# KeepKey Documentation

> Official documentation for the KeepKey hardware wallet: setup guides for the desktop app, browser extension, and mobile app, plus firmware internals and a developer REST API/SDK reference.

KeepKey is a hardware wallet whose private keys are generated on-device and never leave it; every transaction must be physically confirmed on the device. Firmware is open source under LGPLv3. The desktop application exposes a local REST API on http://localhost:1646 that any app can pair with via the keepkey-vault-sdk. Canonical domain: https://docs.keepkey.com (root redirects to /docs).

## Getting Started

- [Introduction](https://docs.keepkey.com/docs): What a KeepKey is, the three things every owner should understand (recovery phrase, PIN, verify-on-device), and a 5-minute setup path.
- [Quickstart (developers)](https://docs.keepkey.com/docs/quickstart): Install the desktop app and keepkey-vault-sdk, pair in one button press, and make a first API call in about five minutes.
- [Security](https://docs.keepkey.com/docs/security): The honest security model — a supply chain you can verify rather than trust, the no-secure-element tradeoff, the BIP-39 passphrase as the strongest physical-attack defense, and the full sourced vulnerability history with the firmware that fixed each finding.
- [FAQ](https://docs.keepkey.com/docs/faq): Quick answers — latest firmware, supported coins (Solana/TRON/TON), the mobile app, the Secure Element question, whether KeepKey is discontinued (it isn't), and security.

## Learn (Crypto Basics)

Plain-language beginner education; each concept page ties back to the relevant KeepKey product.

- [Crypto Basics](https://docs.keepkey.com/docs/learn): The ordered learning path for newcomers — wallets, keys, recovery phrase, transactions, networks, security.
- [What Is a Crypto Wallet?](https://docs.keepkey.com/docs/learn/what-is-a-wallet): Wallets hold keys, not coins; custodial vs self-custody ("not your keys, not your coins"); hot vs cold; why a hardware wallet.
- [Keys & Addresses](https://docs.keepkey.com/docs/learn/keys-and-addresses): Private keys (control) vs public keys/addresses (shareable), and how receiving works.
- [Your Recovery Phrase](https://docs.keepkey.com/docs/learn/recovery-phrase): The 12/24-word BIP-39 phrase that IS the wallet, why it's portable, and how to back it up.
- [Transactions & Fees](https://docs.keepkey.com/docs/learn/transactions-and-fees): How a transaction is signed, broadcast, and confirmed; irreversibility; what network fees and Ethereum gas pay for.
- [Networks, Coins & Tokens](https://docs.keepkey.com/docs/learn/networks-and-tokens): Networks and native coins, coins vs tokens (ERC-20), EVM chains, and what "supported" means.
- [PIN & Passphrase](https://docs.keepkey.com/docs/learn/pin-and-passphrase): The two distinct locks — a PIN that guards the device and an optional passphrase that creates a hidden wallet.
- [Staying Safe](https://docs.keepkey.com/docs/learn/staying-safe): The common crypto scams (phishing, fake support, address poisoning, clipboard malware, fake firmware) and the habits that defeat them.
- [Glossary](https://docs.keepkey.com/docs/learn/glossary): Plain-language definitions of crypto and hardware-wallet terms, each linked to a deeper explanation.

