Hardware wallets evaluated across a secure element you can look up, firmware anyone can rebuild, proof the unit is genuine, key creation you can check, signing and recovering without the maker, and years without a fund loss, each graded on the model the row prices.
Independent. Evidence-based.We rank with a published method and sourced evidence. No one can pay to rank.How it works
Set your country and amount to see your costs ·
Your setup
What your country changesPick a country to see which hardware wallets serve it. Nothing is hidden — any that does not is listed with that reason.
🇺🇸 United States
🇨🇦 Canada
🇲🇽 Mexico
🇬🇧 United Kingdom
🇩🇪 Germany
🇫🇷 France
🇮🇹 Italy
🇪🇸 Spain
🇳🇱 Netherlands
🇨🇭 Switzerland
🇸🇪 Sweden
🇳🇴 Norway
This affects provider availability.
Prices in USD. Select your primary deposit currency.
Your coins and phone
Requirements (0)
Preferences (0)
Preferences re-weight Fit for you, which needs your country.
More filters
Trust & controlAdvanced
23 providers match your requirements
Out of 23 ranked providers. 0 excluded.
What this ranks
Ranked here: purchasable self-custody hardware signing devices, where the key is generated on the device, stays there, and only a signature ever leaves it.Not ranked here: cards whose private key leaves the card, DIY builds with no vendor or list price, devices whose real decision is inheritance or recovery, and devices that give a reader nothing to look up or rebuild.23 of the 43 assessed are ranked; 20 were turned away by name. Who, and whyRequirements narrow the list; they never change a published ChainChoice Score. How the ranking works
#1
BitBox02 NovaHow BitBox02 Nova was chosenWins the weighted total without leading any single criterion
EAL6+ secure chip and firmware rebuilt and matched, with Bluetooth — new in 2025, €175
81 / 100 out of 100published score, #1 of all 23 worldwide
EvidenceHigh6/6 criteria scored, with 6 dated sources quoted.
Secure element you can look upFirmware anyone can rebuild and matchKey creation and signing you can check
Why it leads
BitBox02 Nova is 1 point ahead of Trezor, mainly because it scores higher on its checkable keys.
Ahead of Trezor on checkable keys (+2.2 points)
Secure element 10/10 (weight 27%)
Tradeoff
Fund-loss record: 5 points below the best in this ranking
See key differences in features, fees, security and more.
Checkable keys
Key creation and signing you can check
12% of the published criteria weight. Scored 0–10 from the published evidence; the order below is by this criterion, then the published ranking.
Provider
Checkable keys (0–10)
ChainChoice Score
BitBox02 Nova
10
81
BitBox02
10
76
Blockstream Jade Core
10
71
Blockstream Jade
10
69
Trezor
7
80
Keystone
7
70
Foundation Passport
7
68
Coldcard
7
66
KeepKey
4
62
Keycard Shell
0
69
OneKey
0
69
Keycard
0
67
Ledger
0
63
Ledger Nano X
0
63
Cypherock X1
0
60
Satochip
0
57
GridPlus Lattice1
0
52
CoolWallet Pro
0
48
SafePal S1
0
48
SecuX
0
46
CoolWallet
0
44
SafePal X1
0
44
Tangem
0
42
Secure element
Secure element you can look up
27% of the published criteria weight. Scored 0–10 from the published evidence; the order below is by this criterion, then the published ranking.
Provider
Secure element (0–10)
ChainChoice Score
BitBox02 Nova
10
81
Trezor
10
80
Keycard Shell
10
69
OneKey
10
69
Keycard
10
67
Ledger
10
63
Ledger Nano X
9
63
BitBox02
5
76
Keystone
5
70
Foundation Passport
5
68
Coldcard
5
66
Blockstream Jade Core
4
71
Blockstream Jade
4
69
Cypherock X1
3
60
Satochip
3
57
GridPlus Lattice1
3
52
CoolWallet Pro
3
48
SafePal S1
3
48
SecuX
3
46
CoolWallet
3
44
SafePal X1
3
44
Tangem
3
42
KeepKey
0
62
Rebuildable firmware
Firmware anyone can rebuild and match
27% of the published criteria weight. Scored 0–10 from the published evidence; the order below is by this criterion, then the published ranking.
