Which Bitcoin Signing Device Should I Use?

Bitcoin Signing Device Overview

A signing device is a dedicated piece of hardware that stores your Bitcoin private keys offline and signs transactions without ever exposing those keys to an internet-connected computer. The right device depends on your budget, technical comfort, air-gap preference, and whether you plan to use multisig.

This guide groups devices into four categories based on who they serve best: beginners, Bitcoin-focused users, power users, and budget-conscious buyers. Every device listed below supports PSBTs and can participate in multisig setups, but they differ significantly in firmware transparency, connectivity, and learning curve.

Devices for Beginners

If you are new to self-custody, you want a device that connects over USB, ships with polished companion software, and does not require command-line tools or manual firmware verification. Two devices stand out in this category.

Ledger Nano S Plus

At $59, the Ledger Nano S Plus is the cheapest entry point from a major manufacturer. It uses an EAL6+ certified secure element (ST33K1M5) and supports over 5,500 coins and tokens through the Ledger Live companion app. The small OLED screen and two-button interface are functional but cramped for verifying long addresses. The main drawback: Ledger's firmware is partially closed-source due to an NDA with STMicroelectronics, which prevents independent verification of the code running on the secure element.

Trezor Safe 3

The Trezor Safe 3 costs $79 and provides fully open-source firmware with an EAL6+ secure element. It connects over USB-C and pairs with the Trezor Suite desktop app, which handles coin management, labeling, and CoinJoin. It supports Shamir Backup (SLIP-39), allowing you to split your seed phrase into multiple shares from day one. For users who value transparency without a steep learning curve, the Safe 3 is the strongest beginner option.

Devices for Bitcoiners

Bitcoin-focused users typically want a device that strips out altcoin code, supports advanced features like coin control and replace-by-fee, and integrates with desktop wallets like Sparrow or Specter.

BitBox02 Bitcoin-Only Edition

The BitBox02 Bitcoin-only edition ($150) is built by Shift Crypto in Switzerland. Its firmware is fully open-source and stripped of all altcoin code: the Bitcoin-only firmware is locked at the factory and cannot be reset to a multi-coin version. It uses a dual-chip architecture (ATECC608A secure element plus a separate microcontroller) and features an anti-klepto protocol that lets you verify the device is not leaking key material through signatures. The touch-slider interface is minimal but effective.

Coldcard Mk5

The Coldcard Mk5 ($167, launched March 2026) is Coinkite's compact flagship. It features dual secure elements from two different vendors, a Gorilla Glass-protected display, and full air-gap support via microSD and optional NFC tap-to-sign. Firmware is fully open-source. The Mk5 is designed for users who want air-gapped signing without the bulk of the Coldcard Q, and its numeric keypad works well for PIN entry and BIP-39 passphrase input.

Devices for Power Users

Power users prioritize full air-gap isolation, QR-based PSBT workflows, and the ability to verify firmware builds independently. These devices never need to connect to a computer via USB or wireless.

Foundation Passport Core

The Passport Core ($199) from Foundation Devices is fully air-gapped with no USB port, no Wi-Fi, and no Bluetooth. It communicates exclusively via QR codes and microSD cards. Both hardware (CERN-OHL-S license) and firmware (GPLv3) are open-source. It pairs with Foundation's Envoy mobile app for a clean signing workflow, or with third-party wallets like Sparrow. The camera-based QR scanning is fast, and the device has a premium build quality with a large color display.

Coldcard Q

The Coldcard Q ($249) is the premium sibling of the Mk5. It adds a full QWERTY keyboard (ideal for long passphrases), a 320x240 color LCD, a built-in QR scanner, and dual microSD slots. Like the Mk5, it uses dual secure elements and fully open-source firmware. The QWERTY keyboard makes the Q significantly more comfortable for frequent signing sessions and complex passphrase entry compared to the numeric keypad on the Mk5.

SeedSigner

SeedSigner is not a commercial product: it is an open-source community project that turns a Raspberry Pi Zero 1.3 (no Wi-Fi, no Bluetooth), a camera module, and a small LCD into an air-gapped signing device for under $50 in parts. SeedSigner is stateless by design: private keys exist only in volatile RAM during a signing session and vanish when the device powers off. This makes it ideal as a dedicated multisig signer where you need multiple low-cost devices, but it requires comfort with DIY assembly and a willingness to verify firmware yourself.

