Zcash hardware wallets in 2026
Two hardware wallets support shielded ZEC in the Ironwood pool in October 2026: the Keystone 3 Pro with its Cypherpunk firmware, used with Zodl on a phone, and Ledger devices through Ledger Wallet Desktop or the Zondax Zcash Shielded app. Trezor supports transparent ZEC only, and KeepKey's shielded support is still in development.
A hardware wallet keeps your private keys on a separate device and asks you to approve each transaction on its own screen. For Zcash, that used to mean giving up privacy: until 2025 hardware wallets handled transparent addresses only. Guides written as recently as February 2026 still say no hardware wallet supports shielded ZEC. That is no longer true.
Hardware wallets compared
| Device | Shielded ZEC | Ironwood | Companion app | Open source | Status Oct 2026 |
|---|---|---|---|---|---|
| Keystone 3 Pro | Yes | Ready | Zodl (iOS, Android) | Yes | Active; needs Cypherpunk firmware |
| Ledger (Nano S Plus, Stax, Flex) | Yes | Ready | Ledger Wallet Desktop; Zkool, Vizor via Zondax app | No (closed firmware) | Active; shielded on desktop since 23 Sep 2026 |
| Trezor (Safe 3, 5, 7) | No | Not ready | Trezor Suite, Exodus | Yes | Transparent only |
| KeepKey | In development | Code merged 31 Jul 2026 | KeepKey Vault | Yes | Stable release not confirmed |
| SafePal | No | Not ready | SafePal app | Not verified | Transparent only |
Keystone 3 Pro with Zodl
Keystone's air-gapped device never connects by USB or Bluetooth; it talks to your phone by scanning QR codes. With the special "Cypherpunk" firmware it signs shielded Zcash transactions, and Zodl acts as the companion app that syncs the chain and builds transactions. Keystone announced Ironwood firmware in June 2026, and Zodl includes a guided Ironwood migration for Keystone accounts.
Best for: people who mainly use a phone and want shielded ZEC with keys kept off it. Limitation: Zodl is the only documented shielded companion. Full Keystone review.
Ledger
Ledger's path to shielded ZEC came in steps. Ledger was transparent-only until August 2025, when de-shielding was added. Then the Zondax "Zcash Shielded" Ledger app let companion wallets such as Zkool and Vizor sign shielded transactions. On 23 September 2026 Ledger added native shielded ZEC, including Ironwood, to Ledger Wallet Desktop, with read-only access you can share with an accountant.
A September 2026 report (Crypto Briefing) listed the Nano S Plus, Stax and Flex for the Zondax app and said the Nano X was not supported for it; Ledger's own announcement does not list devices, so check in Ledger Wallet before buying. Shielded support is desktop only for now. Full Ledger review.
Trezor: transparent only
Trezor states that its devices support only transparent t-address transactions. In November 2025 Trezor said it would resume a grant to add Orchard support, but no shielded support had shipped by October 2026, and Orchard has since been replaced by Ironwood for new funds. A Trezor is fine for storing transparent ZEC, and you can shield later by sending to a shielded wallet. Trezor review.
KeepKey: watch this space
A pull request adding Ironwood shield, send and de-shield support to KeepKey Vault was merged into its development branch on 31 July 2026, with a mainnet test transaction confirmed. We could not confirm that it has reached a stable release, so treat KeepKey as transparent-only until it does.
Which should you buy?
- Mostly on your phone: Keystone 3 Pro with Zodl.
- Mostly on a computer, or you already own a Ledger: Ledger with Ledger Wallet Desktop.
- You already own a Trezor: keep it for transparent ZEC, but use a shielded software wallet for anything private.
We compare the two shielded options side by side in Ledger vs Keystone for Zcash.
How shielded signing works on a hardware wallet
Shielded Zcash is harder for hardware wallets than Bitcoin. A companion app on your phone or computer must scan the chain to find your shielded notes and build the transaction, which needs a viewing key. The device then holds the spending key, shows you the recipient and amount, and signs. So the companion app can see your balance and history, but cannot spend without the device.
That split is why each hardware option is tied to specific software: Keystone to Zodl, and Ledger to Ledger Wallet Desktop or Zondax-compatible companions such as Zkool. Protect the phone or computer running the companion app, since a viewing key on it can reveal your history.
Moving hardware-held Orchard funds
If your hardware wallet held shielded ZEC in Orchard before 28 July 2026, it must be moved into Ironwood through the turnstile. Zodl offers a guided migration for Keystone accounts. Ledger users should update Ledger Wallet Desktop and the device app first. See Orchard to Ironwood.
Hardware wallet safety
- Buy from the manufacturer or an authorised reseller, never second-hand. Type the official address yourself: keyst.one, ledger.com, trezor.io.
- No real support agent will ever ask for your recovery phrase.
- Your recovery phrase is the real backup. Store it offline, away from the device.
- Shielded hardware setups still rely on a companion app to sync. Install that app only from official sources too.
- A viewing key shared for "read-only access" cannot be revoked; share it only with people you trust (viewing keys).
Frequently asked questions
Which hardware wallets support shielded Zcash?
As of October 2026, the Keystone 3 Pro (with Zodl and Cypherpunk firmware) and Ledger devices (via Ledger Wallet Desktop or the Zondax Zcash Shielded app). Both are listed as Ironwood-ready.
Does Trezor support shielded ZEC?
No. Trezor supports transparent Zcash addresses only. A grant to add shielded support was announced in November 2025, but nothing had shipped by October 2026.
Can I use Ledger with Zcash on my phone?
Not for shielded ZEC yet. Ledger's native shielded support is desktop only; Ledger says mobile is coming soon.
Is a hardware wallet worth it for Zcash?
For amounts you would hate to lose, yes. It protects your keys if your phone or computer is compromised. For small spending amounts a shielded mobile wallet is enough.