Good fit: The friendliest to operate — a real keyboard and clear menus make passphrases and multisig the easiest to drive of any device here. Buy-once: one device covers single-sig, a passphrase, and multisig, so climbing the ladder never means new hardware.
✓ Bitcoin-only✓ Air-gapped~ Open-source✓ Reproducible build✓ Portable recovery
Watch out: The premium price of the group. Firmware is source-available (independently reproducible) rather than OSI-licensed open-source — a philosophical caveat for open-source purists, not a functional one.
Security advisory: Coldcard seeds generated between March 2021 and 31 July 2026 may be weak. Coins have been stolen. Check if yours is affected — read it →
Not recommended for purchase The rating below is unchanged and this device still clears our published standard. We are nonetheless telling you not to buy one right now — that is our own call, on the maker rather than the hardware, and here is the whole of the reasoning. Our reasoning, in full →
Single-sig Passphrase Multisig Full ladder, all first-class — buy-once, no new hardware as you climb.
Coldcard Mk5
Coinkite $170 Good fit: The pocket-sized, lower-cost Coldcard — the same dual secure element, air-gapped MicroSD signing, and Bitcoin-only open-source firmware as the Q, in a credit-card form factor. An excellent affordable multisig signer or travel key; USB-C + NFC for tap-to-sign.
✓ Bitcoin-only✓ Air-gapped~ Open-source✓ Reproducible build✓ Portable recovery
Watch out: A numeric keypad (not a full keyboard) makes typing a passphrase more of a chore than the Q, and there’s no built-in QR scanner (it air-gaps via MicroSD). Firmware is source-available rather than OSI open-source — verifiable, but a licensing caveat for purists.
Security advisory: Coldcard seeds generated between March 2021 and 31 July 2026 may be weak. Coins have been stolen. Check if yours is affected — read it →
Not recommended for purchase The rating below is unchanged and this device still clears our published standard. We are nonetheless telling you not to buy one right now — that is our own call, on the maker rather than the hardware, and here is the whole of the reasoning. Our reasoning, in full →
Single-sig Passphrase Multisig Full ladder; the numeric keypad makes passphrase entry more of a chore than the Q, but single-sig and multisig sign well.
Trezor Safe 3
SatoshiLabs $59 Good fit: The budget Trezor — two physical buttons and a small monochrome screen, but the same EAL6+ secure element, open-source firmware and optional Shamir backup as its pricier siblings. A solid hold-and-forget first wallet.
~ Bitcoin-only✗ Air-gapped✓ Open-source✓ Reproducible build~ Portable recovery
Watch out: Buttons and a tiny mono screen make passphrase entry and reading long addresses more of a chore than the touchscreen models. Multi-coin, and multisig is adequate rather than best-in-class.
Single-sig Passphrase Multisig Two-button entry makes a passphrase a chore; multisig is only adequate. A fine hold-and-forget starter.
Trezor Safe 5
SatoshiLabs $129 Good fit: The middle Trezor: a colour touchscreen makes passphrase entry and address-checking easy, with mainstream UX and native SLIP-39. The sweet spot if you want a touchscreen without paying for the flagship.
~ Bitcoin-only✗ Air-gapped✓ Open-source✓ Reproducible build~ Portable recovery
Watch out: Multi-coin, and multisig is adequate rather than best-in-class. USB-only (the Safe 7 adds Bluetooth and an auditable chip).
Single-sig Passphrase Multisig Single-sig and passphrase are easy on the touchscreen; multisig is only adequate (and it’s multi-coin).
Trezor Safe 7
SatoshiLabs $249 Good fit: The flagship — a big 2.5″ touchscreen, wireless (Bluetooth, even with an iPhone), and the headline feature: the first *auditable* secure-element chip (TROPIC01), paired with a second certified chip. For anyone who wants a vault chip open to outside inspection rather than a closed black box.
~ Bitcoin-only✗ Air-gapped✓ Open-source✓ Reproducible build~ Portable recovery
Watch out: The priciest Trezor at $249, and Bluetooth adds a wireless interface a USB-only or air-gapped device doesn’t have (every send still needs on-device approval). Multi-coin, and multisig is adequate rather than best-in-class.
Single-sig Passphrase Multisig The big touchscreen makes single-sig and passphrase easy; multisig is only adequate (and it’s multi-coin).
Good fit: Swiss, minimalist, fully open-source; an excellent multi-vendor multisig component.
✓ Bitcoin-only✗ Air-gapped✓ Open-source✓ Reproducible build✓ Portable recovery
Watch out: USB-connected rather than strict air-gap. Minimalist by design — few frills.
Single-sig Passphrase Multisig An excellent multisig component; passphrase on the touch-slider is the fiddly part.
Good fit: Genuinely good on a budget — the original $79 Blockstream device (plug-and-play, plastic body, jog wheel + one button beside the screen). Solid single-sig, workable multisig, and Unchained integration.
