Trezor Safe 3

The Trezor Safe 3 is a Hardware Wallet designed by SatoshiLabs and created in 2023. It's a very compact, lightweight model (14 grams) designed for both beginners and intermediate users. It is the successor to the famous Model One, with significant additions, while retaining the brand's open-source approach that sets it apart from its main competitor, Ledger. The Safe 3 is priced at €79. It is therefore positioned in the mid-range hardware wallet segment, in direct competition with the Ledger Nano S Plus.

The Safe 3 has no battery and operates exclusively via a USB-C connection, used for both power and communication. It features a small 0.96-inch monochrome OLED display and two physical buttons.

The Safe 3 offers all the essential features expected of a good Hardware Wallet, including excellent integration of the passphrase BIP39. However, it does not yet support Miniscript.

This model is particularly suitable for beginners, and might even be the Hardware Wallet I'd recommend to a new user. It's also well suited to intermediate users. On the other hand, it may not meet all the expectations of advanced users looking for more specific features, available on devices like the Coldcard. Nevertheless, if you don't need these advanced options, the Trezor Safe 3 may be an excellent choice.

The Trezor Safe 3 is now equipped with an EAL6+ certified Secure Element, a significant advance on previous models such as the Model One and Model T. This is the OPTIGA Trust M V3 chip, which does not directly store the seed, but acts as a cryptographic component to secure access to it. The Secure Element retains a secret that can only be accessed once the user has entered the PIN correctly. This secret is then used to decrypt the seed, which is stored encrypted in the device's main memory.

This hybrid security system offers improved physical protection, notably against extraction attacks or invasive analysis, problems to which the Model One was prone, particularly in PIN management. These vulnerabilities are now circumvented thanks to the use of the Secure Element. This model also maintains an open-source software architecture: the code that manages the generation and use of private keys remains fully accessible and verifiable. The OPTIGA chip manages only the PIN code, an element external to Bitcoin wallet key management. It only releases a secret that can be used to decrypt the seed. Also, the OPTIGA Trust M V3 chip benefits from a relatively free license, which authorizes SatoshiLabs to freely publish potential vulnerabilities.

This security model represents, in my opinion, one of the best compromises available on the market today. It combines the advantages of a Secure Element with open-source software management. Previously, users had to choose between enhanced physical security with a chip and transparency with open-source; with Trezor Safe 3, it's possible to benefit from both.

In this tutorial, we'll show you how to set up and use your Trezor Safe 3 securely.

When you receive your Safe 3, make sure the box and seal are intact to confirm that the package has not been opened. A software verification of the device's authenticity and integrity will also be carried out when it is set up later.

Box contents include :

When opened, your Trezor Safe 3 should be protected by a protective plastic and the USB-C port should be secured by a holographic seal. Make sure it's there.

Navigation on the device is straightforward: use the right button to scroll to the right, and the left button to scroll to the left. Press both buttons simultaneously to confirm an action.

For this tutorial, I'm going to show you how to use the Trezor Safe 3 with Sparrow Wallet wallet management software. If you haven't already installed this software, please do so now. If you need help, we also have a detailed tutorial on configuring Sparrow Wallet :

You'll also need the Trezor Suite software to configure the Safe 3, check its authenticity and install the firmware. We'll only be using this software for that, and afterwards it will only be needed for firmware updates. For day-to-day management of the wallet, we'll be using Sparrow Wallet exclusively, as it's optimized for Bitcoin and easy to use, even for beginners (Sparrow only supports Bitcoin, not altcoins).

For both these programs, I strongly recommend that you check both their authenticity (with GnuPG) and their integrity (via Hash) before installing them on your machine. If you don't know how to do this, you can follow this other tutorial :

Connect your Safe 3 to your computer where Trezor Suite and Sparrow Wallet are already installed.

Open Trezor Suite, then click on "Set up my Trezor".

Select "Bitcoin-only firmware", then click on "Install Bitcoin-only".

Trezor Suite will then install the firmware on your Safe 3. Please wait during installation.

Click on "Continue".

Then proceed to the authenticity test to make sure your Hardware Wallet is not fake or compromised.

On your Safe 3, press the right button to confirm.

If your Trezor is genuine, a confirmation message will appear in Trezor Suite.

You can then skip the windows with the basic operating instructions.

On Trezor Suite, click on the "Create new Wallet" button.

For a standard wallet, you can opt for the default backup type. This creates a classic single-sig wallet with a 12-word mnemonic phrase. Click on "Create Wallet".

If you would like to learn more about the other backup options available on Trezor, including Multi-share Backup, I recommend you also consult this tutorial :

Accept the terms of use on Hardware Wallet.

Press the right button again to create a new wallet.

In Trezor Suite, click on "Continue to backup".

The software provides instructions on how to manage your mnemonic phrase.

This mnemonic gives you full, unrestricted access to all your bitcoins. Anyone in possession of this phrase can steal your funds, even without physical access to your Trezor Safe 3.

The 12-word phrase restores access to your bitcoins in the event of loss, theft or breakage of your Hardware Wallet. It is therefore very important to save it carefully and store it in a safe place.

You can write it on the cardboard supplied in the box, or for added security, I recommend engraving it on a stainless steel base to protect it from fire, flood or collapse.

Confirm the instructions, then click on the "Create Wallet backup" button.

Safe 3 will create your mnemonic phrase using its random number generator. Make sure you're not being watched during this operation. Write down the words provided on the screen on the physical medium of your choice. Depending on your security strategy, you may consider making several complete physical copies of the phrase (but above all, don't divide it). It's important to keep the words numbered and in sequential order.

For more information on the proper way to save and manage your mnemonic phrase, I highly recommend following this other tutorial, especially if you're a beginner:

To move on to the next words, right-click. You can go backwards by clicking on the left button. Once you've written down all the words, hold down the right button to move on to the next step.

