Nano S Ledger Hardware Wallet From Box Check to Passphrase Accounts

Ledger Nano S Crypto Hardware Wallet Guide – download Ledger Live only from ledger.com, initialize the device yourself, write the 24-word recovery phrase on paper, and verify every address and amount on the built-in screen before signing.

The signer generates and stores private keys inside a secure element chip; those keys do not leave the device. The companion desktop and mobile app installs coin apps on the signer, manages accounts, shows balances, updates firmware, and prepares transactions. Each outgoing transfer is approved physically on the signer screen, so malware on a computer cannot silently sign.

For the wired model in the key, connect with USB, use the screen to check recipient addresses and fees, and keep the recovery phrase offline. If a newer device offers Bluetooth or a larger display, the same rule applies: the secret words never enter a phone, browser, or chat. Anyone asking for those 24 words through a call, email, or direct message is a thief.

Install firmware and app updates only through the official companion program, and treat release notes on ledger.com as the source for version changes. Support requests go through the official help channels listed there; no legitimate helper needs the recovery phrase, and no update requires typing it into a computer. Before moving funds, test the restore process with a small amount, then confirm the restored accounts match the original addresses.

How to Verify the Ledger Nano S Box and Device Before First Use

Inspect the shrink wrap, tamper-evident seals, and printed packaging against the maker’s official reference images before opening the box.

Once the unit is out, connect it to a computer or compatible phone with the official companion app and run the genuine check; the screen must show a welcome message before any PIN setup, and it must never display a pre-filled recovery phrase or ask you to type your own words into the app. Confirm the box contents match the maker’s published list–the signing device, a USB cable, recovery sheets, and any stated accessories–with no extra seed card or paper telling you to enter an existing phrase. If the seal is broken, the screen shows a non-standard prompt, the authenticity check fails, or the package includes a scratch-off seed card, stop immediately and contact the manufacturer through the support page on the official website. A resold or marketplace unit carries higher risk; verify the same checks or return it.

Setting Up a PIN Code and Writing Down the 24-Word Recovery Phrase

Choosing a Numeric Code for the Secure Element

Pick a 4- to 8-digit code you have never reused on a phone, bank card, or door keypad.

Type it only on the device’s own screen, because the digits never travel to the desktop or mobile companion application, never sit in a phone’s memory, and never reach the internet. The secure element compares the input internally; three consecutive mistakes make it erase the encrypted seed and every installed app on its own, after which the companion software shows the unit as blank and ready for a fresh start. This behavior defines the code’s job: it blocks a stranger who briefly holds the gadget, and it does nothing against a thief who also copies your written word list.

A longer string of digits costs an attacker more guesses but takes longer to enter each time you authorize a transfer, so 6 to 8 characters is a practical compromise. Skip runs such as 1111 or 2468, skip birth years, and skip anything you already use elsewhere.

The written word list carries ownership; the numeric lock only guards the unit itself.

Recording the 24 Words Without a Digital Trace

Your 24 words come from a fixed 2,048-entry dictionary, and each word maps to 11 bits, so the full set holds 256 bits of randomness plus an 8-bit checksum; the last word is partly derived from the others, which means a single wrong substitution gets caught when you check the backup. Copy the words with a pen onto paper in the exact sequence the screen presents them, numbering positions 1 to 24, and confirm the few positions the device asks you to retype. Never store the phrase as a photo, a cloud note, a password-manager entry, a printout, or a screenshot – each of those creates a second copy you cannot control.

Keep two handwritten copies in separate buildings, and consider stamping the words into a metal plate so fire, flooding, or a spilled drink cannot destroy them. Support staff, couriers, and update prompts never require the list; anyone who requests it is a thief.

No legitimate service will ever ask for those 24 words.

Verify the backup before you rely on it: enter the words into a second unit, or run the recovery check inside the companion app, and watch it accept every position. An optional passphrase – the 25th word – creates separate hidden accounts and is not stored on the device, so a lost passphrase loses those accounts while the printed 24 words stay intact. Test a full restore while the holdings are still small, and keep the passphrase apart from the numeric code.

