Hardware, Mobile or Browser Wallet: Where the Key Should Live
A wallet is not a brand or an app. It is a place where a private key lives and a way to sign with it. The three form factors most people choose between - a browser extension, a mobile app and a dedicated hardware device - differ mainly in where that key sits and what else can see the transaction before it is signed. The right answer is often more than one of them.
Cover artwork: CoinSoso · AI-generated, not a photograph of a real venue, product or market capture.
Key takeaways
- All three form factors hold the same kind of key; they differ in where it lives and in what can reach it.
- A browser extension runs inside the application that renders every website you visit, which is a large attack surface.
- A mobile wallet moves the key to a general-purpose device with network access and its own app ecosystem.
- A hardware wallet keeps the key on a dedicated device and signs there, but the transaction is still built on a computer.
- Splitting holdings by purpose - spending, signing, long-term storage - removes the need to pick one form factor for everything.
The same key in three places
Every self-custody wallet does two things: it stores a private key, and it uses that key to sign a transaction. The form factor changes where the key is stored and what software has access to the signing step.
That is the whole comparison. Features, interfaces and supported chains matter, but they do not change the underlying question: on which machine does the key exist, and what else runs on that machine?
Browser extension: closest to the page, largest surface
An extension wallet lives inside the browser. It injects an interface into the pages you visit so that a decentralised application can request a signature, and it holds the key in the browser’s storage, encrypted by a password.
The convenience is real: one click connects a wallet to an application. The cost is that the wallet shares an environment with every other extension and every page you load. ethereum.org’s security guidance is direct about this class of software: extensions “can improve browser functionality but also come with risks,” and by default most ask for access to “read and change site data,” allowing them to do almost anything with your data. The page’s recommendation is to uninstall extensions you do not need.
Two failure modes follow:
- A malicious or compromised extension with page access can alter what you see, including an address you are about to copy.
- A malicious site can request a signature that does more than it appears to. The wallet’s confirmation screen is the only place the difference is visible, and it is easy to click through.
An extension wallet is a working tool for frequent on-chain activity with small balances. It is a poor place for a balance you would not be willing to lose to a single mistaken click.
Mobile wallet: a separate app on a general-purpose device
A mobile wallet is an app rather than a browser plugin. That removes the extension’s direct access to web pages, but the phone is still a networked computer running an app store, a browser, a messaging client and often a cloud backup.
The practical differences from an extension are about isolation and habit:
- The key is behind the app’s own sandbox and, usually, a device passcode or biometric check.
- Signing happens in a dedicated interface rather than a pop-up over a web page.
- The risk moves to the device: a stolen unlocked phone, a cloud backup that captured the phrase, or a malicious app with excessive permissions.
A mobile wallet is the most common first self-custody wallet, and for many people it is the right one. It is also the form factor most likely to hold a recovery phrase in a screenshot or a notes app, which ethereum.org warns against specifically: screenshots “might sync them to a cloud data provider, which could make them accessible to hackers.”
Hardware wallet: the key on a dedicated device
A hardware wallet stores the key on a device built for that purpose and signs transactions on the device. Trezor’s explainer describes the mechanism as interfacing with your computer “without exposing your private key to the internet,” and states that even if the computer is compromised, the key remains safe because it never interacts directly with the online device.
ethereum.org’s security page recommends the category for exactly this reason, describing a hardware wallet as offline storage for private keys and as “the most secure wallet option for storing your private keys.”
The boundary is as important as the protection. The transaction is assembled on the computer, and the computer can lie about what it is asking the device to sign. The device screen is where the recipient, amount and action have to be checked. The existing guide to what a hardware wallet does and does not protect against covers that boundary in detail.
The comparison that actually decides it
| Question | Extension | Mobile | Hardware |
|---|---|---|---|
| Where is the key? | Browser storage, password-encrypted | App sandbox, device lock | Dedicated device, PIN |
| What builds the transaction? | The page and the browser | The app | The computer, then the device signs |
| Main failure mode | Malicious page or extension | Stolen or compromised phone | Approving the wrong transaction |
| Recovery | Seed phrase | Seed phrase | Seed phrase on a new device |
| Good for | Small, frequent on-chain use | Everyday spending and moderate holdings | Larger balances, infrequent signing |
The table does not produce a winner. It produces a division of labour.
