---
title: "Secure Boot: How Hardware Wallets Check Firmware (PDF)"
url: "https://bip39-phrase.com/list-phrase/hardware-wallets-bip39-phrase-2025-10-03/"
language: "en"
updated: "2026-10-19T00:00:00+00:00"
---

# Secure Boot: How Hardware Wallets Check Firmware

Secure boot uses cryptographic signature verification at startup to prevent malicious firmware from extracting your BIP39 seed phrase.

PDF document · Published October 3, 2025 · Updated October 19, 2026 

[ Open the PDF (6 pages, 354 KB) ](/list-phrase/hardware-wallets%5Fbip39-phrase%5F2025-10-03.pdf) 

## Contents

1. The Hardware Root of Trust and the Boot Sequence
2. Cryptographic Signature Verification
3. Defensive Handling of Unofficial Firmware
4. Anti-Rollback Mechanisms and Seed Protection
5. FAQ
6. Sources
7. Sample sequences of BIP39 words
8. Reading a BIP39 phrase
9. See also

Keywords: 

secure boot · hardware wallet · firmware verification · root of trust · cryptographic signature

Topic: 

[Crypto Wallets: Hardware, Software and Multisig](/topics/wallets/)

## Guides on the same subject

- [What Is a Hardware Wallet and How Does It Work? (Ledger, Trezor)](/hardware-wallets-explained/)  
A hardware wallet keeps your private keys on a small device and signs each transaction after you confirm it on its screen. How it works and what it can't stop.
- [Hardware Wallets Compared: Ledger, Trezor, Keystone and More](/hardware-wallet-comparison/)  
Ledger, Trezor, Keystone, COLDCARD, BitBox, Jade, Passport and Tangem compared: key chips, open firmware, screens, backups and coins, from makers' own specs.
- [12 vs 24 Word Seed Phrase: Which Is More Secure?](/12-vs-24-word-seed-phrase/)  
A 24-word seed phrase has 256 bits of entropy and a 12-word one 128, but both are beyond brute force; 24 words help mainly when part of a backup is exposed.

One of the documents in the [Seed Phrase PDF Archive](/list-phrase/), listed on [archive page 6](/list-phrase/6/).