Trezor Suite setup, step by step

If the device is new and the app offers to create a wallet, follow that path — the device will generate the keys for you. If you are replacing a lost device, or simply moving to a new one, choose the recovery option instead and have your written seed in front of you. Never do both at once, and never let the app decide for you.

One more decision: use a device you bought directly from the manufacturer or an authorised reseller. A second-hand device with a "pre-set" wallet, or one that arrives with a seed already written on a card in the box, is compromised by design.

Open the manufacturer's own page — the one linked below — and download the desktop build for Windows, macOS or Linux. If you would rather not install anything, use the browser version instead. Avoid the temptation to click a sponsored search result or a link from a chat message; those are the two most common routes to a malicious build.

Once the page is open, bookmark it. From now on you reach the app through your bookmark, not through a search engine, and you will never have to guess whether a result was genuine.

Run the installer and open the app. On macOS you may have to approve the application the first time; on Linux the desktop build handles the device permissions for you, so you do not need any manual rules. Before you connect anything, look at the app's "About" panel once: it shows the version you are running, which is the baseline you want when checking for updates later.

Use the cable that came with the device — charge-only cables carry power but no data. Plug it directly into the computer rather than into a hub or docking station, then let the app detect it. In the browser version you will be asked to grant USB access: allow it, or the device stays invisible for the rest of the session.

On a brand-new device the screen walks you through the setup on the device itself. Follow what the device says rather than what your instincts say — this is where the hardware wallet teaches you how it works.

Suite will offer a firmware update if your device is running an older version. The update is downloaded from the manufacturer, its signature is checked, and the device asks you to confirm on its own screen. You do not need your seed for this, and no step of a genuine firmware update ever asks you to type it in.

Choose the "create new wallet" option in the app. The device generates the keys internally — nothing is generated on your computer. You will then be asked to set a PIN, which you enter by clicking positions on the device's screen grid, so the digits are never sent to the computer in the first place.

Pick a PIN you will remember and do not keep it next to the device. Some models let you use a long alphanumeric PIN if you prefer a passphrase-style code.

The device will display your recovery seed one word at a time. Write each word down by hand, in order, on paper — or stamp it into a metal plate if you want it to survive a fire. Check every word twice as you go. When you finish, the device usually asks you to confirm a few words back to prove you wrote them correctly; do that properly rather than skipping it.

Then put the paper somewhere deliberate: somewhere you will still have access to in five years, somewhere a visitor will not stumble across, and ideally not in the same building as a second copy if you make one. Never photograph it, never type it into a note or a password manager, never email it to yourself, and never let a cloud service sync it.

A passphrase is an extra secret that creates a separate hidden wallet, so that even someone holding your device and your recovery seed sees an empty wallet without it. It is genuinely useful — and genuinely dangerous, because a typo or a forgotten capital letter opens a different wallet with a zero balance, and the original stays hidden until you type it exactly right.

If you enable it, write it down with the same care as the seed and store it separately, so one discovery or one fire cannot take both. If you are not confident you can do that, skip it for now; it can be enabled later.

Add an account for Bitcoin, or Ethereum, or whichever networks you hold, and give each one a name and colour so the list stays readable. For Bitcoin you will be asked which address type to use — the modern default is right for almost everyone. Tokens such as ERC-20 or SPL assets appear inside their parent network's account rather than as separate entries.

If you have an existing balance elsewhere, this is the moment you will eventually move it — but only after step 10 and 11.

Open the account, choose receive, and copy the address or show the QR code. Compare the first and last characters of the address with what the device screen shows. Then send a small amount from wherever the funds sit today — an exchange, another wallet — and wait for it to appear and confirm.

Only after that arrives should you move anything significant. A test transaction costs a network fee and buys certainty.

Enter a destination, choose a fee level, and read what the device screen shows before you confirm: address, amount, and the fee. If anything on that screen disagrees with what your computer shows, cancel and start again. This habit is the whole point of having a device with a screen.