An air-gapped computer is physically isolated from any network. It’s the most secure way to manage crypto keys.
What Air-Gapped Means
| Connected | Air-Gapped |
|---|---|
| Connected to the internet | Never connected to any network |
| Vulnerable to remote attacks | Immune to remote attacks |
| Can be hacked via network | Must be physically accessed |
| Software updates automatic | Manual updates via USB |
Air-Gapped Setup Options
| Option | Cost | Security |
|---|---|---|
| Dedicated laptop (offline) | £200-500 | High |
| Raspberry Pi (offline) | £50-100 | High |
| Old smartphone (never online) | £0-100 | Moderate |
| Hardware wallet (Ledger, Trezor) | £50-200 | Very high (similar concept) |
How to Set Up an Air-Gapped Computer
| Step | Action |
|---|---|
| 1 | Get a dedicated device (laptop, Raspberry Pi) |
| 2 | Install a clean OS (Linux Mint or Ubuntu) |
| 3 | Never connect it to the internet (not even once) |
| 4 | Install crypto software via USB |
| 5 | Generate keys and sign transactions offline |
| 6 | Transfer signed transactions via USB to online device |
Software to Install Offline
| Software | Purpose |
|---|---|
| Electrum (Bitcoin) | Cold storage wallet |
| Sparrow Wallet | Advanced Bitcoin wallet |
| Tails OS | Privacy-focused OS (boots from USB) |
| Linux Mint | Clean OS for the device |
Download the software on a different computer and transfer via USB.
Signing Transactions Offline
| Step | Action |
|---|---|
| 1 | Create unsigned transaction on online device |
| 2 | Transfer to air-gapped computer via USB |
| 3 | Review and sign on air-gapped computer |
| 4 | Copy signed transaction back to USB |
| 5 | Broadcast from online device |
Air-Gapped vs Hardware Wallet
| Factor | Air-Gapped PC | Hardware Wallet |
|---|---|---|
| Cost | £50-500 | £50-200 |
| Setup complexity | High | Low |
| Ease of use | Low | High |
| Security | Very high | Very high |
| Portability | Low | High |
| Firmware verification | Manual | Built-in |
For most users, a hardware wallet (Ledger/Trezor) provides equivalent security with much better usability.
Advantages of Air-Gapped
| Advantage | Why |
|---|---|
| No firmware supply chain risk | You control the software |
| Full transparency | Open source, fully auditable |
| No USB vulnerability (if using QR) | QR codes for transaction transfer |
| Customisable | You decide the software stack |
Disadvantages
| Disadvantage | Why |
|---|---|
| Complex setup | Not for beginners |
| Manual updates | Each update needs USB transfer |
| USB risk | USB could carry malware between devices |
| Physical security | Entire device must be physically secured |
Bottom Line
An air-gapped computer provides maximum security by never connecting to the internet. Use a dedicated device with Linux, install crypto software via USB, and sign transactions offline. For most people, a hardware wallet is a better balance of security and usability. Air-gapped setups are for advanced users with large holdings or specific security requirements. Never connect the air-gapped device to any network — not even once.
Getting the setup right
An air-gapped setup only delivers its security if the discipline around it holds. The most common failures aren’t technical — they are lapses in procedure that quietly break the isolation.
First, verify your software before you commit to it. Download the operating system, Electrum, or Sparrow on a connected machine and check the official checksums and signatures against the publisher’s site before copying the files to USB. This prevents a malicious download from riding into your offline environment on day one. Second, decide how transactions travel between worlds. A USB stick is the common method, so treat it as part of the security boundary: use a dedicated stick, write-protect it where possible, and consider QR codes to move unsigned and signed transactions so no physical medium is shared between the online and offline machines at all.
Third, never relax the “not even once” rule. A single accidental connection to the network — a Wi-Fi adapter left on, an unplugged Ethernet cable already hot — negates the entire design and reintroduces every remote vector you were trying to eliminate. When you are not using the machine, store it powered down and physically secured, because once you remove network access, physical access is the only attack surface left. For most readers this careful ritual is more effort than the equivalent protection of a hardware wallet, which is why an air-gapped computer is best reserved for advanced users with large holdings who want full transparency over their software stack.
If that level of discipline sounds like more than you want to maintain, save yourself the effort and buy a Ledger or Trezor. You get the same offline-key security with automated firmware verification, lower cost, and no USB workflow to manage.