Budget-Friendly Option: Blockstream Jade Plus

The Blockstream Jade Plus ($149 plastic, $169 metal) occupies a unique position: it is fully open-source, supports air-gapped QR signing via a built-in camera, and works with both Bitcoin and the Liquid Network. Instead of a traditional secure element, Jade uses a "virtual secure element" based on a blind-oracle PIN model: the device contacts Blockstream's server (or a self-hosted instance) during unlock to decrypt the seed, which means it cannot be brute-forced offline even without a hardware secure element.

The tradeoff is that the blind-oracle model requires a brief network connection during unlock (not during signing). For users who want air-gapped QR signing with full open-source transparency at a lower price point than the Passport or Coldcard Q, the Jade Plus is compelling.

Decision Framework

Use these questions to narrow your choice:

What is your budget?

• Under $80: Ledger Nano S Plus ($59) or Trezor Safe 3 ($79)
• $100 to $170: BitBox02 Bitcoin-only ($150), Jade Plus ($149), or Coldcard Mk5 ($167)
• $200+: Passport Core ($199), Coldcard Q ($249), or Trezor Safe 7 ($249)
• Minimal spend: SeedSigner DIY (~$50)

Do you need an air gap?

• Yes (QR-based): Passport Core, Coldcard Q, Jade Plus, SeedSigner
• Yes (microSD only): Coldcard Mk5
• No (USB is fine): Trezor Safe 3/5/7, BitBox02, Ledger Nano S Plus

Do you require fully open-source firmware?

• Yes: Trezor (all models), BitBox02, Coldcard (all models), Passport, Jade Plus, SeedSigner
• Partial is acceptable: Ledger (closed-source secure element layer)

Are you building a multisig setup?

• Yes, on a budget: SeedSigner (buy 3 for ~$150 total)
• Yes, with mixed vendors: combine a Coldcard + BitBox02 + Passport for vendor diversity
• Single-sig only: any device above works

Open Source vs Closed Source

The open-source debate is one of the most consequential decisions when choosing a signing device. Fully open-source firmware (Trezor, Coldcard, BitBox02, Passport, Jade, SeedSigner) allows independent security researchers to audit the exact code running on your device. If a vulnerability is found, the community can verify the fix.

Ledger's position is different. Due to an NDA with STMicroelectronics, the low-level code running on the secure element is closed-source. Ledger argues that open source is an inspection property, not a security property, and that their CC EAL6+ certification provides equivalent assurance. Critics counter that certification verifies a snapshot in time, while open-source allows continuous verification.

The Ledger Recover controversy in 2023 sharpened this debate: Ledger's firmware update enabled optional seed extraction and sharding to third-party custodians. While the feature was opt-in, it demonstrated that closed-source firmware can introduce capabilities users cannot independently verify. By late 2025, Ledger had pivoted to a Recovery Key model using a physical smartcard with no cloud storage.

Trezor's Safe 7, released in 2026, introduced the TROPIC01: the first secure element chip whose design is open for external audit. This addresses the longstanding tension between secure elements (which protect against physical attacks) and open-source transparency (which protects against supply-chain and firmware attacks). However, in June 2026, Ledger Donjon researchers disclosed a laser fault-injection attack on the TROPIC01 under lab conditions, illustrating that open-source hardware is subject to the same physical attack surface as closed alternatives.

Connectivity and Air-Gap Comparison

True air-gap means the device never establishes a data connection with a computer: transactions move via QR codes or microSD cards. Passport Core enforces this by having no USB data port at all. Coldcard devices default to air-gapped operation but include a USB port that can be used if preferred. For a deeper dive into how air-gapped signing works with PSBTs, see our PSBT multisig workflow guide.

Multisig Considerations

For holdings above $50,000, a 2-of-3 multisig setup using devices from different manufacturers provides strong protection against both single points of failure and supply-chain attacks. A common configuration pairs a Coldcard with a BitBox02 and a Passport (or SeedSigner as the third key). This ensures that a vulnerability in one vendor's firmware cannot compromise your funds.

