer’s genuine application or a wallet that explicitly supports that device and the assets you use. Verify the application’s download and update path independently rather than following an unsolicited message.
Never disclose the phrase to someone claiming to be support. A legitimate support representative does not need it to diagnose a device, and no self-custody provider can use it to “verify” ownership safely.
Rank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
Verify the backup before relying on it
A legible-looking card is not proof that the words were copied correctly. Use the manufacturer’s official backup-check feature or recovery test, if available. Trezor advises checking a newly created backup before destroying an older backup. Follow the exact model instructions; different devices may use different menus, confirmation methods, and backup formats.
- Perform the check on the hardware wallet or its approved offline workflow, never by typing the phrase into a computer or phone.
- Compare each word, its spelling, and its position. Do not “correct” a word based on memory or a web search.
- If the check fails, stop and resolve the discrepancy while the device still works. Do not assume that a nearly matching phrase will recover the account.
- After a successful check, keep the original record unchanged. If you make a second copy, transcribe it carefully and verify it independently.
Store the recovery phrase for secrecy and survivability
Choose access control first
Store the record offline in a place the owner can reach but an intruder is unlikely to discover. A locked container, private safe, or other access-controlled location can reduce casual discovery. Do not keep the phrase beside the device, in a desk drawer that many people can open, or in a location identified by a label such as “crypto seed.” Consider who could access the space during travel, a move, a medical emergency, or after death, and document an inheritance plan without writing the words into an online document.
Choose a medium that remains readable
Paper is inexpensive and easy to replace, but it can burn, become wet, fade, or tear. Ledger describes steel backup products as protection against environmental damage such as fire and water. A metal plate or capsule can therefore improve durability for a long-term physical backup. It does not provide secrecy: a person who finds and reads the metal record can restore the wallet. Concealment and access control remain necessary.
| Backup approach | Strength | Failure or exposure to plan for |
|---|---|---|
| Paper in a controlled location | Simple, inexpensive, easy to read and replace | Fire, water, fading, tearing, theft, and accidental disposal |
| Metal plate or capsule | Greater resistance to fire and water than ordinary paper | Still readable by anyone who finds it; can be lost, stolen, or corroded depending on material and storage |
| Two ordinary copies | Reduces the chance that one damaged copy is the only copy | Each copy is another opportunity for discovery; both must be kept private and synchronized |
Do not improvise a split phrase
Manually cutting the words into “part one” and “part two” is not automatically safer. Each fragment may reveal more information than expected, and losing one piece can make recovery impossible. If you need distributed storage, use a documented threshold format supported by your device. Trezor documents SLIP39 multi-share backups: in a 3-of-5 arrangement, any three of five shares can restore the wallet. Share counts, lengths, and supported options are specific to the format and device, not universal properties of hardware wallets.
Rank #3
- Unparalleled Security: Protect your assets with EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Multi-share Backup eliminates single points of failure for secure cold wallet recovery
Understand backup formats and compatibility
Do not assume every wallet uses the same number of words or can restore every other wallet. Trezor’s current knowledge base describes BIP39 backups of 12 or 24 words and SLIP39 backups of 20 words for supported devices. It also lists device-specific defaults that have changed for some models and dates, plus single-share and multi-share options. Ledger’s guidance describes 24-word phrases for Ledger devices, while MetaMask describes a 12-word phrase for its phrase-based wallet setup and notes that other wallets may use 18 or 24 words.
| Format or description | Published word/share detail | What the reader must verify |
|---|---|---|
| BIP39 | Trezor documents 12 or 24 words | Whether the destination wallet supports BIP39, the same derivation path, passphrase behavior, and the relevant assets |
| SLIP39 | Trezor documents 20-word shares for supported devices; multi-share thresholds can be configured, including a 3-of-5 example and up to 16 shares in its documented setup | Whether the restoring device supports SLIP39 and the exact share threshold and format used |
| Device-specific phrase | Some manufacturers document a 24-word default; software wallets may document 12, 18, or 24 words | The exact manufacturer instructions, model, firmware, and compatible wallet software |
Before buying a second device as a backup, confirm support for your assets and networks, the backup format, derivation paths, passphrase features, and the restoration procedure. A second device is not automatically compatible merely because it also uses words.
Use the device correctly for everyday transactions
- Connect only through a supported wallet application. Check the network and account shown in the application before beginning.
- Prepare the transaction on the computer or phone. Treat that screen as untrusted input; malware can replace an address or alter contract data.
