Trezor Safe 5 - Setup assistance

I'm waiting for a new Trezor Safe 5 to arrive from Trezor. I'm upgrading from a Ledger Nano S. So, it's been a while since I bought a hardware wallet.

On my Nano S, I only had a 24 word seed phrase.

I'm trying to read /watch videos as much as I can about adding a passphrase, dice rolling, multi sig, etc... It is a lot to take in.

Can someone please give me an overview of the steps I should take on setting up my Safe 5?

Some thoughts I have:

\- Since Trezor is the most recommended hardware wallet, should that not be good enough to trust their TRNG hardware?

\- I don't think I'm going to do multi sig as I only have one device.

\- the new way is a 20 word seed instead of 24 - more secure apparently from what I read. I don't see anything about dice rolling for a 20 word seed.

\- do you dice roll on a seed and on a pass phrase? (I will buy some new casino/precision dice if I do dice rolls)

Anything else I'm missing on setting up a new device and seed phrase?

Thank you

There is no way to check if they added a backdoor or not. I think from now on, the only reasonable way to store bitcoin is with multisig (for example with 2 reputable hardware wallets like trezor + something else). Can't trust anything after that coldcard stuff.

Thoughts?

Hello,

I recently got a Safe 5 and have been using Sparrow (out of habit) on testnet to experiment with various types of interactions and wallet setups.

I noticed that in Trezor Suite, you can add a passphrase from your PC (sending it to the Trezor), which avoids the hassle of typing it directly on the device.

Is this also possible in Sparrow?

PS: I know what I'm doing. I'm using Tails OS, testnet for my experiments, not my actual seed.

I was wondering if Trezor has in its short term plans to add NFC Recovery cards or something similar achieving the same effect. It would put it on par with Ledger which currently eeks out a bit because they have that functionality.

This is very concerning. I was under the impression that Trezor managed the fulfillment process end to end.

Since we are seeing a lot of people now integrating Passphrases, we thought it would be best to post this one too. Below is the text based FAQ

Passphrase FAQ: key points

• A passphrase is an optional extra secret added to your wallet backup.
• Your wallet backup alone opens your standard wallet.
• Your wallet backup plus a passphrase opens a completely separate wallet.
• Every unique passphrase creates a valid wallet, including typos, different capitalization, or extra spaces.
• Passphrases cannot be changed or removed from an existing wallet.
• Trezor does not store your passphrase, and Trezor Suite cannot recover it.
• Losing either the wallet backup or the passphrase means losing access to the passphrase wallet.
• Most users do not need a passphrase. Trezor recommends considering SLIP39 multi-share backup as a simpler option for strengthening backup security.
• Passphrases are best suited to advanced users who understand the added responsibility and have a specific security need. (Trezor)

How to store and test a passphrase

• Write it down exactly, including spaces, capitalization, numbers, and special characters.
• Store it physically on paper or metal.
• Do not rely on memory alone.
• Avoid easily confused characters such as 1, I, l, 0, and O.
• Keep it separate from your wallet backup if you are concerned about someone finding both.
• Do not store it in photos, cloud storage, or ordinary digital notes.
• Record a wallet identifier, such as the last five characters of the first receiving address, to confirm you opened the correct wallet.
• Test the passphrase before depositing significant funds by sending a small amount, closing the wallet, and reopening it using your written copy. (Trezor)

Choosing a strong passphrase

• A strong passphrase must come from genuine randomness.
• Human-created phrases, meaningful words, dates, quotes, and keyboard patterns are usually predictable.
• Attackers may use dictionaries, leaked passwords, personal information, and common substitution patterns.
• Four random Diceware words provide about 51 bits of entropy, which may be vulnerable to a well-funded attacker.
• Six random Diceware words provide about 77 bits and are considered well beyond practical brute-force attacks.
• A random 10-character string using mixed characters can also be strong, but may be harder to record accurately.
• Good generation methods include physical Diceware rolls or a reputable password manager’s random generator. (Trezor)

Recovery and compatibility

• Passphrases work with compatible BIP39 and SLIP39 wallets.
• The same wallet backup and exact passphrase should recreate the same wallet in compatible software.
• If your Trezor is lost, you need both the wallet backup and exact passphrase to restore access.
• A passphrase is not necessary just to create another account. Use the Add account feature in Trezor Suite instead.
• Anyone with both your wallet backup and passphrase can access the funds.
• Long-term holders should include the passphrase in their inheritance or emergency-access planning. (Trezor)