Installing Ledger Live and Connecting the Nano S by USB

Download the companion application exclusively from the vendor’s official site, then attach the USB device using its original cable.

Once the software is installed, open it and select the USB-only model from the device list. Unlock the unit with your PIN, then connect the supplied cable to a direct port on your computer, not a hub, because hubs can cause intermittent power delivery and failed handshakes. The application will prompt you to update firmware if the secure element runs an older version; approve that update on the device screen using the two physical buttons. After firmware is current, the app can install coin-specific signing applications onto the secure element. Each installation requires physical confirmation on the screen, and private keys remain inside the chip. For account setup, add an account in the app, then verify the receive address on the device display before sharing it. USB connection does not use Bluetooth, so pairing is unnecessary. If the device is not recognized, close other applications that might claim the USB interface, try a different cable, and check that the unit is unlocked. Never enter your 24-word recovery phrase into the companion software or any website; the phrase is only for restoring the device itself. The app shows balances and prepares transactions, but every transfer must be approved on the physical screen. After use, you can leave the device connected or disconnect it; disconnecting does not erase keys.

Installing Coin Apps and Managing Storage Space on the Nano S

Install only the blockchain apps you actively use; the signer has finite flash memory, so each installed app consumes space and leaves less room for others.

Each app is a small interpreter for one network’s transaction format. It does not hold your keys; those stay inside the secure element. The companion program uses the app to request public addresses and signatures, and the device screen shows the details before you approve.

Connect the unit by USB, enter your PIN, open the desktop or mobile companion, choose Manager, select the asset, and press Install. You confirm the installation on the screen. If the app does not fit, the companion will report insufficient space; remove another app first, then retry. Accounts in the companion remain tied to the same recovery phrase, so deleting an app does not delete account history or addresses.

Uninstalling an app frees storage without affecting balances or keys.

App sizes differ because some chains require more code for complex transactions, token standards, or smart-contract data. A simple payment network may be tiny; a programmable chain may occupy noticeably more flash. Prioritize the networks you transact with most, and rotate apps when you need a less common chain.

Storage pressure often appears after adding many token accounts inside one app: token accounts do not require separate app installations, but the underlying network app must be present to sign for them. If the device reports no space, remove apps for networks you are not using, keep the companion software current from the official site, and reconnect the device before retrying. Firmware updates can change memory handling, so check the official release notes–not third-party mirrors–before updating.

For frequent use across many chains, a second signing device is cleaner than constant reinstallation. If you rotate apps, verify each address on the screen after reinstalling and before receiving funds. Never enter the recovery phrase into the companion app, a website, or a chat; the phrase belongs only in the device during recovery.

Receiving Crypto: Confirming Addresses on the Nano S Screen

Why the signer’s display outranks the companion app view

Verify every payment address on the signer’s own screen before you paste it into a chat, an invoice, or an exchange withdrawal form, because the companion app only renders what the host machine or phone sends it, while the secure element inside the pocket device re-derives the identical string from the seed it stores and shows you the result of its own computation. Matching both strings character for character is the check that defeats clipboard hijackers, which silently replace a copied address with one controlled by an attacker, and it is also the check that defeats a compromised browser or clipboard manager, since nothing running on the host can alter pixels drawn by the chip. Work through the whole string rather than the visible fragment, and pay attention to the first six and last six glyphs, because those positions are where substitution attacks and hand-copying slips concentrate. If the application shows one string and the device shows another, the transaction route is unsafe: reject the address, close the session, and re-derive. The chip never releases the seed or private keys during this flow; it derives, displays, and waits for your physical button press.

Reused addresses, fresh addresses, and attached tags

Account-based networks let you publish one address indefinitely, while balance-based chains that track individual outputs are better served by a fresh address for each incoming payment, which the desktop or mobile companion generates on request and the signer then displays for approval. Where a memo, destination tag, or payment ID is mandatory, that identifier travels with the address and appears in the same confirmation flow, so read both fields together; omitting the tag can leave a deposit uncredited on the receiving platform.