Provider
Rebuildable firmware (0–10)
ChainChoice Score
BitBox02 Nova
10
81
Trezor
10
80
BitBox02
10
76
Blockstream Jade Core
10
71
Keystone
10
70
Blockstream Jade
10
69
Foundation Passport
10
68
Coldcard
10
66
KeepKey
10
62
Cypherock X1
10
60
Keycard Shell
7
69
OneKey
7
69
Keycard
5
67
Satochip
5
57
Ledger
4
63
Ledger Nano X
4
63
GridPlus Lattice1
4
52
CoolWallet Pro
4
48
CoolWallet
4
44
SafePal S1
3
48
SecuX
3
46
SafePal X1
3
44
Tangem
0
42
Genuine check
Proof the device is genuine and unmodified
12% of the published criteria weight. Scored 0–10 from the published evidence; the order below is by this criterion, then the published ranking.
Provider
Genuine check (0–10)
ChainChoice Score
BitBox02 Nova
7
81
Trezor
7
80
BitBox02
7
76
Blockstream Jade Core
7
71
Keycard Shell
7
69
OneKey
7
69
Foundation Passport
7
68
Keycard
7
67
Ledger
7
63
Ledger Nano X
7
63
Cypherock X1
7
60
Satochip
7
57
GridPlus Lattice1
7
52
Tangem
7
42
Keystone
5
70
Coldcard
5
66
KeepKey
5
62
SafePal S1
5
48
CoolWallet Pro
2
48
SecuX
2
46
CoolWallet
2
44
SafePal X1
2
44
Blockstream Jade
0
69
Maker independence
Sign and recover without the maker
11% of the published criteria weight. Scored 0–10 from the published evidence; the order below is by this criterion, then the published ranking.
Provider
Maker independence (0–10)
ChainChoice Score
BitBox02 Nova
10
81
Trezor
10
80
BitBox02
10
76
Blockstream Jade Core
10
71
Keystone
10
70
Keycard Shell
10
69
OneKey
10
69
Blockstream Jade
10
69
Coldcard
10
66
KeepKey
10
62
Satochip
10
57
Keycard
8
67
Foundation Passport
6
68
Ledger
6
63
Ledger Nano X
6
63
GridPlus Lattice1
6
52
CoolWallet Pro
6
48
Cypherock X1
4
60
SafePal S1
4
48
SecuX
4
46
CoolWallet
4
44
SafePal X1
4
44
Tangem
4
42
Fund-loss record
Years in buyers' hands without a device-level fund loss
11% of the published criteria weight. Scored 0–10 from the published evidence; the order below is by this criterion, then the published ranking.
Provider
Fund-loss record (0–10)
ChainChoice Score
BitBox02
10
76
Keycard
10
67
Ledger Nano X
10
63
KeepKey
10
62
Satochip
10
57
GridPlus Lattice1
10
52
SafePal S1
10
48
SecuX
10
46
Blockstream Jade
9
69
CoolWallet Pro
9
48
Ledger
8
63
Cypherock X1
8
60
Trezor
7
80
Keystone
7
70
SafePal X1
7
44
Tangem
7
42
BitBox02 Nova
5
81
Blockstream Jade Core
5
71
Keycard Shell
5
69
OneKey
5
69
Foundation Passport
5
68
CoolWallet
5
44
Coldcard
1
66
All 6 published criteria
Every ranked row’s score on each criterion, in the published order. Choose a column to order by it.