SeedSigner is particularly well-suited to multisig because its low cost ($50 per unit) makes it practical to maintain multiple signing devices across different physical locations. Its stateless design means a stolen SeedSigner reveals nothing: the attacker also needs your seed backup to sign.

All devices in this guide support the BIP-174 PSBT standard, which is the foundation of interoperable multisig workflows. Desktop coordinators like Sparrow Wallet and Specter Desktop can orchestrate signing across mixed-vendor setups. For a comparison of multisig configurations, see our hardware wallet comparison tool.

Using Signing Devices with Spark

Once you have secured your Bitcoin with a signing device, you may want to use a portion of your holdings for payments or stablecoin transfers. Spark is a Bitcoin layer 2 that enables instant, low-cost transfers including USDB stablecoin payments. Hardware wallets handle the cold storage layer, while Spark handles the spending layer: you can move Bitcoin from cold storage into Spark when you need fast transactions, keeping the bulk of your savings secured by your signing device.

Frequently Asked Questions

What is the most secure Bitcoin hardware wallet?

Security depends on your threat model. For protection against remote attacks, any device on this list provides strong isolation since private keys never touch an internet-connected machine. For protection against physical attacks, devices with secure elements (Coldcard, Trezor, Ledger, BitBox02) offer tamper resistance. For protection against supply-chain attacks, fully open-source devices (Trezor, Coldcard, Passport, SeedSigner) allow independent firmware verification. The highest security comes from a multisig setup using devices from multiple vendors.

Should I buy an air-gapped hardware wallet?

An air-gapped device eliminates USB and wireless as attack vectors. If you hold significant value or want to minimize your trust surface, air-gapped devices like the Passport Core, Coldcard Q, or SeedSigner are worth the extra workflow complexity. For smaller amounts or everyday use, a USB-connected device like the Trezor Safe 3 or BitBox02 provides strong security with a simpler signing process.

Is Ledger safe to use despite closed-source firmware?

Ledger devices use EAL6+ certified secure elements and have a strong track record: no confirmed remote exploit has resulted in fund theft from a Ledger device. The closed-source concern is about verifiability, not a known vulnerability. If you prioritize auditability, choose an open-source alternative. If you are comfortable trusting certification and Ledger's security team, the Nano S Plus remains a capable device at a low price point.

What is the best hardware wallet for multisig?

For multisig, prioritize PSBT support, air-gapped operation, and vendor diversity. A strong 2-of-3 setup uses three different manufacturers: for example, Coldcard Mk5 + BitBox02 + Passport Core. If budget is a concern, SeedSigner units at ~$50 each make a cost-effective multisig quorum. All devices in this guide support BIP-174 PSBTs and work with coordinators like Sparrow Wallet.

What is the difference between a signing device and a hardware wallet?

The terms are often used interchangeably, but "signing device" is more precise. A signing device stores private keys and signs transactions: it does not broadcast them or track balances. A "hardware wallet" implies a more complete experience including balance display and transaction history, which are typically handled by companion software (Sparrow, Trezor Suite, Ledger Live) running on a separate computer. The signing device itself should only hold keys and approve transactions.

How many hardware wallets do I need?

For single-sig, one device is sufficient: your seed phrase backup is the redundancy. For multisig, you need at least two devices (in a 2-of-3 setup, the third key can be a seed stored offline). Many security-conscious Bitcoiners keep two devices: one for active signing and one stored separately as a backup in case the primary device fails. For a guide to choosing the right Bitcoin wallet software to pair with your signing device, see our wallet decision guide.

Can I use a hardware wallet with a mobile phone?

Some devices support mobile pairing. Jade Plus connects via Bluetooth to Blockstream Green on mobile. Trezor Safe 7 includes Bluetooth with a physical kill switch. Passport Core pairs with the Envoy mobile app via QR codes (no direct connection needed). Coldcard devices are desktop-focused and do not support mobile pairing natively, though NFC tap-to-sign on the Mk5 and Q works with compatible Android apps.

This tool is for informational purposes only and does not constitute financial advice. Prices and specifications are approximate and based on publicly available information as of mid-2026. Hardware wallet features, firmware, and pricing change frequently. Always verify current data on the manufacturer's website before purchasing.