Device Display Reference

This page documents what appears on the KeepKey OLED display for each operation type. The CI test suite captures OLED output frame-by-frame — the descriptions here are derived from the firmware 7.14.1 test report.

The full CI report (PDF) contains complete OLED frame captures for every test case.

Display anatomy

The KeepKey OLED is 256×64 pixels. Each confirmation screen consists of:

Header line (top) — operation type in bold (SEND, TRANSACTION, SIGN MESSAGE, APPROVE, etc.)
Body text — the critical data the user must verify (address, amount, memo)
Upload icon (top-right) — the button the user presses to confirm

Multi-screen flows scroll through pages — the user sees each page before pressing confirm on the final one.

Core device operations

Wipe device


WIPE DEVICE
Do you want to erase your private keys
and settings?
                                DEBUG_LINK

Triggered by: host sends WipeDevice message.
User must press the button to confirm. After wipe, device is uninitialized — no operations work until a new seed is loaded.

Change label


CHANGE LABEL
Do you want to change the label to "new
label"?
                                DEBUG_LINK

Label appears on every subsequent confirmation screen — useful when a user has multiple KeepKeys.

Passphrase enable/disable


ENABLE PASSPHRASE
Do you want to enable BIP39 passphrases?

DISABLE PASSPHRASE
Do you want to disable BIP39 passphrases?

When enabled, every operation prompts for a passphrase. Empty string = default wallet. Different passphrases derive completely different wallets from the same seed.

PIN entry (scrambled grid)

The PIN entry screen shows a 3×3 grid with randomized positions. The OLED never shows which digit maps to which button — the user uses the grid displayed in the host application and presses the corresponding physical button. Screen recording attacks see button positions, not digit values.

Cipher recovery (seed entry)

Recovery uses a per-character scrambled keyboard. The letter grid is randomized for each character, so even a compromised host cannot determine which letters the user selects. All words are entered before the device verifies the BIP-39 checksum and reconstructs the seed.

Bitcoin send flow

Step 1 — Recipient address


SEND
Send 0.0038 BTC to
1MJ2tj2ThBE62zXbBYA5ZaN3fdve5CPAz1

Full address shown — never truncated. For Taproot, the full bech32m address is shown across two lines.

Step 2 — Transaction confirmation


TRANSACTION
Do you want to send 0.0039 BTC from your
wallet? This includes a transaction fee
of 0.0001 BTC.

Total sent = recipient amount + fee. The user verifies the full cost before signing.

High fee warning


CONFIRM FEE
Really spend 0.0025 BTC on fees? Except in
times of high network congestion, fees
should be less than 100 sat/byte.

Shown when fee rate exceeds ~100 sat/byte. Protects against maliciously inflated fee attacks.

Multisig address (2-of-3)


Multisig (2 of 3)
3E7GDtuHqnqPmDgwH59pVC7AvySiSkbibz

Quorum shown before address. All co-signer xpubs must be provided to derive the multisig address.

Message signing


SIGN MESSAGE
This is an example of a signed message.

Arbitrary text, shown in full. Used for proof-of-ownership and login flows.

Address path warning


WARNING
Wrong address path for selected coin.
Continue at your own risk!

Shown when the host requests a non-BIP44-standard derivation path.

Ethereum send flow

ETH transfer (no contract data)


SEND
Send 12.34567890123456789 to
0x1D1C328764A41BdA0492b66bAA30C4A339FF8
5EF

Full 42-char EIP-55 checksummed address displayed. Amount shown with 18-decimal precision.

EIP-1559 transaction confirmation


TRANSACTION
Send 0.1 from your wallet, paying up to
0.00042 for gas?

EIP-1559 shows maxFeePerGas × gasLimit as the gas cap (worst case cost), not legacy gasPrice.

ERC-20 token transfer (known token)


SEND
Send 0.2 ADT to
0x574BbB36871bA6b78E27f4B4dCFb76eA0091880B

Token name resolved from firmware token list. Unknown tokens fall back to raw hex calldata.

