How We Chose the Best Air-Gapped Bitcoin Wallet
An air gap separates the signing device from an internet-connected computer or phone. Transactions cross that boundary through QR codes, microSD cards, or another controlled channel instead of a persistent USB, Bluetooth, or Wi-Fi connection.
That isolation can reduce exposure to compromised computers, hostile USB stacks, and some remote attacks. It does not prove that a wallet is secure. A device can remain offline while generating weak private keys, displaying a substituted address, installing malicious firmware, or parsing a dangerous QR code or transaction file.
Our comparison therefore emphasizes five factors: how unsigned and signed transactions move between devices, whether the hardware displays enough information for meaningful verification, how firmware is authenticated and updated, how seed entropy is produced, and whether an ordinary owner can repeat the process without taking shortcuts.
Readers unfamiliar with the underlying device category should first review how hardware wallets protect Bitcoin. Air-gapped signing is one security architecture within that larger category, not an automatic replacement for careful backups, firmware checks, and physical security.
Quick Comparison
These rankings focus on Bitcoin transaction signing rather than the number of supported coins or extra applications.
- Foundation Passport, best overall: A polished Bitcoin-only device with a large screen, camera, removable batteries, and a straightforward QR workflow. It offers the best balance of isolation and usability for most dedicated Bitcoin holders.
- SeedSigner, best stateless option: A do-it-yourself, Bitcoin-only signer that forgets the seed after shutdown. It is highly transparent but requires more setup knowledge and careful handling of the seed backup used to reload it.
- Blockstream Jade, best value: An accessible device with QR-based signing available. Some owners also use its wired or wireless features, so maintaining an air gap depends on the chosen setup and workflow.
- Coldcard Q or Mk5, best for advanced PSBT workflows: Deep Bitcoin-specific controls and mature microSD signing, but the 2026 entropy incident requires a prominent qualification and immediate action from affected owners.
- Keystone 3 Pro, best large-screen multicoin option: A camera-based signing experience with a spacious touchscreen. Its broader asset support creates a larger software scope than a Bitcoin-only device.
No device eliminates the need to verify the destination address, amount, fee, and change outputs on its trusted display. Read our guide to verifying Bitcoin addresses safely before moving a large balance.
1. Foundation Passport
Best for: People who want a dedicated Bitcoin-only wallet with a refined QR workflow.
Passport exchanges animated QR codes with compatible coordinator software. The internet-connected phone or computer constructs an unsigned partially signed Bitcoin transaction, commonly called a PSBT. Passport scans it, displays the transaction details, signs internally, and returns the signed data through another QR code. The private keys never need to enter the online device.
The large screen and physical controls make address and amount review less cramped than on small hardware wallets. Removable batteries also let the device operate without a data cable. Firmware updates still cross the isolation boundary, so owners must obtain releases from the legitimate source and follow the device's signature-verification process.
Passport is our best overall choice because its everyday workflow makes the security model visible. The owner deliberately moves transaction data in each direction and confirms the result. Its main disadvantages are cost and a larger physical footprint than compact devices. Buyers should also confirm that their preferred desktop or mobile coordinator supports the exact Passport workflow they intend to use.
2. SeedSigner and 3. Blockstream Jade
SeedSigner: best for stateless signing
SeedSigner is built around inexpensive general-purpose components configured without wireless networking. It normally loads a seed from a SeedQR backup, signs a transaction, and clears the secret when powered down. A stolen device therefore need not contain a persistent seed.
Statelessness changes the threat model rather than removing risk. The SeedQR or other backup becomes part of every signing session and must be protected from cameras, visitors, and physical theft. Building the unit, obtaining suitable parts, validating the software image, and operating the camera workflow also demand more confidence than buying a finished appliance.
SeedSigner is compelling for users who value auditable components and do not mind a hands-on process. It is a poor choice for someone likely to leave a SeedQR exposed for convenience.
Blockstream Jade: best value
Jade can sign Bitcoin transactions through QR codes when configured for that workflow. It is compact, comparatively affordable, and supported by established Bitcoin wallet software. This makes it a practical introduction to offline QR signing.
However, Jade also supports connection methods that are not air-gapped. A buyer must distinguish what the device can do from how it is actually being used. Connecting it over USB or Bluetooth may still be reasonable for some threat models, but that session should not be described as air-gapped.
Jade's security architecture also differs from devices built around a conventional local secure element. Owners should understand its authentication model, recovery process, and any coordinator requirements before funding it. For modest balances and disciplined QR use, it offers considerable capability at a lower entry cost.
4. Coldcard Q and Mk5: Read the 2026 Security Update
Best for: Experienced users who want Bitcoin-only controls, PSBT signing, microSD transport, and advanced multisignature features.
Coldcard has long offered one of the clearest offline transaction workflows. A watch-only wallet creates a PSBT, the file moves to Coldcard on a microSD card, the device displays and signs it, and the signed transaction returns to an online machine for broadcast. The Q adds a larger screen, full keyboard, and QR scanner. Optional connection features should remain disabled if strict isolation is the goal.
The July 2026 entropy incident
In July 2026, Coinkite disclosed a seed-generation weakness affecting seeds created on Mk2 or Mk3 firmware 4.0.1 through 4.1.9, Mk4 and Mk5 firmware before standard 5.6.0 or Edge 6.6.0X, and Q firmware before standard 1.5.0Q or Edge 6.6.0QX. The official warning provides limited exceptions for seeds supplemented with at least 50 fair, independent, private dice rolls or protected by a strong, unique BIP-39 passphrase. Owners should not assume an exception applies without understanding it precisely.
The practical point is critical: installing fixed firmware does not repair an existing seed generated by affected firmware. Coinkite instructs affected users to install a corrected release, create a replacement seed using the approved process, verify the new wallet, and migrate funds. Follow the official Coinkite warning and migration guidance rather than improvising a transfer.
