Air-gapped hardware wallets reviewed: Ellipal, Keystone and NGRAVE
Air-gapped hardware wallets eliminate direct electronic connections (USB, Bluetooth, Wi-Fi) between the signing device and internet-connected hosts. This review examines three manufacturers that market air-gapped devices, drawing only on their official documentation. No product was hands-on tested.
Last updated:
This page may contain affiliate links in the future. Any commercial relationship will be disclosed and will never affect contender order or findings. This is not investment advice. Security hardware should be evaluated based on your own threat model and requirements. Products listed here were not hands-on tested; findings are based on official documentation reviewed on the dates shown.
Known limitations
- Products were not hands-on tested; all claims come from manufacturer documentation.
- Security claims (anti-tamper, air-gap integrity, certification levels) are manufacturer-stated and were not independently verified.
- Pricing is not compared because it varies by region and model.
- Supported cryptocurrency and blockchain counts were not compared because they change frequently.
- This review covers only the air-gapped segment; non-air-gapped wallets like Ledger and Trezor are compared separately.
Comparison at a glance
| Criterion | Ellipal | Keystone | NGRAVE |
|---|---|---|---|
| Communication method | QR codes only | QR codes only | QR codes only |
| Open-source firmware | Not assessed in the cited evidence | Yes | Not assessed in the cited evidence |
| Anti-tamper features stated | Yes (sealed metal body, key deletion) | Not assessed in the cited evidence | Not assessed in the cited evidence |
| Biometric authentication | Not assessed in the cited evidence | Not assessed in the cited evidence | Yes (fingerprint stated) |
Ellipal
Ellipal markets the Titan 2.0 as an air-gapped hardware wallet with QR-code transaction transfer, a full-metal body, and tamper-resistant self-erasure behaviour.
Verdict: Documents QR-code transaction transfer, a sealed metal body, and manufacturer-stated tamper-triggered data erasure.
Pros
- Sealed metal body and anti-tamper claims documented
- QR-code transaction transfer documented
- No Wi-Fi, Bluetooth, NFC, or USB data connection stated
Cons
- Manufacturer security claims were not independently verified
- Supported assets and companion-app workflow should be checked before purchase
Evidence
Keystone
Keystone documents air-gapped QR-code transaction signing and publishes Keystone 3 firmware source in its official GitHub organisation.
Verdict: Combines QR-code transaction transfer with firmware published by Keystone on GitHub. Readers should still assess the complete hardware, firmware, and companion-software trust model.
Pros
- Air-gapped QR-code signing is documented
- Keystone 3 firmware source is publicly available
Cons
- Complete hardware and companion-software trust were not assessed
- Supported assets and workflow should be checked before purchase
Evidence
NGRAVE
NGRAVE markets the ZERO as an air-gapped hardware wallet with biometric authentication, a built-in light sensor, and QR-code communication.
Verdict: Documents biometric authentication, QR-code communication, a built-in light sensor, and a manufacturer-stated EAL7-certified custom operating system.
Pros
- Biometric authentication stated
- Built-in light sensor stated
- EAL7 certification claimed for the custom operating system
Cons
- Manufacturer security and certification claims were not independently verified
- Supported assets and companion-app workflow should be checked before purchase
Evidence
Decision guide
Open-source firmware matters for air-gapped devices
Keystone publishes Keystone 3 firmware source in its official GitHub organisation. For every device, assess the complete hardware, firmware, and companion-software trust model rather than treating source availability alone as proof of security.
Authentication methods
NGRAVE documents fingerprint authentication. Authentication methods for Ellipal and Keystone were not assessed in the cited evidence; check each model’s current documentation.
How we assessed this
Every claim is sourced from the manufacturer's own product pages and dated. Contenders appear in alphabetical order. No product was hands-on tested. All security claims are manufacturer-stated and were not independently verified. Features may change; verify on the manufacturer's site.
Research basis: Official manufacturer product pages and security documentation reviewed on the dates shown. No hands-on testing was conducted. No affiliate or commercial relationship influenced the selection or ordering of contenders.
Contenders appear alphabetically. Findings are evidence-led and scoped; missing information remains unknown rather than becoming a negative score. Products were not hands-on tested. Affiliate disclosure & methodology →
Sources cited
- Ellipal: Ellipal markets the Titan as an air-gapped hardware wallet that uses QR codes for transaction data transfer — https://www.ellipal.com/products/ellipal-titan (observed )
- Ellipal: Ellipal states the Titan 2.0 has a full-metal body and is designed to erase device data if forced open — https://www.ellipal.com/products/ellipal-titan (observed )
- Keystone: Keystone states its hardware wallets are '100% air-gapped' and use QR codes for transaction signing — https://keyst.one/why-keystone (observed )
- Keystone: Keystone publishes the Keystone 3 firmware source in its official GitHub organisation — https://github.com/KeystoneHQ/keystone3-firmware (observed )
- NGRAVE: NGRAVE states the ZERO is 'the coldest wallet' with no USB, Bluetooth, Wi-Fi, or NFC, using QR codes for communication — https://www.ngrave.io/en/zero (observed )
- NGRAVE: NGRAVE states the ZERO includes biometric authentication and a built-in light sensor, and that its custom operating system achieved EAL7 certification — https://www.ngrave.io/en/zero (observed )