- Compare the destination and amount on the hardware-wallet display. Approve only when the device display matches what you intend. For token approvals and contract calls, understand what permission is being granted rather than relying on a familiar website design.
- Confirm physically on the device. A click in the computer application is not the final authorization if the device requires an on-device confirmation.
- After sending, verify the transaction on the relevant blockchain explorer. This confirms what was broadcast; it cannot reverse a transaction sent to the wrong address.
Hardware isolation cannot protect a transaction that you knowingly or accidentally approve. Phishing sites can ask you to sign a malicious approval, fake support can request the phrase, and a criminal with physical access may threaten or coerce you.
Plan for loss, damage, and recovery
If the device is lost or destroyed
If the recovery phrase remains usable, restore it on a compatible hardware wallet or supported wallet application using the official recovery process. Confirm the format, word count, derivation settings, passphrase, and asset support first. A replacement device may show an empty account if you restored the wrong format, network, derivation path, or optional passphrase even when the words are correct.
Rank #4
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
If both the usable device and the recovery method are gone, a self-custody provider may be unable to recover the assets. MetaMask states: “MetaMask cannot recover your wallet for you.” That limitation is inherent to holding the keys yourself.
If the phrase may have been exposed
Treat the wallet as compromised. A phrase cannot normally be “unshared” or revoked. On a trusted hardware wallet, create a completely new wallet with a new phrase, then move assets to addresses derived from it. Check each destination on the device display and account for network fees, token contracts, staking positions, and approvals. Do not continue using the exposed wallet for convenience while assuming the attacker has not acted.
If only the PIN is forgotten
Follow the model’s official reset and restore procedure. A reset can erase the device, so proceed only when the recovery phrase and any required passphrase are available and verified. Never use a phrase supplied by a person or website offering “recovery assistance.”
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Common mistakes and their fixes
| Problem | Why it is dangerous | Safer response |
|---|---|---|
| Importing an old software-wallet phrase | The phrase may already have been exposed online | Generate a fresh phrase on the hardware wallet and transfer funds |
| Photographing or cloud-storing the words | Backups, account sync, or a breach can copy them | Keep the record offline and physically controlled |
| Entering words into a support form or website | The recipient can restore and drain the wallet | Use only the device’s approved recovery workflow |
| Trusting a preconfigured device | Someone else may know the phrase or PIN | Reject it and initialize a genuine, unused device yourself |
| Assuming metal means theft-proof | Durability does not hide the words | Combine durable material with discreet, access-controlled storage |
| Splitting words with scissors | A missing fragment can make recovery fail, and fragments may leak information | Use a documented threshold scheme supported by the device, or keep complete verified copies separately |
| Approving an unfamiliar contract | The hardware wallet signs what you approve, including malicious permissions | Reject unclear requests and review the on-device details |
How to choose a hardware-wallet and backup setup
There is no evidence-based universal “safest” model. Compare the characteristics that alter your own security and recovery process:
- Asset and network support: Confirm every coin, token, network, and account type you actually use.
- Backup format: Check BIP39 or SLIP39 support, word/share count, derivation paths, optional passphrases, and restoration on a second compatible device.
- Transaction display: Prefer a device display that lets you verify addresses, amounts, networks, and contract details before signing.
- Setup and recovery clarity: Read the current official instructions for initialization, backup checking, reset, firmware updates, and recovery.
- Physical and connection design: Consider display size, buttons or touch controls, USB or wireless connection needs, and whether the device can be used without exposing sensitive data to an untrusted host.
- Backup options: Determine whether the device supports an official backup check, multi-share recovery, or a documented second-device restore.
For the physical backup, compare resistance to fire, water, and corrosion; how easily you can record and later read the words; concealment; access control; and whether recording exposes the phrase to cameras or connected devices. A durable backup reduces damage risk, not theft risk.
Quick Recap
A practical security checklist
- Initialize the device yourself and reject any prewritten phrase or PIN.
- Generate a fresh phrase on the device instead of importing an online wallet’s phrase.
- Write every word in exact order and verify spelling.
- Run the manufacturer’s official backup check before relying on the record.
- Keep the phrase offline; never photograph, email, cloud-sync, or type it on an internet-connected device.
- Use discreet, access-controlled storage and consider a durable metal medium for environmental hazards.
- Do not manually split words; use a supported threshold format if distributed backups are necessary.
- Check transaction details on the hardware-wallet display before every approval.
- Verify asset, network, derivation, and backup-format compatibility before restoring to another device.
- If the phrase is exposed, create a new wallet and move funds promptly; assume the old wallet cannot be made safe again.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