## Desktop App

- [Desktop Application](https://docs.keepkey.com/docs/desktop): The primary way to manage the wallet on macOS, Windows, and Linux — portfolio, swap, send/receive, settings, firmware, and the local REST API.
- [Portfolio](https://docs.keepkey.com/docs/desktop/portfolio): The desktop dashboard — every asset across every chain, total value, token balances, and quick actions.
- [Install](https://docs.keepkey.com/docs/desktop/install): Download the signed installer for your OS from GitHub releases and run first-launch checks.
- [Onboarding](https://docs.keepkey.com/docs/desktop/onboarding): First-time setup — create a new wallet or recover an existing one, write down the recovery phrase, set a PIN.
- [Setup Screens](https://docs.keepkey.com/docs/desktop/setup): Index of permanent companion pages, one per screen of the desktop setup wizard — linked directly from the app.
- [Your PIN is Scrambled](https://docs.keepkey.com/docs/desktop/setup/pin-scrambled): Why the PIN grid shuffles and what the desktop app never learns — the first pre-setup tutorial card.
- [Your Words = Your Wallet](https://docs.keepkey.com/docs/desktop/setup/recovery-words): The recovery phrase is the wallet; write it on paper, never type it anywhere — the second pre-setup tutorial card.
- [Scrambled Recovery Entry](https://docs.keepkey.com/docs/desktop/setup/cipher-recovery): Entering seed words by position against a shuffled on-device alphabet — the third pre-setup tutorial card.
- [Set Up Your Wallet](https://docs.keepkey.com/docs/desktop/setup/create-or-recover): Create vs recover, choosing word count, and why 12 words and 24 words give the same practical security on secp256k1.
- [Creating Your Wallet](https://docs.keepkey.com/docs/desktop/setup/creating-wallet): The on-device seed display and PIN set, plus recovery from disconnects and failures mid-flow.
- [Name Your Device](https://docs.keepkey.com/docs/desktop/setup/device-name): Setting the optional device label, which requires an on-device confirmation.
- [Verify Your Recovery Phrase](https://docs.keepkey.com/docs/desktop/setup/verify-backup): Testing the written backup against the device, and what to do when it doesn't match.
- [Trust Your Device Screen](https://docs.keepkey.com/docs/desktop/setup/device-screen): Clipboard hijacking, malicious dApps, and why the device display is the only trustworthy surface — the first post-setup tutorial card.
- [App Connections Are Off](https://docs.keepkey.com/docs/desktop/setup/app-connections): The local REST API is disabled by default; what enabling it exposes — the second post-setup tutorial card.
- [Hidden Wallets](https://docs.keepkey.com/docs/desktop/setup/hidden-wallets): The non-skippable passphrase opt-in — every passphrase is valid, so a typo silently opens a different empty wallet.
- [Recovery Phrase](https://docs.keepkey.com/docs/desktop/recovery-phrase): The recovery phrase is the wallet; how to store it and why exposure is irreversible.
- [PIN](https://docs.keepkey.com/docs/desktop/pin): How the PIN protects the device and why the entry grid shuffles.
- [Verifying Transactions](https://docs.keepkey.com/docs/desktop/verify-on-device): Always confirm the full address and amount on the device screen — every character.
- [Passphrase (Hidden Wallets)](https://docs.keepkey.com/docs/desktop/passphrase): A passphrase derives a separate hidden wallet from the same seed.
- [Send & Receive](https://docs.keepkey.com/docs/desktop/send-receive): The two core money-movement flows, both confirmed on the device.
- [Swap](https://docs.keepkey.com/docs/desktop/swap): Built-in cross-chain swap aggregator routed through decentralized protocols and approved on the device.
- [Settings](https://docs.keepkey.com/docs/desktop/settings): PIN, passphrase, label, signing policies, firmware, and the local REST API (API bridge, off by default, under Settings → API Servers).
- [Firmware Updates](https://docs.keepkey.com/docs/desktop/firmware): How the desktop app checks for, verifies, and installs firmware updates.
- [Address Book](https://docs.keepkey.com/docs/desktop/address-book): The Addresses tab — label and reuse external addresses (exchange deposits, cold storage, counterparties) safely.
- [BIP85 Derived Seeds](https://docs.keepkey.com/docs/desktop/bip85): Generate deterministic child seeds from one recovery phrase — separate wallets for family members, purposes, or cold backups.
- [Explore](https://docs.keepkey.com/docs/desktop/explore): The Explore tab — connect the device to dApps, integrations, and companion tools.
- [Linux Tips](https://docs.keepkey.com/docs/desktop/linux-tips): USB permissions on Linux — the udev rules and group membership needed for the device to be recognized.

## Firmware & Chains

- [Supported Coins](https://docs.keepkey.com/docs/supported-coins): Every chain and token KeepKey signs — 11 native chains plus the Bitcoin family and any ERC-20 / EVM chain via EIP-155, what's new in 7.14.1, and what isn't supported.
- [Supported Chains](https://docs.keepkey.com/docs/firmware/supported-chains): Firmware 7.14.1 natively signs on 11 chains — Bitcoin, Ethereum, XRP, Cosmos, THORChain, Maya, EOS, Nano, Solana, TRON, and TON (Solana/TRON/TON new in 7.14.1) — plus the Bitcoin family and any ERC-20 token / EVM chain via EIP-155. Per-chain derivation paths, operations, and security behavior. Not supported: Cardano, Polkadot, Monero.
- [Firmware](https://docs.keepkey.com/docs/firmware): Open-source (LGPLv3), reproducibly built, CI-tested (140+ hardware integration tests), signed. Latest release v7.14.1. Build-from-source, emulator, and release verification.
- [Device Display Reference](https://docs.keepkey.com/docs/firmware/device-display): Exactly what the OLED shows for each operation (addresses, transactions, signing, warnings).
- [python-keepkey](https://docs.keepkey.com/docs/firmware/python-keepkey): The Python library used by the firmware CI suite to drive a real device or the emulator.

