Keystone 3 Pro review: an air-gapped Bitcoin wallet setup

The part of the Keystone 3 Pro setup that stays with me is how little of it depends on a computer connected to the internet. ForrestHODL walks through the whole thing in an August 2026 video: the device holds the private keys, shows every transaction on its own screen, and passes data back and forth as QR codes rather than through a cable. By the end he has a Bitcoin-only wallet, a written seed phrase, a passphrase kept separately, and a signed transaction that went out without the signing device ever touching the network.

What the Keystone 3 Pro is

A hardware wallet is a small computer built to keep private keys away from the internet. Those keys prove ownership of coins, and anyone who copies them can spend the balance, so the device stores them somewhere a browser tab cannot reach. The Keystone 3 Pro goes a step further by working air-gapped: it never connects to another machine by cable or wireless link. Information moves through the camera on the front, which reads QR codes, and the screen, which displays QR codes for a companion app to scan.

The hardware is small and plain. A USB-C port sits at the bottom, with a micro SD slot beside it, a camera on the front, a fingerprint sensor on the back and a power button on the side. The box holds a USB-C to USB-C cable and a set of cards for writing down a recovery phrase, printed in several languages.

Keystone ships three firmware variants, and the owner picks one during the update:

Keystone adds coins to the Multi-Coin build over time, the creator says. He chose the Bitcoin-only build, and the rest of the setup uses it.

Three secure elements, and where trust still sits

Most hardware wallets keep secrets inside one secure element, a chip built to resist extraction and tampering. The Keystone 3 Pro uses three. The creator's argument is about spreading risk: with one chip you trust that chip, its maker and its firmware to carry no back door and no flaw waiting to be found. Split the secret across three, and a weakness in one of them is not enough on its own.

That argument assumes the three elements really are independent, come from separate sources, and are tied together by sound firmware. I read the claim as raising the cost of an attack. Keystone still writes the firmware and signs the updates, and the seed phrase you write down is what decides whether your coins survive.

The device also offers dice rolls as an entropy source. Instead of relying on its internal random number generator, you roll physical dice, type the results in, and the device turns that data into a seed phrase. The creator treats this as the option for someone who wants to trust the hardware less, and he points to an entropy bug on Coldcard MK3 devices that cost some owners Bitcoin. A separate tutorial on the dice roll is promised. Dice only help if the rolls are recorded and entered correctly, and they do not protect you from a device that misbehaves after the fact.

What you need before you start

The update path runs through a micro SD card, so you need a card and a computer with a reader. The creator bought one card for this device and uses it nowhere else, a habit I would copy: a card that travels between machines can carry whatever those machines carry. You also need a desktop computer with Sparrow Wallet installed, since Sparrow has no mobile version, a pen, the recovery cards from the box, and a power adapter. The firmware update asks for at least 40% battery with the device plugged in.

Buy from Keystone or an authorised reseller rather than a marketplace listing. A sealed box with its tamper strip intact is the first thing to look at, and a device that arrives with a seed phrase already generated is a trap, not a shortcut.

Setting up the device, step by step

1. Check the tamper strip on the back of the box before you open anything. It is obvious once it has been pulled.
2. Press the power button on the side, choose your language and tap next.
3. Verify the device. Open a private Tor window in your browser (Brave, in the demo), load the verification page, tap Verify device and then Scan QR code, and point the device's camera at the code on screen. Type the code the device displays into the website and press verify.
4. Download the firmware you want from the official Keystone site and copy the file to your micro SD card.
5. Insert the card with the pins facing up toward you, tap Firmware update and confirm.
6. Plug the device into a charger, keep it above 40% battery and press start on the security update. It takes about five minutes.
7. When the device returns to the update screen, press skip. It never says the update finished. You learn it by trying again and being told your version is equal to or greater than the update, a step the creator found unclear.
8. Choose Create wallet. Import wallet is for restoring a seed you already have.
9. Set a PIN and confirm it. The device warns if the PIN is easy to guess and will let you keep it anyway. The creator advises against that, because the PIN encrypts and decrypts the seed phrase on the device.
10. Name the wallet, then press the three dots if you want to change the entropy source or turn on a passphrase before the seed is generated.
11. Pick 12 or 24 words, write them down in order on the recovery card and check them visually. The card runs left to right rather than top to bottom, which caught the creator out on his first attempt.
12. Confirm the seed by tapping the words on screen in the order you wrote them, then enter your passphrase when asked.
13. In Device settings, open Wallet settings, then Fingerprint and passcode, and add a fingerprint.
14. In Device settings, open Connection and switch on Air-gap mode, so the USB port only charges the battery.

The device writes to the secure element as the wallet is created, and it will fall asleep partway through. You put the PIN back in and it carries on.

The seed phrase, the passphrase and the hidden wallet

The seed phrase controls the wallet. Every private key the device holds is derived from those 12 or 24 words, so anyone who reads them can rebuild the wallet on other hardware and move the coins. Write them on paper or metal, keep them offline, and never type them into a website or a chat window, whatever the page claims to be. Nobody legitimate needs your seed phrase to help you; a support offer that asks for it is an attack.