Provider
ChainChoice Score
1
BitBox02 Nova
10
10
7
10
10
5
81
2
Trezor
10
10
7
7
10
7
80
3
BitBox02
5
10
7
10
10
10
76
4
Blockstream Jade Core
4
10
7
10
10
5
71
5
Keystone
5
10
5
7
10
7
70
6
Keycard Shell
10
7
7
0
10
5
69
7
OneKey
10
7
7
0
10
5
69
8
Blockstream Jade
4
10
0
10
10
9
69
9
Foundation Passport
5
10
7
7
6
5
68
10
Keycard
10
5
7
0
8
10
67
11
Coldcard
5
10
5
7
10
1
66
12
Ledger
10
4
7
0
6
8
63
13
Ledger Nano X
9
4
7
0
6
10
63
14
KeepKey
0
10
5
4
10
10
62
15
Cypherock X1
3
10
7
0
4
8
60
16
Satochip
3
5
7
0
10
10
57
17
GridPlus Lattice1
3
4
7
0
6
10
52
18
CoolWallet Pro
3
4
2
0
6
9
48
19
SafePal S1
3
3
5
0
4
10
48
20
SecuX
3
3
2
0
4
10
46
21
CoolWallet
3
4
2
0
4
5
44
22
SafePal X1
3
3
2
0
4
7
44
23
Tangem
3
0
7
0
4
7
42
How this ranking works
How firm the #1 is, the per-criterion arithmetic behind each score, who pays ChainChoice, and which hardware wallets were assessed and left out.
One point from changingBitBox02 Nova leads Trezor by 1 point
A one-point change on one criterion puts Trezor first, so read both.
See the arithmetic
Move secure element you can look up — the heaviest criterion that changes it, weighted 27 — by a single point and Trezor takes first place. Both are worth reading. The published rankings file
Why this score6 published criteria · leads 5 of 6
Published criterionWtScore, and the best hereGap/10 out of 10Pts
Secure element you can look up6.5·108.6
Firmware anyone can rebuild and match6.5·108.6
Proof the device is genuine and unmodified2.9·72.7
Key creation and signing you can check2.9·103.8
Sign and recover without the maker2.6·103.5
Years in buyers' hands without a device-level fund loss2.6−551.8
Σ methodology points29.1/32
Each bar is the score on that criterion’s own 0–10 scale, never rescaled to the pool. The dark line is the best any product here reached on that axis. Wt is the most the criterion can add to the 86-point weighted total. Pts is weight × score × 32; the sum is the methodology score, and each weighted point behind the leader costs 2.6 on the displayed score. how these are weighted
Why it ranks first
Why BitBox02 Nova leads this category right now
EAL6+ secure chip and firmware rebuilt and matched, with Bluetooth — new in 2025, €175. Strongest on secure element you can look up (10/10): The Nova names its secure chip, 'OPTIGA™ Trust M V3', which Infineon's datasheet ties to one certified part (BSI-DSZ-CC-0961, EAL6+); the seed is kept encrypted under that chip and the owner's password. Weakest on years in buyers' hands without a device-level fund loss (5/10): No device-level fund loss is on record for the Nova ('We have no reports of lost funds'), but it first shipped in 2025; two secure-chip configuration issues disclosed that October were fixed in firmware 9.25.0. Published price: BitBox02 Nova, Multi edition, at €175.00 including 19% VAT on https://shop.bitbox.swiss/en/products/bitbox02-nova-79/, read 1 October 2026; no US dollar list price is published.
Best for
Secure element you can look up — 10/10
Main tradeoff
First shipped in 2025, so it has a short record in buyers' hands
Verify before signup
BitBox02 Nova, Multi edition, at €175.00 including 19% VAT on https://shop.bitbox.swiss/en/products/bitbox02-nova-79/, read 1 October 2026; no US dollar list price is published.
Recommendation summary
What should decide this category
Does a secure element whose certificate you can look up matter most (BitBox02 Nova, Trezor, the Keycard Shell, OneKey), or firmware you can verify (BitBox02, Keystone, Blockstream Jade)?
Do you need air-gapped signing by QR code or microSD (Keystone, the Keycard Shell, Blockstream Jade, Foundation Passport, COLDCARD, SafePal), or is USB or Bluetooth fine?
Bitcoin only or several coins, and what is your budget?
Quick picks
Strong options in this category
Start with the lead choice first, then use the shortlist only if you still need a challenger or stronger fit for a specific setup.
