Air-gapped hardware wallets

An air-gapped hardware wallet signs with no automatic data link to the internet-connected device you use it with. Transactions travel to it and back as QR codes on a screen or as files on a microSD card, and you carry them across by hand. That narrows how malware on a phone or computer can reach the signer, at the cost of more steps and, on some devices, fewer coins supported in air-gapped mode.

Everything below comes from makers’ documentation and our wallet database. We have not used these devices.

What does air-gapped mean for a hardware wallet?

NIST’s glossary defines an air gap as an interface between two systems that “are not connected physically” and where any logical connection “is not automated”: data crosses “only manually, under human control”. For a wallet, that means the device holding the keys has no USB, Bluetooth or network link to the online device while it signs; some models still take a cable for firmware updates or other tasks.

Hardware wallets are designed to keep signing keys on the device; with the seed backup also kept offline, that is what makes them cold wallets. A USB or Bluetooth wallet still exchanges data with the computer automatically while it signs. An air-gapped one does not.

Several devices sold as air-gapped are air-gap capable rather than air-gap only:

• Keystone’s product page says the 3 Pro “employs QR codes and Micro SD cards for offline data transfer”, but its FAQ tells you to disable Air-Gap Mode before a WebUSB firmware update.
• OneKey’s AirGap Mode on the OneKey Pro works by “disabling Bluetooth, USB, and NFC transfer function”, leaving QR codes as the only channel.
• Coinkite’s COLDCARD guide says “you never have to connect it to a computer, although that option is there if you choose to use it.”

A few are designed to work by QR alone. NGRAVE says the ZERO “does not rely on USB or any network connection capability such as WiFi, Bluetooth, NFC, or 4G”, and ELLIPAL lists “no WiFi, no Bluetooth, no USB data” for the Titan 2.0.

How does air-gapped signing work?

Bitcoin’s PSBT format (BIP174) was written for this: “The signer can be offline as all necessary information will be provided in the transaction.” A typical Bitcoin round trip:

1. Set up a watch-only wallet. The device exports its public keys (not the seed) by QR code or microSD file. A wallet app on your computer or phone imports them and can then show balances and build transactions, but cannot sign.
2. Build the transaction in that app.
3. Carry it across. With QR, the app shows a code and the device’s camera scans it. With microSD, you save a file and move the card. In Coinkite’s guide, “The PSBT details are passed between Sparrow Wallet and the COLDCARD using the MicroSD card.”
4. Check and approve on the device. The address, amount and fee shown on the device’s own screen are the ones that matter.
5. Carry the signed transaction back the same way, and broadcast it from the app.

Coinkite also counts NFC tap signing as an air-gapped channel. Its NFC guide describes a link of “about 4 centimeters” that needs no pairing, and says “NFC is disabled by default” on the COLDCARD.

Which hardware wallets are air-gapped?

Wallets on this site whose makers list QR or microSD transaction transfer, from our dataset checked on 14 October 2026. Prices are the maker-shop listings on that date.

Wallet	Air-gap channels listed	Other connections	Notes
Keystone 3 Pro	QR codes	USB-C; microSD for firmware updates	Transaction signing by microSD not verified. Air-Gap Mode is switched off for WebUSB updates. Listed at $149 on Keystone’s shop.
COLDCARD Q	QR scanner, dual microSD, NFC	USB-C	Runs on 3 AAA cells or USB power. Bitcoin only. Listed at $319 on Coinkite’s store.
Blockstream Jade Plus	QR camera	USB-C, Bluetooth, SD card	QR mode is Bitcoin only. Listed at $149 to $169 on Blockstream’s store.
OneKey Pro	QR codes	USB-C, Bluetooth, NFC	AirGap Mode covers EVM and Bitcoin addresses only. Listed at $278 on OneKey’s shop.

Other wallets in the database without a datasheet yet:

• QR only by design: NGRAVE ZERO (USB-C for charging and firmware updates only, per NGRAVE) and ELLIPAL Titan 2.0.
• QR signing: ELLIPAL Titan Mini, SafePal S1 and SafePal S1 Pro.
• QR alongside wireless links: Foundation Passport Prime (QR camera, Bluetooth, USB-C data, NFC backups) and the announced OneKey Pro 2.
• microSD and NFC: COLDCARD Mk5, which has no internal battery and takes power over USB-C.

A microSD slot alone does not make a wallet air-gapped. The BitBox02 family, including the BitBox02 Nova, uses its card for backups and connects over USB-C (plus Bluetooth on the Nova). Trezor’s page for the Safe 5 lists a “USB-C connection” and a “MicroSD card slot” without saying what the slot is for.

Is an air-gapped hardware wallet safer?

It removes one route of attack: a live connection that software on the host can use to send commands to the device. Blockstream’s December 2025 disclosure shows the difference. A missing size check in a Jade command could crash an unlocked device or allow limited code execution over USB or Bluetooth, and was fixed in firmware 1.0.37. Blockstream wrote that “QR mode is not vulnerable as it does not expose an RPC interface at all.”

It does not remove every risk:

• Data still crosses the gap. Blockstream’s QR launch post warns that “it’s possible for malware on your host device to communicate via QR codes”, and tells users to “verify all transaction details on their Jade screen.”
• Firmware has to get in somehow. Keystone’s update guide covers microSD and USB, and ELLIPAL says the Titan 2.0 itself has “no SD card slot”: its “Offline Firmware Update” uses a microSD card in a separate Security Adapter.
• The seed phrase is a separate problem. Air-gapped signing does not protect a backup that has been photographed or phished, or repair a seed that was generated insecurely. See our seed phrase guide.

What are the downsides of an air-gapped hardware wallet?

• Fewer coins in air-gapped mode. Blockstream says “QR mode supports Bitcoin transactions only” on the Jade Plus, and that “Liquid is not supported via QR” (details). OneKey says “only EVM and Bitcoin addresses are supported under AirGap Mode”; other chains need a cable or Bluetooth.
• More steps per transaction. Every send is a round trip by camera or card.
• A battery to look after. The Keystone 3 Pro lists 1,000 mAh, the OneKey Pro 530 mAh and the Jade Plus 280 mAh; the COLDCARD Q takes AAA cells.
• Compatible software. The wallet app must read the device’s QR format or PSBT files. Blockstream lists Sparrow and Electrum among the Jade Plus companions; Keystone lists MetaMask and third-party coordinators.
• Price. On 14 October 2026 the four featured air-gap-capable devices were listed between $149 and $319, while the USB-only Ledger Nano S Plus was listed at $69 on Ledger’s shop.

Who should choose an air-gapped hardware wallet?

An air-gapped device suits someone who signs from a computer they do not fully trust, who holds mostly Bitcoin, or who coordinates multisig across several devices (the COLDCARD Q and Keystone 3 Pro list multisig support). It suits someone who signs rarely and does not mind the extra steps.

It may suit you less well if you sign often across many chains. Check that your preferred wallet app supports the device’s QR workflow and the chains you use. A USB or Bluetooth signer that shows every detail on its own screen is still a cold wallet. For a wider view of the trade-offs, see how to choose a hardware wallet and COLDCARD vs Trezor.

What we could not verify

• Whether the Keystone 3 Pro signs transactions from microSD (the Keystone guides we checked show QR signing), and which chains work in its air-gapped mode.
• What the microSD slot on the Trezor Safe 5 and the SD card on the Jade Plus are used for.
• Whether the Foundation Passport Prime can turn off Bluetooth and run on QR alone.
• Chain coverage over QR for the SafePal, ELLIPAL and NGRAVE devices.