ERC-20 approve (specific amount)


APPROVE
Approve withdrawal of up to 42 CVC by
0x1D1C328764A41BdA0492b66bAA30C4A339FF8
5EF?

ERC-20 approve (unlimited)


APPROVE
Unlock full CVC balance for withdrawal by
0x1D1C328764A41BdA0492b66bAA30C4A339FF8
5EF?

MAX_UINT256 approval always shown as Unlock full [TOKEN] balance — explicit unlimited warning.

Contract data (unknown ABI)


CONFIRM ETHEREUM DATA
6162636465666768696A6B6C6D6E6F70
6162636465666768...   256 bytes

Raw hex + byte count. User must be in AdvancedMode or explicitly accept blind signing.

EVM Clear-Signing (metadata verified)

When a correctly-signed metadata blob is provided, the device shows a VERIFIED icon alongside the decoded method name and arguments. The host application is responsible for providing and signing the metadata blob.

Personal message (EIP-191)


SIGN BYTES
eef81f6d2517f420fc0f59684fb3d4cb9ebdf0b
b3a8f6075b9c5e1f3210231f0

Raw bytes shown as hex. For EIP-191 text messages, the text is shown instead.

THORChain swap flow

The memo is the critical security element. A compromised host could encode a swap to a different destination address — the device shows the full memo so the user can verify.

THORChain swap confirmation


THORCHAIN SWAP
Confirm swap asset
USDT-0xdac17f958d2ee523a2206206994597c13d831ec7

THORCHAIN SWAP
Confirm to
0x41e55600548248a6b0732e656e3ad64e20e94e45

THORCHAIN SWAP
Confirm limit 42

Multi-page: asset → destination address → limit. User sees all parameters before signing.

THORChain add liquidity


THORCHAIN ADD LIQUIDITY
Confirm to
0x41e55600548248a6b0732e656e3ad64e20e94e45

BTC→ETH swap via THORChain

Involves both a BTC fee confirmation and the THORChain memo confirmation:


CONFIRM FEE
Really spend 0.0039 BTC on fees? [...]

THORCHAIN SWAP
Confirm to 0x...

Ripple (XRP) send flow


SEND
Send 100.000009 XRP to
rNaqKtKrMSwpwZSzRckPf7S96DkimjkF4H,
with destination tag 123456?

TRANSACTION
Really send 100 XRP, with a transaction
fee of 0.1 XRP?

Destination tag shown in full. Drop amounts converted to human-readable XRP.

Cosmos send flow


Send 0.1 ATOM to
cosmos18vhdczjut44gpsy804crfhnd5nq003nz0nf20v

COSMOS ACCOUNT #0
Sign this Cosmos transaction on
cosmohub-2? It includes a fee of 5000
uATOM and 200000 gas.

Memo (exchange deposit / IBC tag)


MEMO
[full memo text]

Memo displayed in full — exchange deposits use numeric account IDs (e.g. 1234567890) as the memo; IBC transfers include the channel ID. Truncation is not possible.

Solana instruction flow

Solana transactions are displayed as a list of instructions. Each instruction gets a numbered header.

SOL transfer


INSTR 1/1
Send 1.000000000 SOL to
3JF3sEqM796hk5WFqA6EtmEwJQ9quALszsfJ
yvXNQKy3?

SOLANA
Sign this Solana transaction?

SPL token transfer


INSTR 1/1
Send 50000000 tokens to
4Ss5JMkXAD9Z7cktFEdrqeMuT6jGMF1pVozTyP
HZ6zT4?

With SolanaTokenInfo metadata: shows human-readable token name and symbol.

Stake delegate


INSTR 1/1
Delegate stake?

SOLANA
Sign this Solana transaction?

Compute budget (priority fee)


INSTR 1/1
Set compute unit price to 50000?

Memo attachment


INSTR 1/1
Memo attached

Supported Chains — full chain coverage and protocol details
python-keepkey — run these tests yourself
Full CI report (PDF) — complete OLED frame captures for all 143 test cases