# Device Display Reference This page documents what appears on the KeepKey OLED display for each operation type. The CI test suite captures OLED output frame-by-frame — the descriptions here are derived from the firmware 7.14.1 test report. These are historical examples, not a promise of identical wording or coverage on every version. Read the [Test Atlas](/docs/firmware/test-atlas) for current candidate evidence and [release status](/docs/firmware/release-status) for provider and KeepKey-approved flows. ## Display anatomy The KeepKey OLED is 256×64 pixels. Each confirmation screen consists of: - **Header line** (top) — operation type in bold (`SEND`, `TRANSACTION`, `SIGN MESSAGE`, `APPROVE`, etc.) - **Body text** — the critical data the user must verify (address, amount, memo) - **Upload icon** (top-right) — the button the user presses to confirm Multi-screen flows scroll through pages — the user sees each page before pressing confirm on the final one. --- ## Core device operations ### Wipe device ``` WIPE DEVICE Do you want to erase your private keys and settings? DEBUG_LINK ``` Triggered by: host sends `WipeDevice` message. User must press the button to confirm. After wipe, device is uninitialized — no operations work until a new seed is loaded. ### Change label ``` CHANGE LABEL Do you want to change the label to "new label"? DEBUG_LINK ``` Label appears on every subsequent confirmation screen — useful when a user has multiple KeepKeys. ### Passphrase enable/disable ``` ENABLE PASSPHRASE Do you want to enable BIP39 passphrases? DISABLE PASSPHRASE Do you want to disable BIP39 passphrases? ``` When enabled, every operation prompts for a passphrase. Empty string = default wallet. Different passphrases derive completely different wallets from the same seed. ### PIN entry (scrambled grid) The PIN entry screen shows a 3×3 grid with randomized positions. The numbered grid appears on the device. The host shows blank positions; select the positions corresponding to your PIN digits on the device grid. See [PIN setup](/docs/desktop/pin). ### Cipher recovery (seed entry) Recovery uses a per-character scrambled keyboard. The letter grid is randomized for each character, so even a compromised host cannot determine which letters the user selects. All words are entered before the device verifies the BIP-39 checksum and reconstructs the seed. --- ## Bitcoin send flow ### Step 1 — Recipient address ``` SEND Send 0.0038 BTC to 1MJ2tj2ThBE62zXbBYA5ZaN3fdve5CPAz1 ``` Compare the complete address across all screens. For Taproot, the full bech32m address is shown across two lines. ### Step 2 — Transaction confirmation ``` TRANSACTION Do you want to send 0.0039 BTC from your wallet? This includes a transaction fee of 0.0001 BTC. ``` Total sent = recipient amount + fee. The user verifies the full cost before signing. ### High fee warning ``` CONFIRM FEE Really spend 0.0025 BTC on fees? Except in times of high network congestion, fees should be less than 100 sat/byte. ``` Shown when fee rate exceeds ~100 sat/byte. Protects against maliciously inflated fee attacks. ### Multisig address (2-of-3) ``` Multisig (2 of 3) 3E7GDtuHqnqPmDgwH59pVC7AvySiSkbibz ``` Quorum shown before address. All co-signer xpubs must be provided to derive the multisig address. ### Message signing ``` SIGN MESSAGE This is an example of a signed message. ``` Arbitrary text, shown in full. Used for proof-of-ownership and login flows. ### Address path warning ``` WARNING Wrong address path for selected coin. Continue at your own risk! ``` Shown when the host requests a non-BIP44-standard derivation path. --- ## Ethereum send flow ### ETH transfer (no contract data) ``` SEND Send 12.34567890123456789 to 0x1D1C328764A41BdA0492b66bAA30C4A339FF8 5EF ``` Full 42-char EIP-55 checksummed address displayed. Amount shown with 18-decimal precision. ### EIP-1559 transaction confirmation ``` TRANSACTION Send 0.1 from your wallet, paying up to 0.00042 for gas? ``` EIP-1559 