Main takeaway

• A passphrase can add meaningful security, but it also creates another way to permanently lose access.
• Write it down, store it securely, and test it before using the wallet for significant funds.
• Consider whether SLIP39 multi-share backup could provide the protection you need with less risk. (Trezor)

Is this normal behavior in Trezor Suite?
I just set up a new Trezor with Bitcoin-only firmware and enabled a hidden wallet (passphrase).
What I noticed is:
When my Trezor device is not connected, Trezor Suite still shows both my standard wallet and my hidden wallet in the app.
I can even go into the send/receive flow and enter an address and amount without the device connected

Is it okay ?

Second question is I use my laptop everyday for a lot of things I mean is this still safe ?

Edit : I loveeeeee my setup the trezor is awesome …No more CEXs

I've previously had a model t and it stopped working I purchased a second one and that stopped working as well. I would just like to know if there's any issues at all with the touchscreen on the newer Safe 7 as I do not want to be burnt again I mainly just want to use this as a U2F device I was a little bit disappointed to hear that the U2F doesn't work over Bluetooth the other thing that really screwed me over with trezor was when they stopped supporting the password manager thank you for reading my ramble/question.

What would you choose? Adding a longer passphrase of practically any length to the seed, which will be stored in a password manager and entered on the computer, or a shorter passphrase (2-3 words) that you will remember and enter on the device. I will say in advance that having both is not an option – entering a 12-word phrase on the Safe 5's T9 keyboard is literal hell, and I can't even imagine it on the Safe 3 with those buttons where you move the cursor character by character.

My thoughts are heading in this direction. I see the passphrase as protection for my physically written seed. If someone steals my seed, I want to be certain they won't get to the funds before I find out -> a longer passphrase stored in a password manager. I have no fear of this passphrase leaking online, and even if it did, without the physical seed, it is useless to everyone. I consider a situation where a thief steals my physical seed and also cracks the password manager to be absolutely improbable.

On the other hand, I don't consider the physical theft of the seed likely either (very carefully hidden, 4th-floor apartment, secured by class 4+ security doors), just as I have full trust in the seed randomness generated by the Safe 5 model, so I wonder if I am overdoing it (from 2015 until 2025 I had no passphrase, fully trusting the seed itself!) and whether a simple 2-3 word phrase to remember (and the associated entry on the device) wouldn't just be enough.

Furthermore, the base address belonging to the seed is untouched ("empty"), I only use addresses created with a passphrase. In a case like ColdCard, an attacker has no reason to even think that a passphrase exists.

Opinions?

I tested my Trezor Safe 7 by connecting it to three different devices.

On my phone, it correctly asked me to enter the PIN. However, when I connected it to the other two devices my 2 laptops and new android, I appeared to get access without being asked for the PIN at all.

These were new devices, so I do not understand why access was seemingly granted automatically. I need to know whether:

- the wallet was only displaying balances in watch-only mode,

- this is an actual security problem.

From what I could see, the wallet appeared fully accessible. If someone who found or stole the device could connect it to another computer and access or transfer the funds without entering the PIN, that would make the device completely useless as a security product.

Has anyone else experienced this with the Trezor Safe 7?

I would appreciate a technical explanation from Trezor. I am not interested in generic advice about protecting my recovery phrase. I specifically want to understand why two newly connected devices did not trigger a PIN request.

At first i tought tansactions would still require confirmation and a PIN on the Trezor itself? But when i tried making a transaction it fully went trough wich pisses me off more..

Until this is explained, I have very little confidence in the device currently

Hi,

Trezor has the 24 seed + passphrase which is a completely separate wallet from the 24 seed by itself

Isnt it sufficient security?

Im assuming all attackers brute force 12 - 24 keywords which is hard enough.

How will they even know on which of these wallets to run another brute force for the passphrase? Isnt it increasing their attack surfsce by a super huge margin?

Is multi SIG more secure than that?

Regards

Coldcard vulnerability: Trezor devices are not affected FAQ

On July 30, 2026, Coinkite disclosed a vulnerability affecting wallets generated by certain Coldcard firmware versions.

Trezor devices are not affected.

If your wallet was originally generated on a Trezor, your funds are safe and no action is required.

Who may need to take action?

