Setting Up a Hardware Wallet

Go: open a terminal in a folder you can write to, for example cd ~/Desktop (Windows: cd %USERPROFILE%\Desktop).

Do: save this as checksum.py and run python3 checksum.py. It builds a stand-in installer, records the checksum a vendor would publish, then alters exactly one byte of it — the signature of a hostile mirror or a modified download.

import hashlib

def sha256_of(path):
    h = hashlib.sha256()
    with open(path, "rb") as f:
        for chunk in iter(lambda: f.read(65536), b""):
            h.update(chunk)
    return h.hexdigest()

genuine = b"OFFICIAL WALLET INSTALLER v2.4\n" + bytes(4096)
open("wallet-setup.bin", "wb").write(genuine)
published = sha256_of("wallet-setup.bin")
print("checksum published by the vendor :", published)

tampered = bytearray(genuine)
tampered[2000] = 1
open("wallet-setup.bin", "wb").write(tampered)
downloaded = sha256_of("wallet-setup.bin")
print("checksum of the file you got     :", downloaded)
print("bytes different out of 4127      :", sum(a != b for a, b in zip(genuine, tampered)))
print("safe to run                      :", downloaded == published)

You should see: two checksums with nothing in common, from files that differ by a single byte:

checksum published by the vendor : 5aec94a2313fc8825545d7efd4b831e95fc8f2cf54a1f46841c91c8ad4d92402
checksum of the file you got     : db0f36469b28e4d1f8b9df94f9b9ffd18cd986da7eca09ffec1e90170f334791
bytes different out of 4127      : 1
safe to run                      : False

That total change from one altered byte is what makes checksums useful: a tampered installer cannot be made to keep the published number. On a real download you compare against the checksum on the vendor’s own site — typed in by hand from your own bookmark, never followed from the same page that offered the file, because an attacker who controls the download page also controls the checksum printed on it.

If not: PermissionError means the folder is not writable — move to your Desktop or home folder. If bytes different prints something other than 1, the index 2000 was changed; any position inside the file works, but the count should be one.

Go: same folder. This is the single most common way people lose money on a hardware wallet, and it happens before the device is even plugged in.

Do: save this as preseeded.py and run it. Imagine a card in the packaging with a recovery phrase helpfully pre-printed on it, and a seller who photographed that card before shipping.

import hashlib, unicodedata
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
from cryptography.hazmat.primitives import serialization

def first_address(phrase, passphrase=""):
    seed = hashlib.pbkdf2_hmac("sha512",
                               unicodedata.normalize("NFKD", phrase).encode(),
                               ("mnemonic" + passphrase).encode(), 2048)
    pub = Ed25519PrivateKey.from_private_bytes(seed[:32]).public_key().public_bytes(
        serialization.Encoding.Raw, serialization.PublicFormat.Raw)
    return hashlib.sha256(pub).hexdigest()[:40]

card = " ".join(["abandon"] * 11 + ["about"])

print("you set the device up with the card in the box:")
print("   your first receiving address :", first_address(card))
print("the seller photographed that card before shipping:")
print("   their computed address       :", first_address(card))
print()
print("same address, so the same coins:", first_address(card) == first_address(card))

You should see: one address, reached twice, by two different people:

you set the device up with the card in the box:
   your first receiving address : ed0f8784166e0abfff51a9aff9ba259d8c028ed3
the seller photographed that card before shipping:
   their computed address       : ed0f8784166e0abfff51a9aff9ba259d8c028ed3

same address, so the same coins: True

No hacking took place. The phrase is the wallet, so whoever else has read it is a joint owner who can empty the account at a time of their choosing — often months later, once you have moved in serious funds. A genuine device never gives you a phrase: it makes you write down words it generates on its own screen, in front of you. A pre-printed card, a phrase in an email, or a setup site asking you to type words in means the device is compromised. Buy from the manufacturer directly, and if a phrase arrives with the hardware, do not use it — not even “just to test”.

If not: ModuleNotFoundError: No module named 'cryptography' means the library is missing — run pip install cryptography. A different address than the one above means the phrase string differs; it is eleven abandons and then about, single-spaced.

Go: same folder. A passphrase is often called the “25th word”, which undersells what it does.

