Open sourceFirmware and app you compile yourself
Build your own hardware wallet
From parts sold in any electronics shop and the open-source code behind OneKey's wallets. Your recovery phrase is created inside the device, by its own chip, and never touches a computer.
- Parts
- $38–57
- Time
- About 5 hours
- Soldering
- None
- Random numbers
- From the chip
How it works
Your computer
Runs the OneKey app you built. Shows balances and prepares transactions.
One USB cable
Carries the transaction to sign and the signature back. Never your keys.
Your wallet
Keeps your keys, shows exactly what you're signing, and signs only when you press its button.
Where your recovery phrase comes from
Every recovery phrase starts as electronic noise inside the Pi's own Broadcom chip, and passes five checks on its way out. Nothing is simulated, and nothing comes from a computer.
- Electronic noiseRing oscillators in the chip drift by tiny, unpredictable amounts. That jitter is the raw randomness.
- Settings checkedBefore every start, the wallet reads the generator's control register and accepts only the setting Broadcom's own code uses.
- Warm-up thrown awayThe first 1 MB after start-up is discarded, as Broadcom's code does, so the generator is fully running.
- Every byte testedNIST SP 800-90B health tests run on each byte. A stuck or biased generator stops the wallet.
- Condensed with SHA-256Four bytes of noise go into every byte used. Out comes your 12, 18 or 24-word recovery phrase.
If any check fails, the wallet stops and says so on its screen. It never falls back to software randomness.
How the randomness is checkedThree stages, nine steps
Every step tells you exactly what to type and where, and ends with a check, so you always know it worked before you go on.
Buy
25 minChoose your options and order four parts. Then wait for the delivery.
Build
4 hPrepare the memory card, compile the firmware on the Pi, and build the app. Mostly waiting.
Use
70 minCreate your wallet on the device, make it yours, and learn how to keep it safe.
What you buy
Four parts, all made by the million for other uses. Nothing on this list was made for crypto.
- Raspberry Pi Zero 2 WH$15–22
- Waveshare 1.3inch OLED HAT$11–16
- microSD card, 16 or 32 GB$7–10
- Micro-USB data cable$5–9
Total$38–57
Bought or built
A self-built wallet trades some protections for others.
| A wallet you buy | The wallet you build | |
|---|---|---|
| Who handles it before you | A factory, a warehouse and a courier | People who have no idea it will hold keys |
| Where its software comes from | Installed at the factory | Compiled by you, from source you can read |
| Where the recovery phrase is made | Inside the device | Inside the device, from its chip's hardware generator |
| Secure chip | Usually | No. Add a passphrase. |
| Updates | From the maker, through the app | You rebuild from new code yourself |
| Cost and effort | Buy it and plug it in | $38–57 and about 5 hours |
Who made this
YishiFounder of OneKey@ohyishiA personal project by Yishi, founder of OneKey, built on OneKey's open-source firmware and app. It is not an official OneKey product. Corrections and questions are welcome on X.
Other builds
Pro on a Raspberry Pi with a touchscreen. Not ready yet. The Pro firmware can't be built for a Raspberry Pi from its current code, and the older version that can be built makes predictable random numbers. This build will be added once both are fixed.
On an ESP32 board. Not ready yet. Neither OneKey firmware runs on ESP32 chips today; it needs to be ported first.
Ready when you are
Start with step 1, or pick your options first and get a shopping list. Every command in the guide adjusts to what you chose.