Step by step: how setup usually looks (short form)
- Connect device to desktop or mobile (USB or Bluetooth where available).
- Select "Set up as new device" on the device screen.
- Choose a PIN (4–8 digits depending on firmware).
- Write down the recovery seed phrase exactly as shown — typically 24 words (BIP-39 common).
- Confirm a few words on-screen when prompted.
- Install coin apps with the companion app and update firmware if required.
Screens vary by model, but the flow is consistent. In my testing the larger screens on the S Plus and X make confirming words easier and less error-prone.
For a full, device-specific walkthrough see: setup-nano-s, setup-nano-s-plus, setup-nano-x.
Daily use: app capacity, connectivity, and UX
Small memory means more app juggling. I’ve swapped apps several times a month on the original Nano S when holding many different tokens. On the S Plus, app churn drops noticeably. On the Nano X, the larger internal capacity lets me keep most coin apps installed all the time (convenient if you manage many chains).
Connection choices matter. USB-only devices require a cable and keep the device physically attached during signing. Bluetooth offers convenience for mobile transactions, but increases the attack surface (more on that below). USB vs Bluetooth vs NFC (the latter less relevant for these models) should be a conscious trade-off for your threat model.
If you want a purely air-gapped signing workflow you can pair a desktop that never touches the internet with a USB-only device. But if you require daily mobile transactions without cables, Bluetooth is a practical compromise.
Learn more about connection security: bluetooth-usb-nfc-security.
Security architecture: secure element, firmware, and air-gapped signing
All three models use a secure element to protect private keys. The secure element isolates the sensitive cryptography from the host, making remote key extraction far harder. I believe hardware-backed isolation is non-negotiable for self-custody.
Firmware matters. During updates I verify authenticity before applying. Firmware updates patch vulnerabilities and add features, but applying an update requires trust in the update path. Verify update signatures and follow firmware-update-guide and supply-chain-security-verification.
Air-gapped signing reduces exposure further. You can construct transactions on an offline machine and sign them on the hardware wallet that is never connected to the internet. That’s higher friction. But for long-term cold storage it’s worth the effort.
Seed phrase, passphrase (25th word), and backups
Most devices present a 24-word seed phrase (BIP-39 common). I always write the words on a physical backup and store that backup in a secure, geographically separated place. Think of your seed phrase like the master key to a safe deposit box. If someone gets it, they get everything.
Passphrase (the optional "25th word") adds plausible deniability and an extra security layer, but it can also lock you out permanently if you forget it. Use a passphrase only if you have a survivable plan for inheritance and recovery. See the practical guide: passphrase-25th-word-guide.
Metal backup plates survive fire, water, and time. I switched to stainless steel plates years ago for long-term holdings. See options and methods at seed-backup-plates.
Shamir backup (SLIP-39) is an alternate split-seed approach used by some wallets. Check compatibility before planning a split backup: some models do not implement SLIP-39 natively. Read more at slip39-shamir-backup.
Multisig and advanced cold-storage strategies
Multisig (multiple-signature) setups remove single points of failure. Instead of one device + seed phrase, you can require k-of-n devices to sign transactions. Who is this for? Custodians, funds, and high-value holders who want geographic distribution of signers.
All three models can participate as signers when used with compatible wallet software (Electrum, Sparrow, or other multisig tooling), provided the apps and firmware cooperate. For setup and practical examples see multisig-for-ledger and cold-storage-strategies-single-vs-multisig.
In my experience, multisig shifts complexity from device security to operational security — you must coordinate key custody, backups, and recovery procedures among signers.
Common mistakes and safety checklist
- Buying from unofficial sellers (risk: tampered device). See buying-safely-and-supply-chain.
- Exposing the seed phrase when photographing or storing it insecurely.
- Blindly installing mobile apps or browser extensions from unknown sources.
- Using Bluetooth without understanding your threat model.
A short safety checklist I use every time: verify packaging, initialize the device myself, write the seed phrase by hand, apply firmware updates after verifying signatures, store backups in separate locations. Simple. Effective.
For a longer list see common-mistakes-phishing.
FAQ
Q: Can I recover my crypto if the device breaks?
A: Yes. If you have the recovery seed phrase and any passphrase, you can restore private keys on another compatible hardware wallet or software that supports BIP-39. See recover-if-device-lost.
Q: What happens if the company behind the device goes bankrupt?
A: Your private keys are controlled by your seed phrase and passphrase. Company insolvency does not inherently lock your crypto, though software support and firmware signing tools may change. Keep up-to-date backups and export any critical recovery instructions.
Q: Is Bluetooth safe for a hardware wallet?
A: Bluetooth adds convenience and some additional attack surface. In my testing Bluetooth pairing is practical for mobile users, but you should weigh convenience against your personal threat model and consider disabling Bluetooth if you prefer a minimal attack surface.
Conclusion & next steps
Choosing between these models comes down to trade-offs: portability and mobile convenience vs minimal attack surface and simplicity. I prefer the model that matches how I use crypto day-to-day rather than the flashiest feature. If you want more detail, read the hands-on reviews and step-by-step setup guides linked here: Nano S full review, Nano S Plus full review, Nano X full review, and the firmware-update-guide.
Ready to pick a model to explore further? Start with the device review that matches your use case (links above) and follow the setup guide that fits your workflow: setup-guide-overview.
