Trezor.io/Start® | Starting Up Your® Device®

STEP 1: Physical Inspection and Unboxing Protocol

Before proceeding, the first and most crucial security check involves verifying the physical integrity of the device packaging. This step ensures that the device has not been tampered with or replaced during shipping.

1.1. Inspecting the Packaging Seals

For **Trezor Model One**: You must verify the hologram seal over the USB port. The hologram should be perfectly intact, showing no signs of tearing, lifting, scratching, or reapplication. If the hologram is even slightly disturbed, **DO NOT USE THE DEVICE** and contact Trezor support immediately. The device itself should feel factory fresh.

For **Trezor Model T**: The device is secured with a stronger, more advanced tamper-evident seal that adheres the packaging to the device. This seal must be unbroken. Additionally, Model T devices ship without pre-installed firmware. You will install it during setup, which is an additional layer of security.

1.2. Contents Checklist

• The Trezor Device (Model One or Model T).
• USB Cable for connection.
• Physical Recovery Seed Card(s) (Usually two or three blank cards).
• User manuals and stickers.

STEP 2: Connecting and Installing Trezor Suite

2.1. Download and Installation (Critical)

The **Trezor Suite** is the official desktop application used to manage your device, view your portfolio, and sign transactions.

1. Navigate to the ONLY official source: https://suite.trezor.io/start.
2. Download the desktop application for your operating system (Windows, macOS, or Linux). While the Web Wallet exists, the desktop Suite is the recommended, more isolated, and feature-rich option.
3. Install the application, following all prompts. Never run the installation file with an administrative account unless absolutely necessary.

2.2. Connecting the Hardware

Plug the provided USB cable into the Trezor and into a reliable USB port on your computer. Your computer should recognize the device.

IMPORTANT: Open the Trezor Suite application BEFORE connecting the device, if possible. The Suite will guide you through the remaining steps. The Trezor screen should light up, typically displaying a welcome message or a lock icon.

2.3. Firmware Installation/Update

If this is a brand new device (especially the Model T), the Trezor Suite will prompt you to install the latest official firmware.

• Confirm the firmware version displayed in the Suite matches the version displayed on your Trezor device screen.
• The device will enter bootloader mode. The firmware installation is a crucial step that validates the authenticity of your Trezor. Only official, digitally signed firmware will be accepted by the device's secure chip.
• Wait for Completion: Do not disconnect the device during the firmware installation process under any circumstances.

STEP 3: Wallet Creation and Recovery Seed Generation

After the firmware is installed, the Trezor Suite will offer two options: **Create New Wallet** or **Recover Wallet**. For a new device, always choose **Create New Wallet**.

3.1. The Recovery Seed Explained (BIP-39)

The Recovery Seed is a sequence of 12, 18, or 24 English words (24 words is the default and most secure option). This sequence is generated by the device itself using genuine randomness and is the master key to ALL your crypto assets. If your Trezor is lost, stolen, or destroyed, this Seed is the ONLY way to restore your entire wallet and funds onto a new device (Trezor or another compatible wallet).

3.2. Writing Down the Seed (Absolutely Critical)

The Trezor Suite will prompt you to begin the process. The words will be displayed sequentially on the **Trezor screen itself**, never on the computer monitor. This is a core security feature to protect against screen-scraping malware.

1. Prepare the Cards: Use the provided physical Recovery Seed Cards. Write down the words clearly and legibly with a pen.
2. Read from the Device: As each word appears on the Trezor screen, write it down in the correct corresponding number on the card.
3. Double Check: After writing all 24 words, the Trezor will prompt you to confirm a few random words from your sequence (e.g., "What was word #5?" or "What was word #18?"). Check your written card and enter the words using the buttons on the Trezor device.
4. Storage is Key: Once confirmed, immediately store the card(s) in a secure, fire-proof, and flood-proof location (e.g., a safe deposit box, a dedicated security safe, or an encrypted metal backup). This card should NEVER be photographed, digitized, or stored on a computer.

STEP 4: Setting the Device PIN

The Personal Identification Number (PIN) is the first line of defense against someone who gains physical access to your Trezor. You will be prompted to set a PIN after generating the Seed.