Do: save this as passphrase.py and run it. Same twelve words every time; only the passphrase changes.

import hashlib, unicodedata

def wallet_id(phrase, passphrase=""):
    seed = hashlib.pbkdf2_hmac("sha512",
                               unicodedata.normalize("NFKD", phrase).encode(),
                               ("mnemonic" + passphrase).encode(), 2048)
    return hashlib.sha256(seed).hexdigest()[:8].upper()

phrase = " ".join(["abandon"] * 11 + ["about"])

print("no passphrase        :", wallet_id(phrase))
print("passphrase 'holiday' :", wallet_id(phrase, "holiday"))
print("passphrase 'Holiday' :", wallet_id(phrase, "Holiday"))
print("passphrase 'holiday ':", wallet_id(phrase, "holiday "))

You should see: four completely unrelated wallets from one recovery phrase:

no passphrase        : 62A772F8
passphrase 'holiday' : 8C650F1D
passphrase 'Holiday' : 2AB35E62
passphrase 'holiday ': 11C59A92

This is the real feature: your twelve words open the wallet everyone expects, while the words plus a passphrase open a different one that leaves no trace on the device. Someone who forces you to unlock the wallet sees a genuine, working, modestly funded account. Nothing on the device reveals that another exists.

If not: if any two lines match, the passphrase argument is not reaching the salt — check the ("mnemonic" + passphrase) line. If every line is identical, you are calling wallet_id(phrase) four times.

Go: same folder, same output as step 3 — read it again before you continue.

Do: compare the last three lines. holiday, Holiday and holiday with a trailing space produced three unrelated wallets. To feel it, change your own copy to a passphrase you might genuinely pick, then run it once more with one character altered.

python3 passphrase.py

You should see: that no line in that output is ever an error. A wrong passphrase does not fail — it silently opens a different, empty wallet, exactly as a mistyped recovery phrase does.

So the passphrase is a second secret with none of the recovery phrase’s safety net: no word list, no checksum, no wallet warning you that it is wrong. Capital letters, spaces and accents all count. If you use one, back it up as carefully as the phrase and in a different place, and prove it works by restoring on a spare device before you fund it. People have lost everything to a passphrase they were certain they would remember.

If not: if you change the passphrase and the wallet id does not change, the edit was made to the wrong string — the passphrase is the second argument, and the phrase itself must stay untouched.

Go: same folder. The PIN protects the device if it is physically stolen — and only then.

Do: save this as pin.py and run it. It assumes a machine pressing the buttons at five guesses per second.

def seconds_to_words(s):
    for unit, n in (("years", 31557600), ("days", 86400), ("hours", 3600), ("minutes", 60)):
        if s >= n:
            return f"{s / n:,.1f} {unit}"
    return f"{s:.0f} seconds"

RATE = 5          # guesses per second by a machine pressing the buttons

for digits in (4, 6, 8):
    combos = 10 ** digits
    print(f"{digits}-digit PIN: {combos:>9,} combinations, "
          f"average crack time {seconds_to_words(combos / 2 / RATE)}")

print()
print("with a device that wipes itself after 3 wrong PINs:")
print(f"  4-digit PIN: attacker gets 3 of 10,000 guesses = "
      f"{3 / 10000:.2%} chance before the secret is erased")

You should see: the case for both a longer PIN and an attempt limit:

4-digit PIN:    10,000 combinations, average crack time 16.7 minutes
6-digit PIN: 1,000,000 combinations, average crack time 1.2 days
8-digit PIN: 100,000,000 combinations, average crack time 115.7 days

with a device that wipes itself after 3 wrong PINs:
  4-digit PIN: attacker gets 3 of 10,000 guesses = 0.03% chance before the secret is erased

Sixteen minutes is how long a four-digit PIN survives a patient thief with a cheap button pusher — if nothing stops them trying. The wipe-after-N-attempts rule, which every reputable device implements, is what converts that into a 0.03% chance. Both matter: set the longest PIN you will reliably remember, and never disable the attempt limit. And note what the PIN does not do — it protects the device, not the phrase. Anyone who reads your written phrase does not need the device at all.

If not: ValueError: Invalid format specifier means the :>9, inside the f-string was mistyped — it is a colon, a greater-than sign, a nine and a comma. If the times look wildly different, check that RATE is 5 and that the division is combos / 2 / RATE.