One wrong character is enough reason to generate a new address and start again.

Checkpoint	Where it appears	What it rules out
Complete address string	Signer display, reached by scrolling the whole value	Clipboard substitution on the host device
First and last characters	Signer display compared against the companion app	Manual copying errors at the most misread positions
Account and derivation path	Prompt shown when the address is requested	Publishing a string from a different account than intended
Memo, tag, or payment ID	Same confirmation flow as the address	Deposits that arrive without a destination identifier
Recovery phrase	Never requested by any legitimate tool or support agent	Social engineering aimed at the seed

Sending Crypto: Verifying Amount, Fee, and Destination on the Device

Before approving any transfer, compare the amount, network fee, and full recipient address shown on the signer’s screen with what you entered in the companion application; reject the transaction if even one character differs.

The display is the final authority. Private keys remain inside the certified chip, while the companion application builds a transaction and passes its payload to the signer. Any altered clipboard entry, compromised browser extension, or malicious app can change what the computer shows. The built-in screen renders fields from the signed payload, so approving only after checking every page prevents a manipulated transfer from being broadcast.

Read the destination character by character, not just its prefix and suffix. Address-poisoning attacks create lookalike beginnings and endings, hoping you skip the middle. Compare the whole string against the source you trust, or scan the recipient’s QR code and confirm the decoded text on the device. If a memo, tag, or payment ID is required, verify it exactly; an omitted or wrong memo can make funds unrecoverable. When the signer shows a contract interaction or a payload you cannot interpret, cancel instead of blind-signing. For recurring destinations, save the address after this on-screen check, then send a small test transfer before large value.

• Amount: confirm the exact asset, quantity, and destination network match your intent; a different network can route value to an address you do not control.
• Fee: check the network charge in the native unit, plus any provider or bridge service cost; if the total debit equals the amount plus the fee, approve only when both figures match the quote.
• Destination: verify the recipient address, memo, and, for token transfers, the token contract shown by the signer; reject mismatches.

Fee fields depend on blockchain conditions and transaction size. On account-based networks, the signer may display a base charge and a priority charge; on UTXO-based networks, it may show a rate and total. The companion application estimates these values, but the screen shows what the signed payload actually authorizes. If the fee looks abnormal compared with the app’s estimate, cancel, refresh the fee estimate, and rebuild the transfer. Do not approve a fee that consumes the full balance unless you intend to empty the account.

If the signer displays a different recipient, amount, fee, memo, or network than intended, press reject. A confirmed transfer is irreversible; the signed payload is final.

Using a BIP39 Passphrase for Hidden Wallets on the Nano S

Store the passphrase offline, separate from the 24-word recovery phrase, and test the derived account set with a small transfer before moving meaningful balances.

During seed derivation, the firmware feeds the mnemonic and the passphrase into PBKDF2-HMAC-SHA512 with 2048 iterations, producing a 64-byte seed that feeds BIP32 key generation; every distinct passphrase, including case and spacing differences, yields a separate key tree, so the device’s primary PIN opens one set of accounts while a second PIN attached to the passphrase opens another. The passphrase is not part of the 24 words and is not stored in the backup; in temporary mode you re-enter it on the device after each restart, while PIN-attached mode stores it encrypted in the secure element behind that secondary PIN. Because BIP39 normalizes Unicode with NFKD, extra spaces, capitalization, and special characters must match exactly on every restore.

On the device, open Settings > Security > Passphrase, choose a temporary phrase or attach it to a new PIN, and enter the passphrase using the screen and buttons rather than a computer keyboard; then connect to the official companion, add the accounts for that session, and verify each receive address on the device screen before sharing it. If the companion was open with the primary PIN, close it or switch the device session first, because accounts from the no-passphrase tree remain hidden until the passphrase-backed PIN is used.

