A calm, plain-English walkthrough of a first-time setup — which app to trust, how to write your recovery phrase down properly, and how to prove the whole thing works before any serious money touches it.
A hardware wallet is a small device whose entire job is to hold your private keys somewhere a computer cannot reach. It has its own screen and buttons, so you always see what you are approving. A first-time setup takes about thirty minutes and is worth doing slowly. Nothing here requires an account, an email address, or a photograph of anything.
Your device holds the keys; the app on your computer or phone is only a window into them. It can show balances and build transactions, but it cannot sign anything alone — every approval happens when you press the buttons on the device. Keep that in mind and the advice below explains itself: anything asking you to move keys or recovery words off the device is breaking the design.
The device, its own USB cable, a computer or phone, a pen, the recovery card that came in the box, and half an hour without interruptions.
No account, no email, no cloud notes app, no camera, no photo of your screen, and no help from anyone who messaged you first.
Buy from the manufacturer or an authorised reseller, never a marketplace seller with a suspiciously good price. Check the seal and box contents before you plug anything in. A device that arrives already initialised, with a pre-printed recovery card or a slip of paper listing words, is not a new device — return it and buy again from a source you trust.
The manufacturer publishes a desktop app and a web app, and both are free. Type the maker's address into your browser yourself rather than clicking a search result — the top of a search page is where paid impostors buy space. Once you are on the real domain, bookmark it so future visits cannot be redirected.
Plug the device into your own computer, open the app, and choose the option to create a new wallet. If the device offers to restore an existing one and you have nothing to restore, do not take that path. The device will display your recovery phrase — usually twelve, twenty or twenty-four words — one word at a time, on its own screen.
Use the card in the box and a pen. Copy each word as it appears, in order, with its number. Spelling matters and order matters, so read every word back against the screen before moving on. Paper stored somewhere dry and private beats a screenshot, a password manager note, a text message to yourself, or a cloud document — those live on machines that can be hacked, synced, or restored by someone else.
The device will quiz you, asking you to enter a few of the words in a random order. Do it honestly. This is the only moment where a copying mistake is cheap to fix, and the confirmation is what tells the device — and you — that the backup is complete and readable.
Choose a PIN and enter it on the device, not on your keyboard. Keep a spare copy somewhere separate from the device, because a forgotten PIN plus an unreadable backup means the money is gone. A passphrase is optional and advanced: it creates a hidden wallet on top of your backup, adding real protection if you store it as carefully as the recovery words, and silently losing funds if you forget it. Skip it if you are unsure.
Before trusting the setup with anything significant, receive a modest amount. When the app shows you a receive address, confirm that the same address appears on the device screen, then send a small sum and let it arrive. Spend or move a little of it, and check that the device asks you to approve the outgoing transaction with its own buttons. That round trip is the proof you actually want.
Never type your recovery phrase into a computer, phone, website, app, chat window, email, or form — not even one word of it.
Your recovery phrase is your money. Anyone who has it can move your funds from anywhere in the world, and no support agent, no exchange, and no manufacturer will ever need it from you. Wallets are restored by entering the phrase into the device itself, using its buttons. Any page, pop-up, or person asking for the words is stealing them. If you have already typed them somewhere, treat that wallet as compromised: move the funds to a newly created wallet with a fresh phrase.
Update the device firmware through the official app when it prompts you. Verify every receive address on the device screen before sharing it. Keep the device disconnected between uses — it only needs power while you are transacting. Once a year or so, restore your backup onto the device from the written words and confirm the same wallet reappears; an untested backup is a hope, not a plan. And treat anyone who contacts you about your crypto first, however official they sound, as an attacker until proven otherwise.