Setup walkthroughs

Setting up a Coldcard Q

What the Coldcard Q actually shows you during setup, with the parts that matter marked and the places this device is not like the others called out where they land. It has a full keyboard and a large colour screen, so you say yes with the ENTER key and type letter by letter, like a keyboard.

The screens you will see

Every screen below is a drawing, not a photograph of your device. It shows what the moment is for and what you have to do — not the exact pixels, wording or menu path, which change with every firmware release. Your device will look different and say the same things.

There are more screens than these. These are the four where the display in your hand is telling you something your computer is not allowed to tell you, and where reading it carefully is the entire security of the arrangement. The rest is menus.

What is different about the Coldcard Q

The steps further down are the same on every device we rate for cold storage. These are the places this one is not — each changes something you should actually do, and where one of them overrides a step, it says which.

• The PIN has two halves, with two words shown in between. Those words are yours and nobody else’s. Learn them at setup: if they are ever different, you are not holding the device you set up, and you stop before typing the second half.
• It can be driven entirely by camera and screen, so it never has to touch a computer at all. That is the strongest version of this setup and it costs nothing extra to choose at the start.

This device will also fold your own dice rolls into the randomness it uses, if you want it to. That is optional, it is covered under Roll your own seed, and skipping it costs you nothing — the device’s own randomness is not the weak part of anybody’s setup.

The setup, in order

The same order as Your checklist, because it is generated against it — if the two ever disagreed, this page would not build. Where the Coldcard Q does something different, it is called out above rather than quietly rewritten here.

1. 01 Check the seal before you power it on

   The box should be sealed and the device should be blank. If it ever shows you a seed phrase it has already generated, or hands you one on a card, it is compromised and you stop there. A device that arrives pre-loaded with someone else’s keys behaves perfectly right up until your coins leave.

   The rule behind it: rule 06

2. 02 Install the maker’s app, and let it install the firmware

   Type the maker’s address in yourself rather than following a search result — the paid results above a wallet download are a standing attack. Most of these devices ship with no firmware at all, and the app installing it is normal. What is not normal is any prompt, from the app or a website, asking for words you have not created yet.

   The rule behind it: rule 09

3. 03 Tell it to make a new wallet

   Not recover — that is the option beside it, and it is for a wallet you already have. What matters about this step is where the keys come from: they are made by the device, in front of you, out of randomness you did not choose and cannot predict, and nobody — including the maker — sees the result. That is the whole reason the device is worth what you paid for it, and it is over in about four seconds.

   The rule behind it: rule 06

4. 04 Write the words down while the screen still holds them

   The device shows the words once. Write them on paper, in order, by hand, with the device in front of you — and nowhere else. Not a photo, not a note, not a password manager, not “just to check.” This is the single moment on this page where a mistake is silent and permanent, and it is also the moment people reach for a camera.

   The rule behind it: rule 07

5. 05 Give the words back to the device

   It will ask for some of them back, and this is not a formality — it is the only check that happens between your handwriting and your money. It proves the device can read what you wrote, in the order you wrote it. It does not prove your backup works, because the words are still in the device’s memory while it asks. That proof comes later, and it is the step people skip.

   The rule behind it: rule 08

6. 06 Set a PIN on the device itself

   Somewhere around here the device asks for a PIN, and which side of the words it lands on depends entirely on the maker — before it will generate anything on some, after the backup is written on others. It genuinely does not matter, and a page that told you a firm order would be wrong within a release. What is worth being clear about is what the PIN is for: it stops a person who has picked up your device. It protects the hardware, not the wallet — anybody holding your written words does not need it and will never be asked for it.

7. 07 Read the receiving address on the device’s own screen

   Your computer shows you an address. The device shows you an address. Compare them, and treat the device as the one telling the truth. Malware that swaps a copied address for an attacker’s is ordinary, cheap and invisible on a screen the malware controls — and the little display in your hand is the one surface it cannot reach. This is the habit the whole device exists to make possible.

8. 08 Send a small test amount — and only a small one

   An amount you would shrug at. It confirms the address is really yours and that the wallet sees what arrives. It confirms nothing about your backup, so this is as far as the money goes until the restore below has actually been done.

9. 09 Check the paper, then put the words on metal

   Read every word back against the device once more, then move them to metal. Paper is the draft; it survives neither a fire nor a leaking roof nor twenty years in a drawer. The house guidance on which metal, and the tested failures behind it, sits under Metal backups in the Hardware & services menu.

   The rule behind it: rule 07

10. 10 Wipe it, and restore from what you wrote

    This is the step that makes the rest of it real, and it is the one almost nobody does. Reset the device to factory, then restore it from your own writing and nothing else — not the app’s copy, not your memory, not the card the device came with. If the test amount reappears, your backup works. If it does not, you have found that out today, for the price of a rounding error, instead of on the day the device dies.

    The rule behind it: rule 08

11. 11 Now move the rest

    Not before. Everything above this line is reversible for the cost of the test amount; everything below it is your savings. Move them in one go, verify the address on the device’s own screen again, and then leave the device alone — the whole point of cold storage is that the interesting part is over.

    The rule behind it: rule 03

Once the restore has worked and the money has moved, you are done and you should feel slightly anticlimactic about it — that is what a correct setup feels like. What is left is the once-a-year part, which is on Your checklist, and choosing not to add anything else for a while. If you are still deciding between devices, Hardware wallets compares them properly.