Without the passphrase, the derived accounts cannot be restored from the 24 words alone.

Use a high-entropy string–four to six random words or twelve or more random characters–never a simple variant of the mnemonic, a pet name, or a date, because an attacker who obtains the 24 words can brute-force weak passphrases offline. Keep two physical copies in separate locations, avoid digital photos and cloud notes, and never type the passphrase into a website, chat, or pop-up; no legitimate support agent asks for it or for the 24 words. For plausible deniability, do not label the secondary PIN, do not store both account sets in the same companion profile if you need separation, and verify the device screen’s address before every outgoing transfer. A forgotten passphrase has no recovery path, and a firmware reset requires re-entering it on the device.

Q&A:

Can I set up my Ledger Nano S without Ledger Live?

For the first setup, you need Ledger Live. It installs firmware, sets your PIN, and shows your recovery phrase. After that, you can use some third-party wallets that support Ledger, like MetaMask, Electrum, or MyEtherWallet. But firmware updates and app installation usually go through Ledger Live. You can skip Ledger Live only if the device already has firmware and apps installed and you are using a supported third-party wallet.

What happens if I lose the Nano S but still have the recovery phrase?

You can restore access with the recovery phrase on another Ledger or compatible wallet. The phrase is the backup of your private keys, so it controls the same accounts. Buy a new device or use supported software, choose restore, and enter the 24 words in order. After restore, your accounts appear. Without the phrase, a lost device means the funds stay on the blockchain but you cannot move them. A PIN does not help because it only locks that one device.

Why can I only install two or three apps on my Nano S?

The Nano S has small internal storage. Each coin app takes space. You can remove apps you are not using and install others later. Removing an app does not delete your crypto or private keys. Your keys live in the secure element, not in the app. So if you need Bitcoin, Ethereum, and Solana, you may install one or two at a time and switch. The trade-off is less convenience than models with more memory.

Is a used Ledger Nano S safe to buy?

A used device from an unknown seller is risky. Someone could have opened it, replaced parts, or loaded a recovery phrase they already know. If you restore that phrase, the seller can take your coins. Buy from Ledger or an authorized reseller. When your device arrives, check the box and seals. Set it up as a new device and write down the recovery phrase the device generates. If it asks you to use a phrase someone gave you, stop and reset it. If a reset is not possible or the device behaves strangely, return it.

How do I verify a receiving address when using the Nano S?

Always check the address and amount on the Nano S screen before you confirm. Your computer or phone can be infected with malware that changes the address shown in the wallet app. The device screen is the trusted display. If the address on the device does not match the one you copied from the exchange or sender, cancel. For large transfers, send a small test amount first. For contract calls or staking, read the details on the device screen. Do not approve blind signing unless you understand the contract.

What should I do if my Ledger Nano S is lost or broken but I still have the recovery phrase?

If you have the 24-word recovery phrase, you can restore access to your crypto accounts on another compatible hardware wallet or supported software wallet. The device itself is not the wallet; it stores private keys. The recovery phrase is the backup that recreates those keys. Get a replacement Ledger Nano S or another wallet that follows BIP39/BIP44 standards, choose “Restore from recovery phrase” during setup, and enter the words in the exact order. Use a private place, and never type the phrase into a website, email, chat, or any app that asks for it outside the wallet’s own recovery screen. After restoration, check that your accounts and balances appear. You may need to add accounts for each coin or token if they do not show right away. Set a new PIN. If you also had a passphrase (the advanced 25th word), you must enter that same passphrase after the 24 words; without it, you will see a different set of accounts. If the device is lost, the recovery phrase is enough to move funds to new addresses if you want to replace the old setup. Keep the phrase offline, on paper or metal, in a secure location. Do not store it as a photo or text file. If you do not have the recovery phrase, the funds cannot be recovered from the device alone; a lost PIN or damaged device without the phrase cannot be bypassed. Contact Ledger support only through their official site if you need help, and never share the phrase with support. They never need it.