Keystone 3 Pro for Zcash: review
The Keystone 3 Pro is an open-source, air-gapped hardware wallet that signs shielded Zcash transactions, including Ironwood, when it runs Keystone's 'Cypherpunk' firmware and is paired with the Zodl mobile app. Zodl syncs the chain and the Keystone signs by QR code, so your keys never touch your phone. It is the best hardware option for phone-first Zcash users.
Keystone was the first hardware wallet to offer a smooth shielded Zcash experience, working with Zashi (now Zodl) since 2025. After the Orchard flaw, Keystone announced Ironwood firmware in June 2026, and Zodl added a guided Ironwood migration for Keystone accounts.
Keystone at a glance
| Fact | Keystone 3 Pro (October 2026) |
|---|---|
| Type | Air-gapped hardware wallet (QR codes, no USB or Bluetooth for signing) |
| Platforms | Paired with Zodl on iOS or Android |
| Open source | Yes (described as open source by z.cash) |
| Custody | Self-custody; keys stay on the device |
| Shielded pools | Ironwood plus transparent |
| Ironwood readiness | Ready, with Cypherpunk firmware (announced June 2026) |
| Sync | Zodl syncs and builds transactions; the Keystone signs via QR |
| Hardware support | It is the hardware; Zodl is the only documented shielded companion app |
| Status | Active |
How it works
- Install Keystone's Cypherpunk firmware, the edition that supports Zcash shielded signing.
- In Zodl, choose to connect a Keystone. Zodl shows how to scan the Keystone's QR code to import a watch-only account.
- Zodl syncs the blockchain and shows your shielded balance.
- To send, Zodl displays a QR code with the unsigned transaction. You scan it with the Keystone, check the details on its screen, approve, and scan the signed transaction back into Zodl.
Zodl's support centre has a step-by-step article on connecting a Keystone. If your Keystone account held Orchard funds, Zodl walks you through moving them to Ironwood (migration guide).
Pros and cons
| Pros | Cons |
|---|---|
| Shielded ZEC with keys off your phone | Needs the special Cypherpunk firmware |
| Air-gapped: QR codes only | Zodl is the only documented shielded companion |
| Open source | Signing by QR is slower than tapping "send" |
| Works on iPhone and Android via Zodl | No desktop shielded companion documented |
| Ironwood-ready with guided migration | A device to buy and look after |
Who Keystone suits
Keystone is for people who use Zcash mainly on their phone and want hardware-level protection for savings, without giving up shielded privacy. It is especially attractive on iPhone, where Ledger's shielded support is not yet available. If you prefer a computer, consider a Ledger. Full comparison: Ledger vs Keystone.
Privacy considerations
Zodl holds a watch-only view of your account, so your phone can see your balance and history even though it cannot spend. Protect the phone with a passcode. Zodl's optional Tor setting hides your IP address from the light-wallet server while syncing.
Who should look elsewhere
- Desktop-first users who want shielded ZEC on a computer: Ledger Wallet Desktop is the documented option.
- People who need shielded multisig: look at Zkool's FROST support.
- People who want one hardware wallet for many coins in many apps: check Keystone's support for your other coins separately, as Cypherpunk firmware is a specific edition.
What you need
- A Keystone 3 Pro bought new from Keystone or an authorised reseller.
- Keystone's Cypherpunk firmware, installed following Keystone's official instructions.
- An iPhone or Android phone with the latest Zodl.
- Paper (or a metal backup) for the recovery phrase, stored away from the device.
- A small amount of ZEC for a test transaction before moving savings.
Shielded payments cost the standard ZIP-317 fee, usually 0.0001 ZEC (fees); the hardware adds no network cost.
Verdict
For phone-first Zcash users, Keystone 3 Pro with Zodl is the best way to hold shielded ZEC on hardware in 2026. It is open source, air-gapped and Ironwood-ready. The trade-offs are the special firmware, slower QR signing and dependence on a single companion app.
Safety notes
- Buy from Keystone directly or an authorised reseller. The official site is keyst.one; type it yourself.
- Download firmware only from Keystone's official site and follow its verification steps.
- Write the recovery phrase on paper and keep it away from the device.
- Always confirm the address and amount on the Keystone screen, not just in Zodl.
Frequently asked questions
Does Keystone support shielded Zcash?
Yes. The Keystone 3 Pro with Cypherpunk firmware signs shielded ZEC, including Ironwood, when paired with Zodl.
Which app do I use with Keystone for Zcash?
Zodl (formerly Zashi) on iOS or Android. It is the only documented shielded companion app.
Is Keystone better than Ledger for Zcash?
It depends on how you use Zcash. Keystone is air-gapped, open source and works on your phone via Zodl; Ledger's shielded support runs in Ledger Wallet Desktop on a computer.
Do I need special firmware?
Yes. Shielded Zcash requires Keystone's Cypherpunk firmware edition.