TL;DR
Pick one laptop that will do nothing but run your wallet software. Wipe it, update it, and from then on don’t use it for anything else.
What you need
- A laptop with at least two USB ports. New or used, both are fine
- A USB stick of 8 GB or more for the Windows installer
- Your normal computer, to download the installer
Why a separate computer
Your keys never leave the hardware wallets, so why bother? Because the computer builds your transactions and shows you your addresses. Malware can’t steal your keys, but it can try to swap an address and hope you don’t check. The device screens catch that (step 8). A clean computer is the second line, and it costs little.
A used business laptop, a ThinkPad or a Dell Latitude from a refurbisher, is a good choice. They’re cheap and they last.
Steps
- Update the BIOS from the laptop maker’s own support page.
- Make a Windows installer on the USB stick with Microsoft’s Media Creation Tool and reinstall Windows from scratch. Delete all existing partitions during the install.
- During setup, say no to every optional extra. Turn off OneDrive backup and anything called clipboard sync or clipboard history across devices.
- Run Windows Update until there’s nothing left to install. Reboot and check again, it usually takes two or three rounds.
- Leave Microsoft Defender on. If you prefer another antivirus, that’s fine. I use Bitdefender Free on mine.
- Install only what this guide needs: Sparrow (step 3) and the apps of your three device makers (Trezor Suite, BitBoxApp and Ledger Wallet, which used to be called Ledger Live). Download each one from the maker’s own site.
Comfortable with Linux? A fresh Ubuntu or Debian install is a fine alternative. The rest of this guide shows Windows because most people use it.
House rules from now on
- No email, no web browsing, no other software.
- The laptop goes online for updates and to let Sparrow talk to its server. That’s it.
- Before you connect a hardware wallet, make sure Windows is up to date and a virus scan is clean.
Don’t move addresses by clipboard
Never send an address from one computer to another through clipboard sync, email or a chat message to yourself. Those are exactly the places where an address can be swapped without you noticing. Retype it by hand, or scan a QR code with your phone.
Common mistakes
- Using your everyday laptop “just this once”.
- Installing a browser extension or a game on it later because it’s there.
- Leaving cloud sync on, so files and clipboard end up everywhere.