Best overall
BitBox02 Nova
EAL6+ secure chip and firmware rebuilt and matched, with Bluetooth — new in 2025, €175
EAL6+ secure chip and firmware rebuilt and matched, with Bluetooth — new in 2025, €175. Strongest on secure element you can look up (10/10): The Nova names its secure chip, 'OPTIGA™ Trust M V3', which Infineon's datasheet ties to one certified part (BSI-DSZ-CC-0961, EAL6+); the seed is kept encrypted under that chip and the owner's password. Weakest on years in buyers' hands without a device-level fund loss (5/10): No device-level fund loss is on record for the Nova ('We have no reports of lost funds'), but it first shipped in 2025; two secure-chip configuration issues disclosed that October were fixed in firmware 9.25.0. Published price: BitBox02 Nova, Multi edition, at €175.00 including 19% VAT on https://shop.bitbox.swiss/en/products/bitbox02-nova-79/, read 1 October 2026; no US dollar list price is published.
Best for: Secure element you can look up — 10/10
Secure element you can look up · weight 27%10/10Firmware anyone can rebuild and match · weight 27%10/10Proof the device is genuine and unmodified · weight 12%7/10Key creation and signing you can check · weight 12%10/10Sign and recover without the maker · weight 11%10/10Years in buyers' hands without a device-level fund loss · weight 11%5/10
Quick pick
Trezor
Trezor Safe 3: certified chip you can look up — firmware rebuilt and matched by independent reviewers, at EUR 59 (US$59)
Trezor Safe 3: certified chip you can look up — firmware rebuilt and matched by independent reviewers, at EUR 59 (US$59). Strongest on secure element you can look up (10/10): The Safe 3's OPTIGA Trust M (V3) maps to Infineon hardware identifier IFX_CCI_00000Bh, which BSI certifies at EAL6+ under BSI-DSZ-CC-0961, valid to March 2027. Weakest on years in buyers' hands without a device-level fund loss (7/10): No device-level fund loss is on record for the Safe 3, which first shipped in November 2023, so it counts three years in buyers' hands. Published price: Trezor Safe 3: the Product JSON-LD on https://trezor.io/trezor-safe-3 reads "priceCurrency":"USD","price":59, read 1 October 2026; the Bitcoin-only edition is the same price.
Best for: Secure element you can look up — 10/10
Secure element you can look up · weight 27%10/10Firmware anyone can rebuild and match · weight 27%10/10Proof the device is genuine and unmodified · weight 12%7/10Key creation and signing you can check · weight 12%7/10Sign and recover without the maker · weight 11%10/10Years in buyers' hands without a device-level fund loss · weight 11%7/10
Quick pick
BitBox02
Firmware rebuilt and matched, seven years without a fund loss — Swiss, USB-C only
Firmware rebuilt and matched, seven years without a fund loss — Swiss, USB-C only. Strongest on firmware anyone can rebuild and match (10/10): Two WalletScrutiny reviewers rebuilt BitBox02 Multi firmware 9.27.1 from source and matched the official binary in September 2026. Weakest on secure element you can look up (5/10): The original BitBox02 keeps one of its secrets in a named ATECC608B secure chip, but no Common Criteria, CMVP or PSA listing names that part; the EAL6+ chip is in the BitBox02 Nova. Published price: BitBox02 (original), Multi or Bitcoin-only edition, at €149.00 including 19% VAT on https://shop.bitbox.swiss/en/products/bitbox02-80/, read 1 October 2026; no US dollar list price is published.
Best for: Firmware anyone can rebuild and match — 10/10
Secure element you can look up · weight 27%5/10Firmware anyone can rebuild and match · weight 27%10/10Proof the device is genuine and unmodified · weight 12%7/10Key creation and signing you can check · weight 12%10/10Sign and recover without the maker · weight 11%10/10Years in buyers' hands without a device-level fund loss · weight 11%10/10
Quick pick
Blockstream Jade Core
USB-C and Bluetooth signer at $99 with a per-unit Genuine Check — no secure element; the Jade Plus ($149) scores the same
USB-C and Bluetooth signer at $99 with a per-unit Genuine Check — no secure element; the Jade Plus ($149) scores the same. Strongest on firmware anyone can rebuild and match (10/10): A WalletScrutiny reviewer rebuilt Jade Core firmware 1.0.41 from source and matched both published Core images, Bluetooth and no-radio, recorded on 2 September 2026. Weakest on secure element you can look up (4/10): Jade Core has no secure element; its PIN is checked by a blind oracle whose code is open and which an owner can run themselves. Published price: Blockstream Jade Core: the US store's product data reads "price":"99.00" with no compare-at price (US dollars), read 2 October 2026 from https://store.blockstream.com/products/blockstream-jade-core.json?country=US.
