Keystone is a hardware wallet for people who want to keep their Bitcoin, Ether and other crypto assets under physical control and sign transactions without exposing keys to a computer. It suits anyone who already uses a Windows PC for managing crypto and wants a dedicated device guarding the signing step. The Keystone device is purchased, and on a PC it works through compatible third-party wallet software rather than replacing it.
The defining feature is air-gapped signing. The device and the computer exchange data through QR codes instead of a cable or a wireless link, so the private keys never leave the hardware. Keystone's firmware is open source, which lets outside developers read the code. This page covers the hardware and its Windows workflow, so you can decide whether this setup fits how you hold and move your assets.
What Is a Hardware Wallet and Why Keep Keys Offline?
A crypto wallet does not really store coins. It stores the private keys that prove ownership of addresses on a blockchain. Software wallets keep those keys on an internet-connected device, where malware, phishing pages and compromised browser extensions can target them.
A hardware wallet moves the key storage and signing onto a separate device. Your funds remain on the blockchain, but authorizing a transaction requires the device. Even if the computer is infected, an attacker cannot sign a transfer without the hardware.
The trade-off is convenience. You need to keep the device, remember your recovery phrase and go through a confirmation step for each transaction. For many long-term holders that extra friction is the point.
Who Keystone Suits Best
Keystone is most useful for people who hold crypto for months or years and want the signing keys off their everyday computer. A common case is a Bitcoin holder who manages a balance in Sparrow on Windows and wants every outgoing transfer confirmed on a separate device.
It also fits users who move between networks. Someone active in Ethereum-style applications through a browser wallet like Rabby or MetaMask can keep those keys on Keystone while still using a familiar desktop or browser interface.
Keystone is less suited to people who need a single app for everything or who want to avoid buying hardware. Those readers may prefer a software wallet for small, frequent transactions and keep a hardware device for larger holdings.
How Hardware Wallets Divide the Work With Desktop Software
In a setup like Keystone's, the software and the device each do a different job. The wallet app on Windows handles the public side: it shows balances, builds unsigned transactions, and broadcasts signed ones to the network. It never needs your private keys.
The device handles the secret side. It holds the seed phrase and private keys, displays the transaction details on its own screen, and produces the signature only after you approve. This separation is why a compromised PC cannot silently move funds.
Understanding this split helps you troubleshoot. If the app shows a balance but cannot send, the problem is usually in the pairing or the QR exchange, not in the keys themselves.
Key features
Air-gapped QR code signing
Works with popular wallet software
Open-source firmware
Supported coins
Keystone works with a range of networks, including Bitcoin (BTC), Ethereum (ETH), Solana (SOL) and Cosmos, among others. Which assets you can send depends on the wallet app you pair with the device, so check that app's supported network list before moving funds.
How to install Keystone on Windows
- 1
Buy the device from the official source
Purchase Keystone hardware directly from the official website at keyst.one rather than from resellers or marketplace listings. Avoid used devices and any hardware that arrives with a recovery phrase already written down.
- 2
Download the Windows wallet software
Get the wallet app you plan to use, such as Sparrow or Rabby, from its official website or the GitHub Releases page. Keystone's open-source resources are published at github.com/KeystoneHQ.
- 3
Verify the installer
Compare the file's SHA-256 checksum with the value published by the developer. If the project offers a digital signature, check it as well before running the installer.
-
Install and pair the device
Run the installer, open the wallet, and choose the hardware wallet connection option. Follow the on-screen QR code prompts to link Keystone, and write your seed phrase on paper during device setup, never on the computer.
How to use Keystone
Keystone works as a pairing between your device and a Windows wallet app, so the process is repeated for every transaction. The steps below describe a typical send from a desktop wallet.
- Open the wallet app on Windows and connect it to your Keystone device using the QR code pairing option.
- Enter the recipient address and amount, then review the fee the wallet proposes.
- Generate the transaction, which the app displays as a QR code.
- On the Keystone device, scan the QR code with its camera.
- Check the recipient address and amount on the device screen and confirm only if they match what you intended.
- Scan the signed QR code that the device displays with the wallet app, then broadcast the transaction to the network.
Pros & cons
- Private keys stay on the hardware device during signing
- Air-gapped QR code workflow avoids cables and wireless links
- Works with several popular wallet apps on Windows
- Open-source firmware that can be reviewed publicly
- Requires buying a physical device
- Desktop workflow depends on third-party wallet software
- Each transaction takes more steps than a software-only wallet
Is Keystone safe?
Download Keystone-related software only from the official website at keyst.one, from the official GitHub organization, or from the wallet developer's own site. Verify every installer by comparing its SHA-256 checksum or checking its signature against the developer's published values.
Never enter your seed phrase on a website, in a chat, or into an app that asks for it unexpectedly. Keystone and the wallet apps should never need your recovery phrase after setup. Be cautious of fake support accounts and emails that claim your device needs an urgent update.
Buy the device directly from the manufacturer, and keep the recovery phrase offline in a secure location. Before installing or updating, check the latest version on the official website.
- Official source only. Download from keyst.one. Ignore ads and lookalike domains.
- Check the SHA-256. Compare the installer hash with the value the developer publishes before running it.
- Never share your seed phrase. No developer, support agent or website — including CryptApps — will ever ask for it.
Alternatives
Ledger Wallet (Ledger Live), Trezor Suite and BitBoxApp are companion apps built for their own hardware lines, so each brand's device and desktop software are designed to work together. Keystone takes a different route: its air-gapped QR workflow pairs with independent wallet apps such as Sparrow, Rabby, MetaMask and BlueWallet.
That makes Keystone a good match if you already like a particular wallet interface and want a separate signing device. Products like GridPlus Lattice1, SafePal Desktop and imKey Pro are also hardware-backed options, but their setup and software ecosystems differ. Compare which wallet apps you need, which networks they support, and how you prefer to confirm transactions.
Specifications
- Price
- Free
- Type
- Proprietary
- License
- —
- Latest version
- —
- Last update
- —
- Windows support
- Yes (official Windows version)
- Official site
- keyst.one
- Source code
- github.com/KeystoneHQ
Frequently asked questions
Keystone can be used safely on Windows because the private keys stay on the hardware device during signing. Safety still depends on buying the device from an official source, verifying the wallet software you install, and protecting your recovery phrase offline.
You do not need a separate Keystone program to manage your assets on a PC. Keystone works with compatible third-party wallets such as Sparrow or Rabby, which you install on Windows and pair with the device through QR codes.
Keystone supports networks including Bitcoin, Ethereum, Solana and Cosmos, among others. The exact assets you can send depend on the wallet app you use with the device, so check that app's supported networks before transferring funds.
Air-gapped signing means the signing device has no permanent network or cable connection to the computer. Data moves between the two through QR codes, so an infected PC cannot read your private keys or sign a transaction without your physical confirmation on the device.
Yes, Keystone is listed as compatible with MetaMask, so you can use it to sign Ethereum-style transactions from the browser extension. Confirm each transaction on the device screen and check the recipient address before approving.
Your funds are not lost with the device, because they exist on the blockchain and are controlled by your seed phrase. If you have a correct recovery phrase backup, you can restore access on a new device or a compatible wallet.
Verdict
Keystone suits people who hold crypto for the long term and want signing keys kept off their Windows computer. It is a good fit if you already use wallets like Sparrow, Rabby or MetaMask and want a physical device confirming each transaction. If you need a single app for everything or want to avoid buying hardware, a software wallet or a different ecosystem may be more practical.