How a hardware wallet works

Hardware wallets are electronic devices designed to store the private keys necessary to access your bitcoin on the bitcoin blockchain. These private keys are a series of characters that are used to unlock the bitcoin contents at a given address. Because these characters are so long, they shouldn’t be memorized by people, so they need to be safely stored somewhere.

Hardware wallets offer the highest level of security for storing private keys because they are not kept online. This greatly reduces the chances that a hacker can get to them.

These hardware wallets are themselves very often encrypted so that, if you lose the wallet, the keys inside them are not accessible by anyone who finds the wallet. Wallet providers usually walk you through how to document a recovery option — called a seed phrase — that lets you regenerate the private key stored on the wallet if you happen to lose your wallet.

How do hardware wallets work?

At their core, hardware wallets are really just specialized external hard drives. But simply dropping your private key in a .txt file on an external hard drive and then calling that a hardware wallet wouldn't be entirely correct, either.

Usually, a hardware wallet encrypts the private key it has on the wallet with a PIN and protects your key with at least one secure element. They tend to have very little memory to prevent bad actors from injecting malware into a device.

For a device to be a truly useful hardware wallet, however, it should facilitate executing bitcoin transactions on the blockchain. Hardware wallets often come with preinstalled software that can help you send funds to crypto exchanges and connect to dapps (decentralized apps that connect to a blockchain) to let you interact with the blockchain.

The best way to understand this is to see it in action. Let's look at how to set up one of the most popular hardware wallets out there, the high-end Trezor Model T, and then how to execute a bitcoin transaction on it.

Meet an example: Trezor

Trezor is a household name in the crypto community, and the company was the first to create a fully-fledged hardware wallet for bitcoin — the Trezor One.

Its Trezor Model T version is the company's flagship product. The wallet supports bitcoin, ethereum, and other assets, has a touchscreen for better usability, and has a plug-and-play mobile interface so that you can connect it to your mobile phone and carry out transactions that way.

To start using the device, you need to connect it to your computer and set it up. Our Support Center walks you through the specific instructions, but here are some highlights you can expect with most wallets.

Installing firmware

After first connecting your Trezor device, you will be prompted to install its firmware.

The firmware is the code on the device that manages your keys, registers addresses, and carries out the complex procedure of executing transactions on the blockchain.

In the case of Trezor, the device ships without firmware to ensure that you always use the latest firmware. The device also always verifies the firmware every time it starts to ensure that nothing has been corrupted. In any case, be sure to follow the manufacturer’s instructions.

Creating or recovering a wallet

Once your firmware is up to date, it’s time to create your very own private key.

After installing the firmware, you are given the choice to create a new wallet or recover an existing one. Unless you are transferring an existing Trezor wallet to a new Trezor device, it is recommended to create an entirely new wallet on the Trezor rather than restoring one from the seed phrase of another wallet.

Once the new Trezor wallet is created, you can then transfer your funds from your old wallet or exchange to the Trezor device.

Part of the process of creating a new wallet includes being given the seed phrase — 12-24 unique words — that can be used to recover the Trezor wallet should you ever lose the physical device. These words must never be stored online, and you should never take a photograph of them because, with them, a hacker can gain full access to your wallet.

Trezor sends two physical paper cards that you must fill in with the words, and these cards should be stored in a safe, access-controlled location. Keeping a seed phrase is important if you are securing your investment with just one device.

Your Trezor device also requires a PIN to protect the device from hackers. It’s important to set up and use a PIN for hardware wallets because otherwise, anyone who finds the device can use it. Keep your PIN private, too.

Adding bitcoin to the hardware wallet

Once you have set up a hardware wallet, you can use it to generate addresses. This can be done with the device. For Trezor, the software shows you how to do this.

Addresses are different from your private keys. Addresses can be shared with others to facilitate transactions. Private keys are proof of ownership and should be kept secure.

If you’re using a Trezor to withdraw bitcoin from an exchange, you can simply generate an address with your device, copy and paste it onto the exchange. It’s best to double-check addresses before you send funds, and it’s okay to do a test transaction. Safety first!

Once your transaction has been confirmed on the blockchain, your funds are officially in your self-custody.

Which hardware wallet to choose

All wallets work similarly, but they differ in the degree of security they offer, the user-friendliness of their software, and their price range (value for money). We have previously written about five excellent hardware wallets to suit every budget.

Get even greater protection

Casa allows you to protect your bitcoin with multiple keys, which adds an extra layer of security when storing significant amounts of bitcoin. That way, you can have extra peace of mind that your assets are still safe even if your device is lost or stolen.

Interested in giving Casa a try? Learn more about our plans here.