Best for: Firmware anyone can rebuild and match — 10/10
Secure element you can look up · weight 27%4/10Firmware anyone can rebuild and match · weight 27%10/10Proof the device is genuine and unmodified · weight 12%7/10Key creation and signing you can check · weight 12%10/10Sign and recover without the maker · weight 11%10/10Years in buyers' hands without a device-level fund loss · weight 11%5/10
Considered and not ranked
20 products we looked at and left out
A shortlist is only honest if it says who it turned away. Each of these was assessed against the same published criteria as the ranked table and excluded for a stated reason — not overlooked.
We assessed 43 products here and rank 23 — 53% of what we looked at. That share is of the products we assessed, not of the category: how many exist is not something we can count, so we do not claim a number for it.
SeedSigner· Different jobArculus· Evidence incompleteD'CENT· Evidence incompleteBallet· Different jobBC Vault· Evidence incompleteProkey· Reason belowimKey· Evidence incompleteELLIPAL Titan· Evidence incompleteBitkey (Block)· Ranked elsewhereNGRAVE ZERO· Evidence incompleteCoinkite SATSCARD· Different jobCoinkite TAPSIGNER· Evidence incompleteSecuX Neo· Evidence incompleteOpendime· Different jobKrux· Different jobSpecter DIY· Different jobCoinkite SATSCHIP· Different jobSatochip Satodime· Different jobSatochip Seedkeeper· Different jobKeystone ForgeBox· Different job
What this ranking does not assess
Every other failure family that applies to this category is scored by one of its criteria.
Information failure is shown but not scored: it appears as dated entries on each provider page's incident timeline.
These can still cost you money here; the ranking does not measure them, so a high place says nothing about them. Which criterion scores each family, and why the others do not apply, is in /data/risk-coverage.json.
Quantum exposure: which signature scheme each product here relies on, and what it has published about post-quantum readiness, as of 15 October 2026. Read the explainer. It changes no score.
How this ranking is built
Reviewed on six ladders, each graded on the model the row prices: the maker's cheapest, or a separately sold model whose scores differ on two or more criteria: a secure element whose part number and certificate the certification registries list, firmware an independent reviewer has rebuilt from source and matched to the shipped binary, a check that proves the unit genuine and unmodified before you load it, key creation and signing you can check against bad firmware, signing and recovering with independent wallets and no maker server, and years in buyers' hands without a device-level fund loss. Air-gapped signing, Bitcoin-only builds, connectivity, coin support and price are shown as facts, not scored; in Find my best, air-gapped signing, a Bitcoin-only firmware and signing on other chains are requirements you can set.
Data checked Oct 2026 · Independent rankings · We show our work
ReviewedNext review by Published Methodology v2026.11.1
How this page is reviewed
Reviewed means every product ranked on this page was read against its sources on or after that date; every ranked category is re-read at least every 45 days. Models research, extract and parse. A deterministic engine ranks. Every quote passes an adversarial refute pass.
BitBox02 Nova ranks #1 overall for hardware wallets on ChainChoice. EAL6+ secure chip and firmware rebuilt and matched, with Bluetooth — new in 2025, €175. It holds that rank under an affiliate-blind methodology scored across 6 published, weighted criteria — the code that ranks providers physically cannot read affiliate payouts (CI-enforced), so a payout can't move a rank. The verdict re-computes on every fee change, incident, or regulatory action; the full reasoning and the audit receipt are under Methodology.
How you can lose money here, and what the ranking scores
Key failure: your own keys are made, shown or recovered unsafely.