shows `maxFeePerGas × gasLimit` as the gas cap (worst case cost), not legacy `gasPrice`. ### ERC-20 token transfer (known token) ``` SEND Send 0.2 ADT to 0x574BbB36871bA6b78E27f4B4dCFb76eA0091880B ``` Token name resolved from firmware token list. Unknown tokens fall back to raw hex calldata. ### ERC-20 approve (specific amount) ``` APPROVE Approve withdrawal of up to 42 CVC by 0x1D1C328764A41BdA0492b66bAA30C4A339FF8 5EF? ``` ### ERC-20 approve (unlimited) ``` APPROVE Unlock full CVC balance for withdrawal by 0x1D1C328764A41BdA0492b66bAA30C4A339FF8 5EF? ``` MAX_UINT256 approval always shown as `Unlock full [TOKEN] balance` — explicit unlimited warning. ### Contract data (unknown ABI) ``` CONFIRM ETHEREUM DATA 6162636465666768696A6B6C6D6E6F70 6162636465666768... 256 bytes ``` Raw hex + byte count. User must be in AdvancedMode or explicitly accept blind signing. ### EVM Clear-Signing (metadata verified) Metadata display and authority depend on the firmware and provider tier. A provider signature is not automatically KeepKey approval. See [Signing and Approvals](/docs/learn/clear-signing) and the [release contract summary](/docs/firmware/release-status). ### Personal message (EIP-191) ``` SIGN BYTES eef81f6d2517f420fc0f59684fb3d4cb9ebdf0b b3a8f6075b9c5e1f3210231f0 ``` Raw bytes shown as hex. For EIP-191 text messages, the text is shown instead. --- ## THORChain swap flow The memo is the critical security element. A compromised host could encode a swap to a different destination address — the device shows the full memo so the user can verify. ### THORChain swap confirmation ``` THORCHAIN SWAP Confirm swap asset USDT-0xdac17f958d2ee523a2206206994597c13d831ec7 THORCHAIN SWAP Confirm to 0x41e55600548248a6b0732e656e3ad64e20e94e45 THORCHAIN SWAP Confirm limit 42 ``` Multi-page: asset → destination address → limit. User sees all parameters before signing. ### THORChain add liquidity ``` THORCHAIN ADD LIQUIDITY Confirm to 0x41e55600548248a6b0732e656e3ad64e20e94e45 ``` ### BTC→ETH swap via THORChain Involves both a BTC fee confirmation and the THORChain memo confirmation: ``` CONFIRM FEE Really spend 0.0039 BTC on fees? [...] THORCHAIN SWAP Confirm to 0x... ``` --- ## Ripple (XRP) send flow ``` SEND Send 100.000009 XRP to rNaqKtKrMSwpwZSzRckPf7S96DkimjkF4H, with destination tag 123456? TRANSACTION Really send 100 XRP, with a transaction fee of 0.1 XRP? ``` Destination tag shown in full. Drop amounts converted to human-readable XRP. --- ## Cosmos send flow ``` Send 0.1 ATOM to cosmos18vhdczjut44gpsy804crfhnd5nq003nz0nf20v COSMOS ACCOUNT #0 Sign this Cosmos transaction on cosmohub-2? It includes a fee of 5000 uATOM and 200000 gas. ``` ### Memo (exchange deposit / IBC tag) ``` MEMO [full memo text] ``` Memo displayed in full — exchange deposits use numeric account IDs (e.g. `1234567890`) as the memo; IBC transfers include the channel ID. Verify the complete memo on the selected firmware; cancel if required information is missing. --- ## Solana instruction flow Solana transactions are displayed as a list of instructions. Each instruction gets a numbered header. ### SOL transfer ``` INSTR 1/1 Send 1.000000000 SOL to 3JF3sEqM796hk5WFqA6EtmEwJQ9quALszsfJ yvXNQKy3? SOLANA Sign this Solana transaction? ``` ### SPL token transfer ``` INSTR 1/1 Send 50000000 tokens to 4Ss5JMkXAD9Z7cktFEdrqeMuT6jGMF1pVozTyP HZ6zT4? ``` With `SolanaTokenInfo` metadata: shows human-readable token name and symbol. ### Stake delegate ``` INSTR 1/1 Delegate stake? SOLANA Sign this Solana transaction? ``` ### Compute budget (priority fee) ``` INSTR 1/1 Set compute unit price to 50000? ``` ### Memo attachment ``` INSTR 1/1 Memo attached ``` --- ## Related - [Supported Chains](/docs/firmware/supported-chains) — full chain coverage and protocol details - [python-keepkey](/docs/firmware/python-keepkey) — run these tests yourself - [CI Test Atlas](/docs/firmware/test-atlas) — candidate-specific results, sampled and ordered captures, and limitations