Hardware vs software wallets

What does a crypto wallet actually store?

Ethereum's official wallet page makes a point that clears up most confusion: a wallet is a tool that lets you interact with your account using your keys. Your coins and tokens are recorded on the blockchain itself. What the wallet guards is the private key, the secret that signs transactions, plus the seed phrase that can regenerate it.

So the difference between wallet types is not where your money is. It is where the signing key lives and how often it sits on a machine that is online. A key on a laptop that browses the web, opens email attachments and installs extensions faces far more threats than a key on a device that does nothing but sign.

Ethereum.org lists five broad kinds of wallet: physical hardware wallets, mobile apps, browser wallets, browser extensions and desktop apps. The last four are software wallets, often called hot wallets because the key lives on an internet-connected device.

How do hardware, software and exchange wallets compare?

Many people start with a third option: an account at a crypto exchange, where the company holds the keys for you. The table puts all three side by side.

Ethereum.org notes the trade-off with exchanges directly: you get a username and password you can recover in the usual way, but you are trusting the exchange with custody, and if it gets into financial trouble your funds are at risk. Before using one, check its licence with how to check if a platform is registered.

How does a hardware wallet sign without exposing the key?

The idea is older than hardware wallets themselves. Bitcoin.org describes offline signing with two computers: one that never goes online holds the keys and signs, while a second, online computer broadcasts the signed transaction. A hardware wallet packs the offline half into a small device built to do nothing else, which bitcoin.org calls the best balance between very high security and ease of use.

The signature proves you approved the transaction, but it does not contain the private key. So even if the computer that relays it is infected, the attacker gets a signed transaction for the exact amount and address you approved, not the key that would let them sign anything they like.

When does a software wallet make sense?

Software wallets are not a mistake. They are usually free, quick to set up and practical for small, frequent payments or for trying an app. The useful habit is to size what each wallet holds to the risk it faces. Bitcoin.org's guidance is to keep only small amounts on a computer or phone for everyday use and to keep savings offline.

Browser extensions deserve extra care. Ethereum.org warns that many extensions ask for permission to read and change site data, and that automatic updates can slip in malicious code. Install only from trusted sources and remove extensions you no longer use.

What can a hardware wallet not protect you from?

A hardware wallet guards the key. It cannot judge whether the transaction you approve is a good idea.

• A leaked seed phrase. The recovery words rebuild the key on any device. If someone has them, the hardware is irrelevant. See seed phrases explained.
• Approving a malicious contract. On Ethereum-style chains, an ERC-20 approval lets a contract withdraw your tokens later, up to the limit you set. If you sign one for a scam site, your device has done exactly what you asked. Our guide to token approvals and wallet drainers covers this.
• Sending to the wrong address. Blockchain transfers cannot be reversed. Ethereum.org's advice is to check that the destination matches the intended address exactly; address poisoning is built to defeat a quick glance.

What mistakes do beginners make when choosing a wallet?

• Treating the device as the backup. Devices get lost, broken or stolen. The seed phrase, written down and stored safely, is the backup.
• Using a device that someone else set up. Whoever saw the recovery words during setup can rebuild the wallet. Always generate a fresh phrase yourself.
• Typing the hardware wallet's seed phrase into a computer. Doing so copies the offline secret onto an online machine and undoes the point of the device.
• Keeping everything on an exchange by default. That can be a reasonable choice, but it is a different kind of risk, not no risk.
• Signing what you have not read. If the address or amount on screen is not what you expected, reject the request.