Coldcard Mk4 / Q1
Coinkite
✓ Open source✓ Air-gapped✓ BTC only
The operator-grade signing device. The Coldcard has the longest track record in the BTC-only category and the device most multisig setups in the operator class hold at least one quorum slot for. Mk4 is the keyless model: dual secure elements, PSBT-over-microSD for air-gapped signing, optional NFC for mobile workflows, runs on USB or battery pack. Q1 is the keyboard variant: full QWERTY for long passphrases, 3.2″ LCD, built-in QR scanner with LED illumination, dual microSD slots, AAA-battery powered. Both are open source, both reproducibly buildable, both ship from a vendor whose entire product line is Bitcoin signing devices.
Operator notes. UX is deliberately not friendly — the device assumes you know what you're doing and lets you brick yourself if you don't. Anti-phishing words, duress PINs, brick-me PINs, login countdown, Seed Vault, Key Teleport for multisig coordination. Setup difficulty: moderate; the docs are excellent if you actually read them. Durability is the strongest in the category — Coinkite has been shipping signing devices since 2018 and the failure data is public.
Who it's for: the operator who wants the strictest BTC-only signing path and is willing to read the documentation. Honest caveats: the Mk4 UI is utilitarian; if you want a polished interaction, buy the Q. The clear case is part of the security model (tamper-evidence) and looks more austere than the marketing photos suggest.
From ~$130–$220Mk4 / Q1
Buy at Coinkite(affiliate)
Passport (Core firmware)
Foundation Devices
✓ Open source✓ Air-gapped✓ BTC only
The most beautiful air-gapped signer in the category and the most design-forward open-source Bitcoin hardware shipping out of the US. Passport runs Foundation's Core firmware — Bitcoin-only by design — and signs via QR-code exchange and microSD; the device has no USB data port that touches keys, which makes the air-gap an architectural property rather than a configuration choice.
Operator notes. The UX is the cleanest in the eligible set — physical buttons, clear screen, intuitive flow, an iOS / Android companion app (Envoy) for portfolio view and fee-rate signal without the keys ever leaving the device. Setup is the friendliest in the category; if you've handed a hardware wallet to a partner who refused to learn the workflow, this is the device to try second. The hardware is assembled in the USA in an audited facility, the security chip is Microchip's, and the device has been Keylabs-audited.
Who it's for: the operator with a household or a family they're trying to bring into self-custody, where approachability matters as much as purity. Honest caveats: Foundation expanded the product line in 2026 with Passport Prime — a multi-credential device (Bitcoin + 2FA codes + security keys + encrypted files) at a higher price point — which broadens the brand beyond strict BTC-only signing. The Passport Core firmware path is the line item this list endorses; verify which device and firmware variant you're buying before checkout.
From ~$200–$260Core firmware
Buy at Foundation(affiliate)
SeedSigner
SeedSigner project (DIY)
✓ Open source✓ Air-gapped✓ BTC only
The DIY signer that converted “build your own hardware wallet” from a slogan into something an average operator can actually do in an afternoon. SeedSigner runs on a Raspberry Pi Zero (the WiFi-less 1.3 revision specifically), a small camera, a small screen, and a 3D-printed case; the software is a custom Linux image that loads to RAM, holds no persistent secrets, and signs PSBTs via two-way QR code exchange.
Operator notes. Stateless by design — every time you power it down, the secret is gone, and you re-enter the seed (or scan a SeedQR backup) the next time you want to sign. That property is the whole feature. Camera-based signing means the device never needs a USB connection to a computer, ever. Setup difficulty is the highest in the eligible set; expect an afternoon for the first build, less if you buy a kit. Pre-built devices are available from several third-party sellers in the $120–$180 range — fine if you trust the seller and verify the firmware hash on first boot.
Who it's for: the operator who wants the strictest air-gap property the category supports (no persistent key storage, no USB, no battery, no Bluetooth) and is comfortable with a build process. Honest caveats: the form factor is breadboard, not retail. If “looks like a finished product” matters, Passport is the answer. The stateless model is a strength but also a workflow change — you'll be entering or scanning the seed every signing session.
~$60–$80 DIY~$120–$180 pre-built
Project · seedsigner.com
Krux
Krux project (DIY)
✓ Open source✓ Air-gapped✓ BTC only
The lower-cost DIY alternative to SeedSigner, with the same operator logic and a different bill of materials. Krux runs on M5StickV or M5StickC PLUS hardware — small handheld devices with camera, screen, and battery integrated — and uses the same air-gapped, camera-based PSBT signing flow.
Operator notes. The parts list is shorter than SeedSigner's, the assembly is closer to “flash and use” than “build”, and the form factor is more pocketable. Stateless by default, with optional persistent storage if you explicitly enable it (most operators leave it off). Setup difficulty is the lowest in the DIY tier; if you've ever flashed firmware to a board, you can build a Krux signer in twenty minutes. The community is smaller than SeedSigner's but the docs are solid.
Who it's for: the operator who wants a DIY signer in their pocket as a backup or travel device. Honest caveats: the M5Stick hardware is sourced from a single vendor (M5Stack), which is a supply-chain dependency to acknowledge. Smaller community than SeedSigner — at 11pm the answer might come from one of two people instead of twenty. Verify the firmware hash on first boot, every time.
~$50–$80 DIYM5Stick
Project · selfcustody.github.io/krux