Scored by Secure element you can look up · 27% (BitBox02 Nova 10/10, Trezor 10/10, BitBox02 5/10)
Scored by Firmware anyone can rebuild and match · 27% (BitBox02 Nova 10/10, Trezor 10/10, BitBox02 10/10)
Scored by Proof the device is genuine and unmodified · 12% (BitBox02 Nova 7/10, Trezor 7/10, BitBox02 7/10)
Scored by Key creation and signing you can check · 12% (BitBox02 Nova 10/10, Trezor 7/10, BitBox02 10/10)
Scored by Sign and recover without the maker · 11% (BitBox02 Nova 10/10, Trezor 10/10, BitBox02 10/10)
Scored by Years in buyers' hands without a device-level fund loss · 11% (BitBox02 Nova 5/10, Trezor 7/10, BitBox02 10/10)
Every failure family that applies to this category is scored, except Information failure, which the provider pages show as a fact.
FAQs
3 questions readers ask before choosing hardware wallets.
Frequently asked
Questions people ask before choosing hardware wallets
What is the safest hardware wallet?
No device wins everywhere, so we grade six things a buyer cannot easily check alone: whether the secure element has a certificate the registries list, whether independent reviewers have rebuilt the firmware and matched it, whether you can prove the unit genuine before loading it, whether you can check how its key was made and that it signs honestly, whether you can sign and recover without the maker, and how long the model has been in buyers' hands without a device-level fund loss. On those, the BitBox02 Nova leads today by one point over the Trezor Safe 3. Two records are named in their rows rather than hidden: a July 2026 seed-generation flaw that cost COLDCARD owners funds (fixed in firmware 5.6.0), and a 2026 laser attack on Tangem's card chip that Tangem cannot patch.
Why isn't Ledger ranked #1?
Ledger's Nano S Plus has a certified chip anyone can look up, the same top score the BitBox02 Nova and the Trezor Safe 3 earn, and a longer clean record than either. It falls behind on three criteria: its operating system is closed, so no one outside Ledger can rebuild what signs; installing a signing app needs Ledger's live servers; and nothing lets a buyer check how its key was made or that it signs honestly. Our ranking is affiliate-blind: a partnership never moves a provider up.
Is open-source or a secure element more important?
We weight them equally because they answer different attacks: a certified secure element resists someone holding the device, and firmware an independent reviewer has rebuilt and matched shows the device runs the code anyone can read. The secure element's own firmware is closed by necessity, so the firmware score looks at the code that parses and signs. If one matters more to you, choose it as a priority in Find my best and its weight doubles.
Free advisor·No signup needed
Still unsure? Get your best hardware wallets pick
Answer a few quick questions and get one clear recommendation based on how you actually plan to use crypto — then review the evidence before deciding.
No signup·Free first pass · Private·No spam · No account
Not financial advice · Independent · Always do your own research
Best picks
Best hardware wallets in 2026
BitBox02 Nova leads by one point over Trezor's Safe 3. Both have a certified chip you can look up, firmware independent reviewers have rebuilt and matched, and independent wallets that sign without the maker's servers; both let a buyer check how the key was made, and the Nova adds anti-exfil signing, which checks that its signatures leak nothing (Taproot, typed-data and Cardano signatures excepted), while the Safe 3 has the longer record. The original BitBox02 follows. Ledger and OneKey have certified chips, but neither lets you check how the key was made, and Ledger's operating system is closed. For air-gapped signing, Keystone and the Keycard Shell lead; for Bitcoin only, or for coins on other chains, set it as a requirement in Find my best.
Best overall
BitBox02 Nova
EAL6+ secure chip and firmware rebuilt and matched, with Bluetooth — new in 2025, €175
Data checked Oct 2026
EAL6+ secure chip and firmware rebuilt and matched, with Bluetooth — new in 2025, €175. Strongest on secure element you can look up (10/10): The Nova names its secure chip, 'OPTIGA™ Trust M V3', which Infineon's datasheet ties to one certified part (BSI-DSZ-CC-0961, EAL6+); the seed is kept encrypted under that chip and the owner's password. Weakest on years in buyers' hands without a device-level fund loss (5/10): No device-level fund loss is on record for the Nova ('We have no reports of lost funds'), but it first shipped in 2025; two secure-chip configuration issues disclosed that October were fixed in firmware 9.25.0. Published price: BitBox02 Nova, Multi edition, at €175.00 including 19% VAT on https://shop.bitbox.swiss/en/products/bitbox02-nova-79/, read 1 October 2026; no US dollar list price is published.