The passphrase is a second secret that combines with the seed phrase to open a different wallet. The same seed with a different passphrase gives a different set of addresses and an empty balance, which is why people call it a hidden wallet. The creator dislikes the common description of it as a 13th or 25th word, because a single word is too easy to guess; he says it should be a longer string, kept as safe as the seed and stored separately. Lose the passphrase and the hidden wallet is gone, since nothing on the device or on paper can rebuild it.

A Shamir backup is also on offer, splitting the seed into three backups. It stays a single-signature wallet, but the backup behaves more like a multi-signature arrangement, because you need a set of shares to recover. The standard seed phrase is the simpler route and the one the walkthrough uses.

The fingerprint opens the device but does not replace the PIN when you approve a transaction; it is not accepted at that confirmation.

Connecting to Sparrow Wallet

Sparrow is an open-source desktop wallet, one of six companion apps the Keystone lists, alongside BlueWallet, Nunchuk, Zeus, Bitcoin Safe and Bull Bitcoin. The two halves do different jobs. The device generates and stores keys and signs transactions. The app builds the transaction, watches the balance and broadcasts it to the network.

1. Open Sparrow and choose File, then Import wallet, or press the Import wallet button on the start screen.
2. Select Keystone from the list of wallet types and press Scan.
3. Hold the device in front of the webcam. It shows an animated series of QR codes and the camera reads them in sequence.
4. Import as a Native SegWit HD wallet and give it a name.
5. Add a password for the Sparrow file if you want it encrypted on your computer, or leave it off.
6. Check the master fingerprint. Sparrow shows it under Settings at the bottom left; the device shows the same value under Device settings, then Wallet settings. In the video both read 0e87bf8a.

That fingerprint check is the step I would not skip. If two devices that have never spoken over a cable agree on the same value, the wallet you see in Sparrow is the wallet the Keystone controls. Skipping it means trusting the import without confirming it.

Sparrow holds the extended public key, the master public information that lets it build addresses and watch the balance. It cannot spend. The private side stays on the device and never leaves it, because there is no cable and no network link for it to leave through.

Receiving and sending Bitcoin

To receive, open the Receive tab in Sparrow, which shows an address and a derivation path of m/84'/0'/0'. The creator opens the same screen on the device and points out that path and address match on both sides, a second check that the import went right. You can generate a fresh address for each payment, which is how Bitcoin is meant to be used, and address settings on the device let you switch between Native SegWit, Taproot, Nested SegWit and Legacy formats.

The air gap earns its place when you send:

1. Paste the destination address into Sparrow's Send tab, set the amount (the creator presses max) and adjust the fee so it lines up with what the mempool shows.
2. Create the transaction, look over the details in Sparrow and finalise it for signing.
3. Press Show QR code, then open the Keystone, press Scan and point the camera at the screen.
4. Read the transaction on the device before you approve it: the amount, the fee, that it is on mainnet, the address it comes from and, most importantly, the address it goes to.
5. Slide the button to confirm, enter the passcode, and scan the QR code the device returns into Sparrow.
6. Press Broadcast, then done.

The test payment was 0.002 BTC, shown as CAD 158.58, sent back out to an address on another wallet. Reading the details on the device is the part that matters most to me. Malware on a computer can swap an address the moment you copy it, so the clipboard can say one thing and the device another. The Keystone's screen is the version you trust, because nothing on the internet can rewrite it.

What the creator liked, and what fell short

He liked most of it. He says the interface is simple enough for anyone to use, likes the air-gap switch that limits the USB port to charging, and likes the fingerprint sensor on the back. Relying on open-source companion apps counts as a strength for him, because the device only has to do one job well.

He is clear about the limits of his own endorsement: "I am not formally recommending this to anybody." The video demonstrates what the device can do, he says, rather than recommending a purchase, though he thinks it is a very good wallet personally. His preferred setup is a dice-rolled seed phrase with a fairly complex passphrase on top, and he sees the device working well as one key in a multi-signature quorum.

Three complaints come up. The firmware update finishes without saying so, and you only learn the version is current by running the check again. The fingerprint is not accepted at the signing confirmation. Calling a passphrase a 13th word, in his view, misleads people. The first one can leave a new owner unsure whether an important security step completed.

What to check before you trust it with real coins

The device suits someone who holds Bitcoin, wants the signing keys off every networked machine, and is comfortable running a desktop app. If you need a phone-only setup, or you hold a spread of altcoins and want one wallet to cover them, the Bitcoin-only path here is the wrong shape, though the Multi-Coin firmware exists for that case.

Before you send a real balance, I would do four things. Buy from Keystone or an authorised seller and check the tamper strip. Verify the device and update the firmware only from the official site, since a modified firmware is the one attack the secure elements cannot catch. Check the master fingerprint against the companion app every time you set up a new one. And send a small test amount first, then confirm it arrives before you move the rest.

The habit that outlasts any one device is simpler than the hardware. Your seed phrase and passphrase are the wallet; the Keystone is the tool that keeps them useful without exposing them. Dice rolls are the next step the creator has promised, and until that tutorial lands, a seed phrase generated on the device means trusting its random number generator with the one secret everything else depends on.