Coinkite's August 17 security-status guidance recommends standard firmware 5.6.1 for Mk4 and Mk5 and 1.5.1Q for Q. Current standard new-seed generation requires user-supplied entropy through at least 65 unpredictably timed key presses, 50 physical six-sided-die rolls, or 128 physical coin flips. The releases also add transaction-boundary and random-number-generator checks. For a new wallet holding a meaningful balance, Coinkite recommends a strong, unique BIP-39 passphrase after verifying the seed backup and testing recovery. These safeguards do not repair an affected existing seed, which still requires migration.
Block's independent analysis reported a predictable random-number fallback and limited reseeding, with exposure determined by the firmware used when the secret was generated, not the date the device was manufactured. Its technical report confirms that air-gapped communication did not prevent the underlying seed-generation failure.
Media and research firms have attributed large on-chain sweeps to exploitation of the weakness, but a transaction pattern alone does not prove theft, identify an attacker, or establish a final loss total. The confirmed issue is the vulnerable seed-generation path and the need for remediation.
Coldcard remains highly capable, but we cannot place it first after an incident that directly affected key creation. New buyers should verify current firmware before generating a seed. Existing owners should consult our detailed Coldcard Mk5 review only after addressing the official security notice.
5. Keystone 3 Pro
Best for: People who prioritize a large touchscreen and QR signing while managing more than Bitcoin.
Keystone 3 Pro uses a camera and animated QR codes to exchange transaction data with supported companion wallets. Its large display can make transaction review more comfortable, especially when compared with devices that show addresses in short segments.
The tradeoff is scope. Multicoin firmware must handle more protocols and transaction formats than a Bitcoin-only signer. That does not make the wallet inherently unsafe, but it increases the amount of software and behavior an owner must evaluate. Bitcoin-focused users should minimize unused features, confirm companion-wallet compatibility, and verify that transaction details are decoded clearly on the Keystone screen.
Keystone earns a place in this comparison for its usable QR experience, but Passport, SeedSigner, and Coldcard provide more focused Bitcoin environments.
Air-Gapped Workflows and Their Threat Models
QR codes
QR signing provides a visible, one-way transfer for each step and avoids removable media. Its risks include maliciously constructed QR payloads, camera vulnerabilities, incomplete transaction decoding, and accidental exposure of sensitive QR backups. Animated codes also move more data than a single static image, which increases parser complexity.
MicroSD cards
MicroSD workflows are convenient for large PSBTs and multisignature transactions. The card is still a bridge between the online computer and signer. Both devices must safely parse its filesystem and files. Use a dedicated card, keep it free of unrelated data, and never treat removable media as a magical one-way channel.
Stateless signers
A stateless device avoids retaining the seed between sessions, reducing what a thief can extract from the powered-off signer. The repeated seed-loading process increases exposure around the physical backup. This design works best in a private location with a carefully protected SeedQR or seed phrase.
What the air gap cannot prevent
- Weak or predictable seed generation
- Malicious firmware or compromised components
- Incorrect address verification by the owner
- Physical discovery of the seed backup
- A coerced transaction or exposed passphrase
- Loss caused by an untested recovery process
The Coldcard incident is the clearest 2026 example of this distinction. Communication isolation protected the keys from direct online contact, but it could not add entropy that was missing when the wallet secret was created. A complete custody plan must combine an appropriate signer with strong seed-phrase security practices.
Which Wallet Should You Buy?
Choose Foundation Passport if you want the strongest balance of Bitcoin-only focus, QR usability, and clear transaction review. Choose SeedSigner if stateless operation and transparent do-it-yourself construction matter more than convenience. Choose Jade if price is the main constraint and you are prepared to configure and preserve its QR workflow.
Choose Coldcard Q or Mk5 only if its advanced Bitcoin features justify the steeper learning curve and you will verify firmware status before generating or importing secrets. Anyone with a potentially affected Coldcard-generated seed should prioritize migration over shopping comparisons. Choose Keystone when a large touchscreen and broader asset support outweigh the simplicity of Bitcoin-only firmware.
If you do not genuinely need an air gap, a reputable conventional hardware wallet may be easier to operate correctly. Trezor is a non-air-gapped alternative that normally communicates over USB. It should not be described or ranked as an air-gapped wallet. Compare the wider market in our hardware wallet guide, then select the simplest architecture that addresses your actual risks.
Safe Setup Checklist
- Buy through a legitimate channel: Inspect the packaging and follow the manufacturer's device-authentication procedure. Packaging alone is not proof of integrity.
- Verify firmware first: Check the installed version and current security advisories before creating a seed. This is mandatory for any Coldcard in light of the July 2026 warning.
- Generate a new wallet privately: Keep cameras, phones, smart speakers, windows, and other observers away from the seed-generation area.
- Record the backup offline: Never photograph the words, store them in cloud notes, type them into a computer, or enter them into an unverified website.
- Create the watch-only wallet carefully: Confirm that the exported wallet information matches the intended seed, account, script type, and derivation path.
- Practice with a small amount: Receive Bitcoin, build an unsigned transaction, verify it on the signer, broadcast it, and confirm the result before transferring a larger balance.
- Test recovery: Restore the backup on an appropriate offline device and verify known receive addresses. A backup is only trustworthy after a successful test.
- Verify every spend: Check the full destination address, amount, fee, and change on the hardware display. Do not approve a transaction based solely on the online wallet's screen.
Air-gapped wallets are most useful when their deliberate workflow causes the owner to slow down and verify. If the extra steps become so burdensome that you bypass them, the theoretical advantage disappears. For a broader comparison of offline and connected custody, see cold storage versus hot wallets.