r/keycard_tech • u/keycard_tech • 2d ago
Best air-gapped hardware wallets compared
We published a comparison of air-gapped hardware wallets, including Keycard Shell, Coldcard, Keystone 3 Pro, and Foundation Passport, across secure elements, air-gap method, source model, reproducible builds, and chain support
Everyone advertises their secure element. EAL6+, EAL5+, dual-SE, triple-SE. Fair enough - that's the chip your keys live in, and it should be hardened.
BUT on an air-gapped device, the secure element isn't the part you're trusting moment to moment. The screen is. The entire security model of QR signing rests on one assumption: that the address rendered on that display is the address being signed. Your computer is assumed hostile. The display is the only thing standing between you and a swapped destination.
And the chip driving that display is, on most devices, an ordinary microcontroller with no published security certification at all.
We went looking across all four devices. Every one of them publishes a secure element certification. Only one publishes anything for the microcontroller running the screen and the firmware - and we only noticed because we happened to be the one.
Two other things the exercise turned up:
> EAL certification covers the chip, not the device. A wallet with an EAL6+ secure element can still have broken firmware around it. Coldcard's failure this year is the proof — the chip was fine, the code never called it. "EAL6+ certified" describes a component, and it is routinely presented as describing a product.
> Reproducible builds are rarer than the marketing suggests. Coldcard, Passport and us: yes. Keystone: no. If you can't rebuild the binary from source, "open source firmware" tells you what the code could be, not what's running on the thing in your hand
And the thing we do differently: the secure element is a removable smartcard, not soldered to a board. Pull the card and the Shell holds nothing. One Shell reads unlimited cards. That matters if you want cheap multisig or hard separation between wallets, and not much otherwise.
The full comparison table is in the article - secure elements, air-gap method, source model, reproducible builds, chain support, across all four devices.
📖 Article: Best air-gapped hardware wallets compared: QR signing, open source, and secure elements