Welcome — a short security-first primer
This demo guide walks you through the practical steps to safely bring a hardware wallet online: unboxing inspection, device initialization, handling the recovery seed, verifying firmware and companion software, first receive/send operations, and ongoing best practices. Always follow official vendor documentation when performing critical operations; this is a template only.
1. Unboxing & inspection
Before powering on, check for obvious tampering and confirm the package contents:
- Inspect tamper-evident seals and packaging. If anything looks altered, stop and contact vendor support.
- Confirm included items — device, cable, recovery card/manual — match official packing lists.
- Record serial numbers and keep proof of purchase for warranty/support use.
2. Initial setup — choose a safe environment
Set up your device on a trusted personal machine and private network. Avoid public Wi-Fi or unknown hosts for initial key generation or firmware updates.
- Open the official start page by typing the verified URL (do not follow unsolicited links).
- Connect the device using the supplied cable and follow the guided setup shown by the vendor UI.
- Create a new wallet when prompted — the device will generate a recovery seed and display it word-by-word on the device screen. This is authoritative; follow it exactly.
- Set a device PIN to protect local access — choose a PIN you can remember but is not trivial.
3. Recovery seed & passphrase
Understanding seed and passphrase concepts reduces accidental lock-outs or theft risk.
- Seed length: Most devices use 12, 18, or 24-word BIP-39-style seeds. Write words in order; mistakes are fatal.
- Durability: Consider metal backup plates to resist fire, water, and deterioration.
- Passphrase: An optional passphrase (a “25th word”) creates an additional hidden wallet derived from your seed. The passphrase is non-recoverable if forgotten — manage it like any secret.
- Redundancy: Store copies in separate secure locations if the value warrants it (e.g., trusted safes, geographically separate vaults).
4. Firmware & software verification
Firmware and companion app integrity is essential — attackers sometimes target installers and firmware images.
- Download firmware and wallet apps only from official vendor pages or verified repositories.
- Verify checksums (SHA256) and, where provided, GPG signatures before installing. Commands:
shasum -a 256 file(macOS/Linux),Get-FileHash -Algorithm SHA256 path\to\file(PowerShell). - Follow on-device prompts when applying firmware — do not interrupt power during an update unless directed by vendor recovery instructions.
- Prefer official desktop apps or verified PWAs; avoid untrusted third-party builds unless you can audit them.
5. Receiving & sending — verify on-device
The device display is the final authority. Use it to validate addresses and amounts.
- When receiving: generate a receive address in the wallet UI and confirm the same address on the device screen before sharing.
- When sending: always validate the recipient address, amount and fee on the device display — do not rely solely on the host UI.
- Beware clipboard hijackers and malicious browser content; on-device confirmation prevents many common attacks.
6. Common issues & recovery steps
If something goes wrong, follow vendor-provided recovery instructions and contact official support as needed.
Device won’t power
Try a different cable and USB port. Avoid unpowered hubs. If the device remains dead, contact vendor support with proof of purchase and serial number.
Firmware update failed
Follow the vendor's documented recovery mode. Preserve logs or screenshots to assist support. Avoid third-party recovery tools unless explicitly recommended by the vendor community or docs.
Lost seed but device present
If the device still holds funds, generate a new wallet on a secure device and transfer funds to it; then create and securely store the new seed.
Lost seed and device
Without your seed or device, funds are not recoverable. This is why robust, secure backups are critical.
7. Ongoing best practices
- Keep device firmware and wallet software up to date; read release notes before upgrading.
- Use trusted hosts for signing; avoid public or shared computers for high-value transactions.
- Revoke site device permissions in your browser when not in use and minimize installed extensions that can manipulate pages.
- Test with a small amount before sending large transfers and maintain a documented recovery plan.
8. Advanced topics (overview)
For advanced users: passphrase strategies, multisig setups, Shamir backups (if supported), air-gapped signing, PSBT workflows and enterprise device lifecycle management are available — but they require careful planning and testing.