Ledger vs Keystone for Zcash: which hardware wallet?
Both Ledger and Keystone now support shielded ZEC in the Ironwood pool. Keystone 3 Pro is air-gapped, uses open-source firmware and pairs with the Zodl mobile app; Ledger works with Ledger Wallet Desktop (native shielded since 23 September 2026) and with Zkool or Vizor. Pick Keystone for phone-first, air-gapped use and Ledger for desktop and multi-coin convenience.
Until 2025, most guides said no hardware wallet supported shielded Zcash. That is now out of date. In October 2026 two hardware wallets handle shielded ZEC in the Ironwood pool: Keystone 3 Pro and Ledger. Trezor still supports only transparent ZEC (see Trezor and Zcash).
Ledger vs Keystone at a glance
| Ledger | Keystone 3 Pro | |
|---|---|---|
| Shielded ZEC | Yes: Ironwood and transparent | Yes: Ironwood and transparent |
| How you get it | Native in Ledger Wallet Desktop (since 23 Sep 2026); also the Zondax Zcash Shielded app | Special "Cypherpunk" firmware |
| Companion app | Ledger Wallet Desktop; Zkool or Vizor | Zodl (iOS, Android) |
| Mobile shielded use | Not yet ("coming soon" per Ledger) | Yes, through Zodl on your phone |
| Connection | USB (Bluetooth on some models) | Air-gapped: QR codes only |
| Supported models for shielded | Not listed by Ledger; a Sep 2026 report named Nano S Plus, Stax and Flex for the Zondax shielded app and said Nano X was not supported | Keystone 3 Pro |
| Firmware | Closed source | Open source |
| Extras | Read-only viewing access for accountants; private coinholder voting | Guided Ironwood migration in Zodl |
| Best for | Desktop users, existing Ledger owners, many coins | Phone users, air-gap fans, Zcash-first users |
How shielded ZEC works on a hardware wallet
Your spending keys stay on the device. The companion app holds a viewing key so it can scan the chain and show your shielded balance, then sends each transaction to the device to approve and sign. That means the companion app can see your shielded history, but cannot spend. Keep the companion device clean, and remember that a viewing key, once shared, cannot be revoked (see viewing keys).
Keystone 3 Pro with Zodl
Keystone has worked with Zashi, now Zodl, since 2025, and announced Ironwood firmware in June 2026. The device never connects by cable or wireless: you scan QR codes between the phone and the Keystone screen. You need to install Keystone's Cypherpunk firmware for Zcash, and Zodl is the only documented shielded companion. Zodl walks you through moving old Orchard funds to Ironwood.
Pros: fully air-gapped, open-source firmware, works on the go with your phone, and the Zodl app is beginner-friendly with built-in swaps. Cons: special firmware, a single companion app, and no desktop shielded option documented. See our Keystone review.
Ledger
Ledger's Zcash support moved quickly: transparent only until August 2025, then the Zondax "Zcash Shielded" app used with companion wallets such as Zkool and Vizor, and finally native shielded ZEC in Ledger Wallet Desktop on 23 September 2026 (Ledger, Sep 2026). Mobile support is announced as coming soon. The desktop app scans the chain using a unified viewing key stored locally.
Pros: one device for many coins, a large ecosystem, a choice of companion apps, and read-only access for an accountant. Cons: shielded use is desktop only for now, model limits for the shielded app, and closed firmware. Some holders of very old ZEC (from before 2018) reported trouble moving it from Ledger in November 2025. See our Ledger review.
Fees and everyday use
A hardware wallet does not change Zcash fees: a simple shielded payment still costs 0.0001 ZEC under ZIP-317 (see the fee calculator). What changes is convenience. With Keystone you scan two or three QR codes per payment; with Ledger you plug in or pair the device and confirm on its screen. For small daily spending, many people keep a separate hot wallet such as Zodl or Zingo! and use the hardware wallet as savings.
Moving coins from a hot wallet to hardware is just a shielded send to the hardware wallet's unified address, so it stays private. Moving from an exchange is different: most exchanges withdraw to transparent addresses, so shield the funds afterwards (see how to shield ZEC).
Safety tips for either device
- Buy from the manufacturer or an authorised seller, never second-hand.
- Type ledger.com or keyst.one yourself or use a bookmark; fake companion apps and firmware sites exist.
- Write the recovery phrase on paper or metal. Never type it into a computer, phone or website.
- Check every address on the device screen before you approve.
- If you still hold funds in the old Orchard pool, follow the Orchard to Ironwood guide.
Which should you choose?
- Choose Keystone 3 Pro if you mainly use your phone, want an air-gapped device with open firmware, and are happy with Zodl as your app.
- Choose Ledger if you already own one or hold many coins, prefer a desktop app, or want to use Zkool's advanced features.
- Avoid Trezor for shielded ZEC for now: it supports only transparent addresses.
Our verdict: for a Zcash-first user, Keystone with Zodl is the cleanest shielded setup today. For a multi-coin desktop user, Ledger is now a solid shielded option. Compare all devices in Zcash hardware wallets.
Frequently asked questions
Does Ledger support shielded Zcash?
Yes. Ledger Wallet Desktop added native shielded ZEC with Ironwood support on 23 September 2026. Mobile support is announced as coming soon.
Does Keystone support Ironwood?
Yes. Keystone 3 Pro supports Ironwood with its Cypherpunk firmware, paired with the Zodl mobile app.
Does Trezor support shielded ZEC?
No. As of October 2026 Trezor supports only transparent ZEC addresses.
Which is more private, Ledger or Keystone?
Both keep keys on the device and use shielded transactions. Keystone is air-gapped and has open-source firmware; Ledger's firmware is closed. Your companion app and network habits matter as much as the device.