4.1. The Obfuscated PIN Entry

Trezor uses a unique system to prevent "shoulder surfing" and screen-logging malware: the numbers are displayed on the Trezor screen in a random 3x3 grid, and the corresponding position pad is shown on the computer screen.

• The Trezor screen shows the number positions (e.g., the top-left square is '4').
• The computer screen shows a blank 3x3 grid.
• You click the empty squares on the computer screen that correspond to the numbers shown on the Trezor screen.
• PIN Length: A good PIN should be between 4 and 50 digits long. **DO NOT** use patterns (1234), sequential numbers, or dates of birth. A 6-8 digit random PIN is a strong starting point.

4.2. PIN Error Handling and Time Locks

Trezor has a built-in time lock mechanism to discourage brute-force attempts. After every failed PIN attempt, the waiting time to try again doubles (1 second, 2 seconds, 4 seconds, etc.). This makes repeated guessing physically impractical, ensuring your keys remain safe even if the device falls into the wrong hands.

STEP 5: Device Naming and Passphrase (Optional, Advanced Security)

5.1. Naming Your Trezor

The Trezor Suite will ask you to name your device (e.g., "MyVault-Trezor-01"). This name is purely for your convenience and does not affect the security or the Recovery Seed. It helps you distinguish between devices if you own multiple.

5.2. Understanding the Passphrase (The Hidden Wallet)

The Passphrase (often called the 25th word) is the single most powerful security feature available. It is an arbitrary word or phrase you choose, which works in combination with your 24-word Seed to generate a completely new, unique, and mathematically distinct set of private keys.

• Plausible Deniability: If someone forces you to unlock your device, you can enter the PIN, and then enter a "decoy" passphrase. This unlocks a separate, "decoy" wallet that holds little to no funds. Your main funds are secured behind a strong, secret passphrase.
• It is NOT Backed Up: The Passphrase is **NEVER** stored on the device or in the Seed. If you forget or lose your Passphrase, your funds are permanently lost, even if you have the 24-word Seed. You must memorize it or store it with extreme care, completely separate from the Seed.
• Recommendation: For large holdings, using a strong Passphrase is mandatory.

5.3. Enabling the Passphrase Feature

To use a passphrase, you must enable it in the Trezor Suite settings. Once enabled, you will be prompted to enter the passphrase after entering the PIN every time you connect the device.

STEP 6: Funding and Ongoing Security Best Practices

6.1. Receiving Funds

Once setup is complete, you can begin receiving cryptocurrency.

• In the Trezor Suite, navigate to the currency you wish to receive (e.g., Bitcoin).
• Click the "Receive" tab. The Suite will generate a new receiving address.
• Verify the Address: The Suite will display the address, but the address must be confirmed on your physical Trezor screen. This protects against address-swapping malware on your computer.
• Only send funds to the address shown and confirmed on the Trezor screen.

6.2. The Transaction Signing Process

When sending funds, the transaction is prepared by the Trezor Suite, but it is **signed** by your Trezor device. This process is key to cold storage security.

1. Initiate the 'Send' transaction in the Trezor Suite.
2. The Suite sends the unsigned transaction to the Trezor device.
3. The Trezor screen displays all critical transaction details (Recipient Address, Amount, Fee).
4. You must physically verify and approve these details using the buttons on the Trezor device. **Never approve a transaction if the details on the screen do not match your intention.**
5. The device signs the transaction and sends the signed version back to the Suite, which then broadcasts it to the network.

6.3. Long-Term Security Maintenance

• Practice Recovery: Set up a dummy wallet with a tiny amount of funds and practice recovering it using your Seed phrase on a separate, blank Trezor (if available) or a software wallet like Exodus or Electrum. This confirms your Seed card is written correctly.
• Stay Updated: Always accept firmware updates when prompted by the Trezor Suite, as they contain critical security patches and feature improvements.
• Avoid Phishing: Trezor (or SatoshiLabs) will **NEVER** ask you for your Recovery Seed online, via email, or over the phone. Anyone who asks is a scammer.

Frequently Asked Questions (F.A.Q.)