Use more than one
The most workable arrangement is usually not a single wallet but a set of them, separated by purpose:
- Spending wallet - a mobile app or extension with a small balance, used for small purchases, test transactions and connecting to applications.
- Signing wallet - a hardware device holding the balance you would not want to lose, used when you need to move it and not otherwise.
- Backup - one written recovery phrase per wallet, stored offline, never photographed and never typed into a website, per ethereum.org’s guidance that the phrase is the only way to recover the wallet.
This split solves a problem the single-wallet question cannot: a device that is safe enough for a long-term holding is inconvenient for daily use, and a wallet convenient enough for daily use is a poor place for a long-term holding.
A short setup checklist
- Write the recovery phrase on paper, offline, once per wallet, and never store it on a computer or in a screenshot.
- Keep the spending wallet small enough that a mistake is survivable.
- Check the recipient and amount on the signing device, not only on the screen that requested the signature.
- Remove browser extensions you do not use; ethereum.org lists this among its security recommendations.
- Re-test a small withdrawal before moving a larger balance to a new setup.
- Store the device and the backup separately, so that one theft or fire cannot take both.
The form factor is a starting point, not a verdict. What determines the outcome is whether the key stays where you put it, whether the backup is safe, and whether you look at what you are signing.
Risk note. This article explains wallet form factors, not investment advice. It does not recommend any product; Trezor is named only because its published explainer is the source of the quoted vendor statements. Self-custody means no support channel can reverse a mistaken transaction or recover a lost phrase. Software wallets, browser extensions and devices all have failure modes, and no configuration removes the possibility of loss.
Sources
How this was researched. Wallet guides describe how key management works in general. Where an article describes a specific product's behaviour, its sources are listed below.
Primary sources for the factual claims on this page. A date appears only where a human has actually read the source; where it is missing, the check is still outstanding.
Frequently asked questions
Is a browser extension wallet less safe than a mobile wallet?
They fail differently. A browser extension runs alongside every page you open, and ethereum.org advises uninstalling extensions because most request permission to read and change site data. A mobile wallet is a separate app, but the phone is still an internet-connected general-purpose device. Neither keeps the key off a networked machine.
Do I need a hardware wallet if I only hold a small amount?
A hardware wallet is worth its cost when the amount at risk exceeds what you would pay to protect it, and when you sign often enough to build the habit of checking the device screen. For a small balance used for testing and small purchases, a software wallet with a well-kept seed phrase can be a reasonable choice.
Can I use the same seed phrase in two wallets?
Most wallets derive the same addresses from the same recovery phrase, which is why a phrase can restore a wallet in different software. That also means a phrase entered into a second, less careful application exposes the same funds. The backup is the wallet; duplicating the backup duplicates the exposure.
What happens to my funds if my phone is stolen?
If the wallet is protected by a passcode and the seed phrase is stored separately, the thief has a locked app, not the funds. Recovery happens by restoring the phrase on a new device. If the phrase was stored on the phone or in a cloud backup, the theft is a loss event.
Is a hardware wallet immune to malware?
No. It keeps the key away from the computer, so malware cannot read it. Malware can still change the transaction the computer asks the device to sign. The device screen is the only place to catch that, which is why reading it is part of the security model rather than an optional courtesy.
Where to go next
Independent research. Each card shows the platform’s invite code, and its Create Account button is a referral link that may earn us a commission at no extra cost to you. Whether an account can be opened is decided by the platform at sign-up.
Binance
One of the largest global exchanges by traded volume, with a very broad product range.
20% Trading Fee Rebate
Use invite code con888 when signing up to enjoy trading fee benefits.
Download from the exchange's official download service. Verify the source and follow the on-screen installation instructions.
Do not install an APK from an unknown source, or one that has been modified or cannot be checked.
OKX
A large global exchange offering spot, derivatives and a self-custody wallet.
20% Trading Fee Rebate
Enter invite code con888 when signing up to check available trading fee benefits.
Download from the exchange's official download service. Verify the source and follow the on-screen installation instructions.
Do not install an APK from an unknown source, or one that has been modified or cannot be checked.