✓ Bitcoin-only✗ Air-gapped✓ Open-source✓ Reproducible build✓ Portable recovery
Watch out: No dedicated secure element (a "blind oracle" model), and no on-device camera — so it connects by USB or Bluetooth rather than air-gapped QR (the Jade Plus adds a camera + battery for that). Some multisig quirks.
Single-sig Passphrase Multisig Covers the ladder cheaply; the jog wheel makes passphrase and multisig fiddlier. Great to start.
Good fit: Blockstream’s beginner-focused device (launched April 2026) — guided setup through the Blockstream app, USB-C or Bluetooth, a Genuine Check authenticity test at setup, and the same fully open-source blind-oracle security as the rest of the Jade line.
✓ Bitcoin-only✗ Air-gapped✓ Open-source✓ Reproducible build✓ Portable recovery
Watch out: No camera, so no air-gapped QR signing (the Jade Plus adds that), and Bluetooth is present. No dedicated secure element (the blind-oracle model). New hardware — its track record is months, not years.
Single-sig Passphrase Multisig Built as a guided first device; passphrase and multisig work but are not its focus.
Good fit: The premium Jade — a metal body (six colours), a built-in camera for air-gapped QR signing, and a rechargeable battery, with the same open-source “blind oracle” security as the standard Jade. A nicer-feeling, air-gap-capable device without a big price jump.
✓ Bitcoin-only~ Air-gapped✓ Open-source✓ Reproducible build✓ Portable recovery
Watch out: Like the Core, it uses a "blind oracle" model rather than a dedicated secure element (Blockstream argues there’s nothing physical to steal from it). Bluetooth is present alongside the camera. Some multisig quirks.
Single-sig Passphrase Multisig Covers the ladder; left/right selection buttons make passphrase and multisig fiddlier, but the camera + battery make it a nicer air-gap unit than the standard Jade.
Built for spending → Good fit: A polished, US-assembled “security platform” — a big colour touchscreen with a keyboard, an independent audit (Keylabs), a strong default backup (2-of-3 Shamir across tap-to-read NFC keycards), and Bitcoin multisig up to 15 keys.
~ Bitcoin-only~ Air-gapped✓ Open-source✗ Reproducible build✓ Portable recovery
Watch out: It’s more device — and more money ($349) — than a first Bitcoin wallet needs: it also stores 2FA codes, passkeys and files and can run altcoin apps, so it isn’t the minimal Bitcoin-only signer this guide leans toward. It adds Bluetooth + NFC (so it’s not strictly air-gapped), and its firmware isn’t reproducibly buildable yet. Foundation retired the simpler $199 Passport, so this is now their only device.
Built for spending: A capable, secure device — but a general-purpose platform (it runs apps, stores files, 2FA and passkeys) is more surface than a long-term savings vault needs. Full reasoning →
Single-sig Passphrase Multisig Full ladder; a built-in keyboard makes passphrase entry easy, and it signs multisig up to 15 keys.
Built for spending → Good fit: Non-technical, mobile-first holders; the 2026 version now has an on-device touchscreen to verify transactions; built-in 2-of-3 recovery model.
✓ Bitcoin-only✗ Air-gapped✓ Open-source✗ Reproducible build~ Portable recovery
Watch out: Fingerprint-only unlock, and it still centers on its own app and 2-of-3 model rather than open multisig with other devices. The screened 2026 hardware is new — confirm current availability.
Built for spending: Clever and secure — a 2-of-3 with no single seed to steal, and Block can’t spend alone — but recovery and daily use lean on Block’s living servers and app, with no seed you hold on steel. Full reasoning →
Single-sig Passphrase Multisig Its own built-in 2-of-3 — a great first setup, but a DIY passphrase or multisig means different hardware.
Doesn’t clear our bar → Ledger Nano family
Ledger $79–$399 Good fit: Wide ecosystem support — the reason many people already own one. If that’s you, read the standard’s reasoning before relying on it for savings; your BIP-39 seed moves cleanly to a device that clears the bar. (Range spans Nano S Plus to the touchscreen Flex and Stax.)
~ Bitcoin-only✗ Air-gapped✗ Open-source✗ Reproducible build✓ Portable recovery
Watch out: Closed-source firmware; the 2023 Recover controversy and 2020 customer-data leak. Engage those before choosing it.
Doesn’t clear our bar: Its closed firmware has proven it can ship your single master seed off the device over the internet — so your safety reduces to trusting an unauditable black box. Full reasoning →
Single-sig Passphrase Multisig Covers the ladder, but closed firmware and the 2023 Recover episode are the real caveats.
No device matches every must-have.
Loosen a filter — in self-custody the best device is the one you’ll actually use, not the one that ticks every box. A “partial” badge still counts as a pass here; only a hard “no” removes a device.
