Bitcoin Magazine Trezor Safe 7 Review: The FOSS Self Custody Hardware Wallet

Some hardware wallets aim to create air-gapped devices that can be assembled by hand by end users, or tailored to industry professionals in a free and open-source ethos. Others close the source and aspire to become the Apple or Macintosh of hardware wallets, leading through their design of user guardrails. Trezor seems to have found a middle ground with the Safe 7.

The device feels like what you might expect from a modern iPhone, metal exterior, a wide screen that reaches the border of the device, and tactile feedback clearly designed to deliver satisfaction to the user. The Safe 7 manages to give you the impression, the experience, that Bitcoin is a real thing, a physical thing, in a way most other wallets do not.

Trezor also navigates the divide between Bitcoin and crypto users quite well. It pulls it off by delivering two different firmware stacks and designs; the standard multi-coin version, which comes in black and green, and the Bitcoin-only orange. Users can switch back and forth at will, regardless of which one they order, but Bitcoiners who already know what they want can get the orange version and won’t have to do any off-path firmware upgrades. Both types of users can switch to the other firmware type if they are so inclined, regardless of device color.

The choice does, however, have some consequences; many updates to firmware revolve around coins other than Bitcoin. As a result, Bitcoin-only firmware is leaner; Trezor’s support articles put it plainly: “Added advantages of running Bitcoin-only firmware include fewer regular updates (compared to the Universal firmware) and reduced risk of bugs or security issues.”

The first thing you’ll notice if you have some experience with Bitcoin but have never used Trezor is the size of their word list. The Safe 7 offers 20 words for the wallet’s backup, rather than 12 or 24 as most others. This is a security design choice that Trezor has been building on for many years. The 20-word standard called SLIP-39 was first introduced by Trezor in 2019 with their announcement of the Shamir backup feature . Shamir lets users split up the wallet’s backup seed words into shards, a threshold of which can be used to recreate the Bitcoin wallet, but any one of which alone is insufficient. Take, for example, a two-of-three Shamir setup; users write down three lists of 20 words, and store them in separate physical locations: the bank, the home, the office. Any one of those found by a thief or destroyed by a fire or flood is not a catastrophic loss. The single shard can not give anyone access to the wallet, and the other two shards let the owner regain control and move the coins to a new wallet setup. This quality is often called ‘redundancy’, and it is also achieved by multi-signature wallets , though with different trade-offs, such as onchain transaction costs. Shamir backups come from an old, well-known cryptographic scheme called Shamir Secret Sharing , which Trezor built its own implementation of.

The extra words, compared to the more popular 12-word standard, do not give users more entropy; Trezor is clear that users can expect the same 128 bits of entropy as with 12-word seeds. However, the word list used in SLIP-39 is, according to Trezor, carefully curated to avoid confusing or similar words.

SLIP-39 also unlocks something that BIP-39 does not; extendability into Shamir. Users who initially create a single seed 20-word backup with a Trezor device can later on create a redundant set of Shamir shares, like a three-of-five. These shares recreate the same wallet, which means users do not need to do onchain transactions to transfer funds. They should, however, consider destroying their original 20-word single seed, since it alone will also be able to restore the wallets involved. There is a full FAQ from Trezor that interested users can read up on. SLIP-39 is supported by other wallets like Sparrow and Electrum, though it has far less adoption than its predecessor.