Setting up a hardware wallet takes 15 to 30 minutes, and almost every serious mistake happens during those minutes: a device bought second-hand, an app downloaded from a fake site, a recovery phrase photographed “just in case”. This guide shows how to set up a hardware wallet step by step, with the specifics of the two most common families, Ledger (Nano X, Nano S Plus) and Trezor (Safe 3, Safe 5), as documented by their makers in October 2026.
A hardware wallet, or cold wallet, generates your private keys inside a dedicated chip and signs transactions only after you confirm them on its own screen. It protects you from malware on your computer, but only if the setup is done properly.
What you need before you start
- The device, new, bought from the maker’s official store or an authorised reseller.
- A computer or a compatible phone. Check compatibility first: the Ledger Nano X works with an iPhone over Bluetooth, while Trezor’s Safe 3 connects by USB-C to computers and Android phones.
- The recovery cards supplied in the box and a pen. Nothing digital.
- 30 quiet minutes, alone, away from cameras.
How to set up a hardware wallet: step by step
- Inspect the package. Trezor asks you to check that the package is factory sealed and its holographic seal intact. Ledger ships a blank recovery sheet: if the sheet is already filled in, or if a PIN or a list of words is supplied, do not use the device and contact the maker.
- Install the official app from the official address. Type trezor.io/start or ledger.com/start yourself, or install Trezor Suite or Ledger Wallet (formerly Ledger Live) from the official app store. Fake setup pages hosted on unrelated domains appear in search results, so never follow a link from an ad, an email or a message.
- Connect the device and install or update the firmware. Trezor devices ship without firmware: Trezor Suite installs it during setup, and you can choose the standard or the Bitcoin-only version. Ledger Wallet will offer any update once the device is set up.
- Check that the device is genuine. Trezor Suite runs an authenticity check of the secure element. Ledger Wallet runs a Genuine Check through a cryptographic challenge to the chip. If either check fails, stop and contact the maker’s support.
- Create a new wallet. Choose “Create a new wallet” (Trezor) or “Set up as new device” (Ledger). Use the restore option only if you are recovering a wallet whose backup you created yourself.
- Choose a strong PIN. Ledger PINs have 4 to 8 digits; the device resets after three wrong entries. Trezor PINs can have 4 to 50 digits, and the wallet is erased after 16 wrong entries. Avoid dates and simple sequences.
- Write down the recovery phrase on paper. Ledger always generates 24 words. Recent Trezor Safe devices create a 20-word backup by default. Write each word in order on the supplied card, check the spelling on the screen, and confirm the words the device asks for. Never type them on a computer or phone, never photograph them.
- Verify the backup. Trezor Suite includes a backup check in which you enter the words on the device to confirm they are correct. Do it now, while the wallet is still empty.
- Install coin apps and add accounts. In Ledger Wallet, open My Ledger and install the apps for the blockchains you use (Bitcoin, Ethereum and so on), then add accounts. Trezor Suite shows supported coins directly; you enable those you need.
- Receive a small test amount. Generate a receiving address in the app, compare it character by character with the address shown on the device screen, send a small amount from your exchange, and wait for it to arrive before moving larger sums.
Ledger: what differs
Ledger devices use a secure element and a closed operating system, and they work with the Ledger Wallet app on desktop and mobile. The Nano X adds Bluetooth for phones; the Nano S Plus is USB-only. Ledger’s setup instructions for the Nano X confirm that its devices only generate 24-word phrases.
Ledger also sells an optional paid service, Ledger Recover, which stores encrypted shares of your phrase with third-party companies after identity verification. It is a convenience, not a requirement; a careful paper backup does the same job without involving anyone else.
Trezor: what differs
Trezor’s firmware and Trezor Suite are open source, and the Safe 3 and Safe 5 add a secure element. During setup, the backup type depends on the device, as Trezor’s backup guide explains: units from 2024 onwards offer a 20-word single-share backup (SLIP39 standard) by default, which you can later upgrade to a multi-share backup split between several places. Older Safe 3 units shipped with 12-word cards. The Safe 5, reviewed in our Trezor Safe 5 review, has a colour touchscreen instead of buttons, but the steps are the same.
Other models: newer Ledgers and card wallets
Ledger’s newer devices, the Stax, the Flex and the Nano Gen5, are set up through the same Ledger Wallet app, with the same PIN, 24-word phrase and Genuine Check; only the screen and buttons differ. Trezor’s Bluetooth model, the Safe 7, also uses Trezor Suite.
Card wallets such as Tangem follow a different logic. You tap the cards on your phone over NFC, and by default the key is generated inside the card without a recovery phrase: the backup is the set of two or three cards, which you must store in different places. A recovery phrase can be enabled in the app if you want a backup compatible with other wallets. Since the cards have no screen, check addresses carefully on your phone.
Storing the recovery phrase
The recovery phrase is the wallet. Anyone who reads it can take your funds from anywhere in the world; if you lose it and the device breaks, nobody can recover them.
- Keep the card in a safe place at home, away from water, heat and visitors.
- For larger amounts, consider engraving it on a steel plate that resists fire and water.
- Do not split the words into halves stored in different places: each half weakens the security. Use a multi-share backup if you need distribution.
- Tell a trusted person how to find your instructions in case something happens to you, without revealing the words.
Our guide to seed phrase security goes into storage options in more detail.
Optional: add a passphrase
Both Ledger and Trezor support a passphrase, an extra secret that opens a separate set of accounts. It protects you if someone finds your recovery card, but if you forget the passphrase, the funds behind it are lost forever. Use it only once you are comfortable with the basics, and back it up separately.
Daily use and firmware updates
- Always check the address, amount and fee on the device screen before confirming. The screen of your computer can be falsified; the device screen cannot.
- Install firmware updates only from Ledger Wallet or Trezor Suite. Never update from a link in an email: both makers have seen phishing campaigns after data leaks.
- Disconnect the device when you are not using it and keep the PIN private.
- To use DeFi apps, you can connect the hardware wallet to a browser wallet such as MetaMask so that every signature still requires the device.
Mistakes to avoid
- Buying a used or “pre-configured” device. Ledger documents cases where sellers kept a copy of the recovery phrase and later emptied the wallet.
- Entering your recovery phrase into any website or app, including one that claims to “validate” or “sync” your wallet. Scams of this kind are covered in our guide on how to avoid crypto scams.
- Skipping the backup check and discovering a misspelled word years later.
- Plugging in a device you received without ordering it.
If the device is lost, stolen or broken
Your funds are on the blockchain, not in the device. Buy a new device, choose “restore” during setup and enter your recovery phrase on the device itself. If the device was stolen, the thief still needs your PIN; restore your wallet on a new device and move the funds to a fresh wallet with a new recovery phrase as a precaution.