## Developer / API

- [Authentication](https://docs.keepkey.com/docs/authentication): How pairing works; the bearer token only authorizes signature *requests* — every signing call blocks on physical device confirmation.
- [SDK](https://docs.keepkey.com/docs/sdk): keepkey-vault-sdk — a typed, zero-dependency TypeScript client for the REST API (browser/Node/Bun/edge).
- [Device & System](https://docs.keepkey.com/docs/system): The sdk.system namespace — read device health/features and perform mutating operations that require on-device confirmation.
- [SDK Reference](https://docs.keepkey.com/docs/reference/api): The full typed API reference, auto-generated from source.
- [REST Reference](https://docs.keepkey.com/docs/reference/rest): Interactive OpenAPI explorer for the local REST API on http://localhost:1646.

## Browser Extension & Mobile

- [Browser Extension](https://docs.keepkey.com/docs/bex): Injects window.ethereum so any EVM dapp (Uniswap, OpenSea, Curve, and thousands more) works with hardware-backed signing. Requires the desktop app with the API bridge enabled.
- [Agent Mode (MCP)](https://docs.keepkey.com/docs/bex/mcp): Connect an AI agent to the wallet over the Model Context Protocol at http://localhost:1646/mcp (loopback-only, bearer pairing key). Extension 0.0.38 + Vault 1.5.0 publish 21 bex_* tools: introspection (status, accounts, pending requests, connected sites, provider logs), browser driving (tabs, navigate, snapshot/find with [ref=eN] handles, click, type, select, read_page, screenshot) and page debugging (console, network, perf, storage). Always pass tabId, or tools act on the user's active tab. Off by default, and no tool can sign — every signature needs a physical button press on the device.
- [Mobile App](https://docs.keepkey.com/docs/mobile): A read-only companion to the desktop wallet — view portfolio and generate receive addresses after QR pairing. Holds no keys and cannot sign independently (iOS/Android).

## Key Facts

- Hardware wallet: private keys are generated on the device and never leave it; every transaction is confirmed with a physical button press.
- Open-source firmware (LGPLv3), reproducibly built, CI-tested (140+ hardware integration tests), and signed by the KeepKey team.
- Latest firmware: 7.14.1. Natively signs on 11 chains: Bitcoin, Ethereum, XRP, Cosmos, THORChain, Maya, EOS, Nano, Solana, TRON, and TON — Solana, TRON, and TON are new in 7.14.1.
- Also supports the Bitcoin family (Litecoin, Bitcoin Gold, Dash, Groestlcoin, Zcash transparent) and any ERC-20 token or EVM chain via EIP-155. Zcash Orchard (shielded), EVM clear-signing, and BIP-85 child derivation are in progress.
- Not supported: Cardano (ADA), Polkadot (DOT), Monero (XMR). Avalanche works as an EVM chain.
- Three official apps: Desktop (macOS/Windows/Linux), Browser Extension (EVM dapps via window.ethereum), Mobile (portfolio + receive, iOS/Android).
- Desktop app exposes a local REST API on http://localhost:1646; the API bridge is off by default and is enabled in Settings → API Servers.
- Developer SDK: keepkey-vault-sdk on npm — zero dependencies, native fetch.
- Actively developed; latest firmware released in 2026.

## Contact & Source

- Support: https://support.keepkey.com
- GitHub organization: https://github.com/keepkey
- Desktop app (KeepKey Vault) releases: https://github.com/keepkey/keepkey-vault/releases/latest
- Firmware source: https://github.com/keepkey/keepkey-firmware
- python-keepkey: https://github.com/keepkey/python-keepkey
- SDK on npm: https://www.npmjs.com/package/keepkey-vault-sdk
- Website: https://keepkey.com