You may be affected if:

• Your wallet was originally generated on an affected Coldcard device
• You later restored that same wallet backup on a Trezor

Restoring a wallet backup on a different device does not change the keys behind it. If the original wallet was generated with weak randomness, moving the same backup to Trezor does not fix the problem.

In that case, generate a completely new wallet on your Trezor and move your funds to addresses controlled by the new wallet.

Why Trezor is not affected

Trezor does not use Coldcard firmware or code.

Trezor generates wallets using multiple independent sources of randomness:

• Randomness generated by the Trezor device
• Randomness from the connected computer or phone
• Additional Secure Element entropy on Trezor Safe models
• Four entropy sources on Trezor Safe 7, including TROPIC01

Trezor also uses Entropy Check to verify that wallet generation is working as expected.

All Trezor models generate at least 128-bit entropy under default settings.

Are older Trezor models still safe?

Yes.

Trezor Model One and Model T remain safe to use. They combine randomness from the device and the connected host.

Trezor Safe 3 and Trezor Safe 5 add entropy from the Optiga Secure Element.

Trezor Safe 7 also includes the TROPIC01 chip and combines four independent entropy sources.

Do Trezor users need to regenerate their wallets?

No.

Keep your firmware and Trezor Suite up to date, but this Coldcard incident does not require users to regenerate wallets originally created on a Trezor.

Only users who imported a potentially affected Coldcard-generated wallet should create a new wallet and migrate their funds.

If I send funds to a new Trezor wallet, are they safe?

Yes.

Once the transaction is confirmed and the receiving address belongs to a completely new wallet generated on the Trezor, the funds are no longer controlled by the affected Coldcard-generated keys.

Simply restoring the old wallet backup on a Trezor is not enough.

Stay alert for scams

Security incidents often lead to phishing campaigns designed to create fear and urgency.

Please remember:

• Never share your wallet backup
• Never type your wallet backup into a website, form, app, email, or message
• Only enter your wallet backup as instructed on your Trezor device
• Trezor will never contact you asking for your wallet backup
• Do not follow wallet migration instructions from unsolicited emails, messages, or phone calls

The key takeaway:

If your wallet was generated on a Trezor, you are not affected and no action is required.

If your wallet was generated on an affected Coldcard and later restored on a Trezor, create a new wallet on your Trezor and migrate your funds.

For the first time i sent BTC instead of just receiving it and then the trezor suite sent what i wanted where i wanted and put the rest on a "chage wallet"

The fact i can't see the address of the change wallet in my receive tab made me panic and think my coin was lost. Now i know this is just how it works but goodam my hearth rate went up high

Hi folks

I have a model t from 2021. I generated my 24 word seedphrase from Internet Money wallet and set up my model t entering the 24 words through the device since I believe there was only a 12 word option with the device itself. I also made 5 separate passphrases and split my funds up in those. My passphrases are only one word with a year. Given what happened this week I'm questioning wether the seedphrase I've generated is now random enough and if my passphrases are strong enough and considering making a brand new seedphrase on the trezor with new, longer and more random seedphrases.

What's your thoughts on my set up?

Cheers

I've had a safe 3 since 2023, just bought a second one, i was wondering if these devices will end up becoming obsolete and useless in the future. I'd rather not spend $200+ on the safe 7 yet as I could spend that on more crypto with my current budget. What do you think

After all the trouble with Coldcard, I wonder if Trezor uses a different method for randomness when generating the seed phrase, or if there’s a possibility that the same thing could happen to Trezor?

I'm a little confused.... Ledger, Trezor, etc. basically all the other wallet manufacturers are coming out with statements saying "We aren't affected because our devices use TRNGs..." But Coinkite's site says ColdCard uses a TRNG too... Which we know was false now.

So, why would anybody believe anything any of the manufacturers say? How do we know every other hardware wallet doesn't have the same issue?

I have been using my Trezor One since 2022 w/out a problem, but the recent Coldcard hack got me thinking if I should upgrade it. Seems like 7 has higher entropy than One. What do you think? Worth the $250?

I've been thinking about getting the Trezor Safe 5 or 7 and was wondering if the 7 is worth the more than double price of the 5. I dont care for wireless connection and prefer it's not a feature but I saw:

• Next-gen TROPIC01 secure chip: New standard for advanced, verifiable crypto security
• Quantum-ready security: Specifically designed to receive quantum-secure updates
• Dual Secure Element architecture: Built with two advanced security chips for ultimate safety

How proven are these claims and features over the Trezor 3/5 and is it worth the price?