Hardware signer

01What pairing changes

With a hardware signer, the seed is generated on the signer and never exists on your phone or laptop. Xendra becomes the part that watches balances, builds transactions and explains them. The signer holds the only copy of the key and shows the critical fields on its own screen.

You keep the decoded preview, the simulation and the approval controls. You lose nothing except the seed being on a general-purpose computer.

02Supported devices

03Pairing

1. Open Settings › Accounts › Add hardware signer.
2. Connect by cable, Bluetooth, or by scanning the QR sequence for an air-gapped device.
3. Xendra imports the extended public keys only. No private material crosses the link, ever.
4. Confirm the first address on the signer's own screen against the app. They must match, character for character.
5. Send a small test transaction before moving anything meaningful.

04Air-gapped signing

With a QR signer, Xendra renders the unsigned transaction as an animated QR sequence. You scan it with the signer, review it there, and scan the signature back. No cable, no Bluetooth, no shared USB stack.

The encoding is UR/BC-UR, so signers from other vendors that implement the same standard generally work even if they are not on our list. Anything that verifies against the standard is accepted.

05What a signer does not fix

• It cannot save you from approving a malicious transaction. Read the signer screen, not just the phone.
• Its recovery phrase still needs a backup, and the same rules apply.
• Buy from the vendor directly. A signer bought second-hand may arrive with a seed someone else already knows.
• Verify the firmware signature on first boot, before you generate anything.