Firmware
KeepKey firmware is fully open source under the LGPLv3 license. Every release is reproducibly built, CI-tested against 140+ hardware integration tests, and signed by the KeepKey team.
Repository: github.com/keepkey/keepkey-firmware
Latest release: v7.14.1
License: LGPL v3
What this section covers
This section documents firmware internals, chain support, and device behavior for developers building on top of KeepKey. If you’re a regular user looking to update firmware, see Firmware Updates.
- Supported Chains — the 11 native chains (plus the Bitcoin family and any ERC-20/EVM token via EIP-155), what operations are supported per chain, and security behavior
- Device Display Reference — exactly what the OLED shows for each operation type (addresses, transactions, signing, warnings)
- python-keepkey — the test harness that generates CI reports; use it to script device interactions
CI test suite
Every commit triggers a full hardware integration test suite via GitHub Actions. The test suite is written in Python using python-keepkey and runs against a real device (or the firmware emulator). Each test captures the OLED output frame-by-frame.
Firmware 7.14.1 CI results:
| Section | Tests | Status |
|---|---|---|
| Core — Device Lifecycle | 30/31 | ✓ (1 needs OLED fixture) |
| Bitcoin (+ forks) | 28/28 | ✓ All passed |
| Ethereum (ERC-20, EIP-1559) | 16/16 | ✓ All passed |
| Ripple (XRP) | 3/3 | ✓ All passed |
| Cosmos (ATOM) | 3/3 | ✓ All passed |
| THORChain | 4/4 | ✓ All passed |
| Maya Protocol | 3/3 | ✓ All passed |
| EOS | 4/4 | ✓ All passed |
| Nano | 1/1 | ✓ All passed |
| EVM Clear-Signing [NEW] | 3/8 | Partial (5 need OLED fixtures) |
| Solana [NEW] | 13/13 | ✓ All passed |
| TRON [NEW] | 6/6 | ✓ All passed |
| TON [NEW] | 8/8 | ✓ All passed |
| Zcash Orchard [NEW] | 0/9 | Pending |
| BIP-85 Child Derivation [NEW] | 0/6 | Pending |
Total: 143 tests — 122 passed, 21 pending (the pending cases await OLED fixtures for CI).
Download full CI test report (PDF) — firmware 7.14.1, generated 2026-05-23 via python-keepkey
Building from source
# Prerequisites: Docker
docker pull kktech/firmware:v5-beta
git clone git@github.com:keepkey/keepkey-firmware.git
git submodule update --init --recursive
# Build device firmware
./scripts/build/docker/device/release.sh
# Build emulator (Linux/macOS)
./scripts/build/docker/emulator/release.shThe emulator is also available as a prebuilt binary artifact from each CI run (see GitHub Actions → emu-image). It runs the exact same firmware logic without needing physical hardware.
Verifying a release
SHA-256 hashes for every release binary are published on the GitHub releases page . After downloading a firmware binary, verify it before flashing:
shasum -a 256 firmware-v7.14.1.bin
# Compare against the hash on the releases pageThe Vault desktop application performs this check automatically during firmware updates.