Select the words in your mnemonic phrase according to their order to confirm that you've written them down correctly. Use the left and right buttons to navigate between proposals, then select the correct word by clicking on the 2 buttons simultaneously.

Once this verification procedure is complete, click on the button on the right.

Next comes the PIN code step. The PIN code unlocks your Trezor. It therefore provides protection against unauthorized physical access. This PIN code is not involved in the derivation of your wallet's cryptographic keys. So even without access to the PIN code, possession of your 12-word mnemonic phrase will enable you to regain access to your bitcoins.

On Trezor Suite, click on "Continue to PIN", then on the "Set PIN" button.

Confirm with Safe 3.

We recommend choosing a PIN code that is as random as possible. Be sure to save this code in a separate location from where your Trezor is stored (e.g. in a password manager). You can define a PIN code of between 8 and 50 digits. I recommend that you choose a PIN code as long as possible to enhance security.

Use the left and right buttons to select each digit. To confirm your choice and move on to the next digit, press both buttons simultaneously.

When finished, click on the "ENTER" checkmark at the beginning of the digits, then confirm your PIN a second time.

Your PIN code has been registered.

On Trezor Suite, click on the "Complete setup" button.

The configuration of your Safe 3 is now complete. If you wish, you can change the name and home page of your Hardware Wallet.

We won't be needing the Trezor Suite software any more, except to perform regular firmware updates on your Hardware Wallet, or if you'd like to run a recovery test. We're now going to use Sparrow to manage the wallet, as this software is perfectly suited to Bitcoin-only use.

Start by downloading and installing Sparrow Wallet from the official website on your computer, if you haven't already done so.

Once you've opened Sparrow Wallet, make sure that the software is connected to a Bitcoin node, which is indicated by the tick in the bottom right-hand corner of the Interface. If you're having trouble connecting Sparrow, I recommend that you read the beginning of this tutorial:

Click on the "File" tab, then on "New Wallet".

Name your wallet, then click on "Create Wallet".

In the "Script Type" drop-down menu, select the type of script that will be used to secure your bitcoins. I recommend "Taproot", or failing that, "Native SegWit".

Click on the "Connected Hardware Wallet" button. Your Safe 3 must of course be connected to the computer and unlocked.

Click on the "Scan" button. Your Safe 3 should appear. Click on "Import Keystore".

You can now see the details of your wallet, including the extended public key of your first account. Click on the "Apply" button to finalize wallet creation.

Choose a strong password to secure access to Sparrow Wallet. This password will ensure secure access to your Sparrow wallet data, protecting your public keys, addresses, labels and transaction history from unauthorized access.

I advise you to save this password in a password manager so you don't forget it.

And now your wallet has been imported into Sparrow Wallet!

Before you receive your first bitcoins in your wallet, I strongly advise you to perform an empty recovery test. Write down some reference information, such as your xpub, then reset your Trezor Safe 3 while the wallet is still empty. Then try to restore your wallet on the Trezor using your paper backups. Check that the xpub generated after the restore matches the one you originally wrote down. If it does, you can rest assured that your paper backups are reliable.

To learn more about how to perform a recovery test, I suggest you consult this other tutorial:

On Sparrow, click on the "Receive" tab.

Before using the address proposed by Sparrow Wallet, check it on your Trezor's screen. This practice allows you to confirm that the address displayed on Sparrow is not fraudulent, and that the Hardware Wallet does indeed hold the private key needed to subsequently spend the bitcoins secured with this address. This helps you to avoid several types of attack.

To perform this check, click on the "Display Address" button.

Check that the address displayed on your Trezor matches the one on Sparrow Wallet. It's also advisable to carry out this check just before communicating your address to the sender, to be sure of its validity. You can use the buttons to confirm.

You can then add a "Label" to describe the source of bitcoins that will be secured with this address. This is a good practice that allows you to better manage your UTXOs.

You can then use this address to receive bitcoins.

Now that you've received your first Satss on your Safe 3-secured wallet, you can spend them too! Connect your Trezor to your computer, unlock it using the PIN code, launch Sparrow Wallet, then go to the "Send" tab to build a new transaction.

If you wish to Coin Control, i.e. choose specifically which UTXOs to consume in the transaction, go to the "UTXOs" tab. Select the UTXOs you wish to spend, then click on "Send Selected". You will be redirected to the same screen in the "Send" tab, but with your UTXOs already selected for the transaction.

Enter the destination address. You can also enter multiple addresses by clicking on the "+ Add" button.

Write down a "Label" to remember the purpose of this expense.

Select the amount to be sent to this address.

Adjust the fee rate of your transaction according to the current market. For example, you can use Mempool.space to choose a suitable fee rate.

Make sure all your transaction parameters are correct, then click on "Create Transaction".

If everything is to your satisfaction, click on "Finalize Transaction for Signing".

Click on "Sign".

Click on "Sign" next to your Trezor Safe 3.

Check the transaction parameters on your Hardware Wallet screen, including the recipient's receiving address, the amount sent and the charge. Once the transaction has been verified on the Trezor, click on both buttons simultaneously to sign it.

Your transaction is now signed. Check one last time that everything is OK, then click on "Broadcast Transaction" to broadcast it on the Bitcoin network.

You can find it in the "Transactions" tab of Sparrow Wallet.

Congratulations, you're now up to speed on the basic use of the Trezor Safe 3 with Sparrow Wallet! To take things a step further, I recommend this comprehensive tutorial on using a Hardware Wallet Trezor with a passphrase BIP39 to enhance your safety:

If you found this tutorial useful, I'd be grateful if you'd leave a green thumb below. Feel free to share this article on your social networks. Thank you very much!