Guides ยท 7 parts in reading order
Holding your own keys, explained
Plain-language guides to cold wallets, seed phrases and self-custody, written from primary sources and linked to the datasheets they mention. Read them in order or start with the question you have.
- Parts
- 7
- Reading time, all
- 51 min
- Words
- 11,759
- Last revised
- Basis
- Reading time at 230 words a minute
-
Part 1: What is a cold wallet?
A cold wallet holds the private keys that control your crypto on something that is not connected to the internet, typically a physical device such as a hardware wallet. With a hardware wallet or an offline computer, transactions are prepared on an online phone or computer, then checked and signed on the offline device, so the keys stay off the internet-connected machines that malware targets. A key kept on paper cannot sign; it has to be loaded into software to spend.
-
Part 2: Cold wallet vs hot wallet
A hot wallet keeps your private keys in an app on an internet-connected phone, computer or browser, while cold storage keeps them offline; a hardware wallet, one kind of cold wallet, signs transactions on a separate device. Hot wallets are quicker to use and may be free to install; cold wallet devices typically cost money and add a step, but keep the keys off the devices you use for everything else.
-
Part 3: Seed phrases: what they are and how to store one
A seed phrase, also called a recovery phrase, backs up a wallet's master secret: 12, 15, 18, 21 or 24 words under BIP39, or SLIP-39 shares of 20 or 33 words. Anyone who holds it (plus the passphrase, if one is set; for SLIP-39, enough shares to meet the threshold) can restore the wallet on a compatible device and spend from it. Store it offline on paper or metal, in more than one place you control, and never photograph it, put it in cloud storage or type it into a website.
-
Part 4: Is Ledger safe?
None of the Ledger incidents we track shows keys extracted from a set-up, PIN-locked device: the record is data leaks, a hijacked software library, pre-setup tampering research and fixed firmware flaws. The losses in the Ledger reports we reviewed came from recovery-phrase phishing and from malicious transactions that users signed.
-
Part 5: Air-gapped hardware wallets
An air-gapped hardware wallet signs transactions with no USB, Bluetooth or other automatic data link to an online phone or computer, and moves unsigned and signed transactions by QR code or microSD card instead. Among the wallets we feature, the Keystone 3 Pro, COLDCARD Q, Blockstream Jade Plus and OneKey Pro document an air-gapped mode, and all four also keep a USB port for other tasks.
-
Part 6: How to choose a hardware wallet
No hardware wallet is the best choice for everyone: the right one depends on budget, coins, Bitcoin-only or open-source firmware, air-gapped signing, backup format and screen. This guide matches each criterion to the 26 wallets we feature, from maker documentation.
-
Part 7: Self-custody, explained
Self-custody means you hold the private keys to your crypto yourself, in a non-custodial wallet, instead of letting an exchange or custodian hold them for you. You gain sole control and take on sole responsibility: if your keys or backup are stolen, or you lose every usable means of access and recovery, you may permanently lose your crypto.
Datasheets and comparisons count the distinct pages each guide links to. Reading time is the guide's word count at 230 words a minute, rounded.