Blockstream Jade

Blockstream Jade, made by Blockstream (Victoria, BC, Canada), is the hardware wallet most strongly associated with budget-conscious Bitcoin self-custody. At $79 (the base Jade Core) it is meaningfully cheaper than every other mainstream hardware wallet while providing fully open-source firmware and native multisig support. Note (2026): the $79 Jade Core has no on-device camera (it connects by USB-C/Bluetooth, so it is not air-gapped on its own); the Jade Plus ($149, metal body + battery) adds the camera for air-gapped QR signing. Distinguishing features: lowest mainstream price, native integration with Blockstream Green (and as of 2026 with Unchained’s collaborative-custody platform), and support for both USB and QR signing modes. The trade-off is Jade’s “virtual” secure element implemented in firmware on a general-purpose ESP32 rather than a dedicated chip — a deliberate design choice that some practitioners contest. For substantial holdings the secure-element absence tips many holders toward more expensive devices; for Tier 1 holdings, multi-vendor multisig diversification, or budget-constrained holders, Jade is the only mainstream device under $100 worth recommending.

What this is

Vendor: Blockstream Corp. (Victoria, BC, Canada). Founded 2014 by Adam Back, Greg Maxwell, Pieter Wuille, and others. Blockstream is among the most influential Bitcoin infrastructure companies — they develop Bitcoin Core (employing many of the principal developers), operate the Liquid sidechain, and run the Blockstream satellite network. The hardware wallet is one product in a deep Bitcoin-focused portfolio.

Product line as of 2026-07-17 (reconciled to Blockstream’s own compare page):

Jade Core ($79) — the base device (this is the current name for the original “Blockstream Jade”): plastic body, ESP32, virtual secure element. No on-device camera and no battery — it connects by USB-C or Bluetooth, so on its own it is not air-gapped (QR air-gap needs the Plus’s camera, or you relay QRs via the companion app on a phone).
Jade Plus ($149) — premium variant: precision-machined aluminium body (six colours), a larger display, a built-in camera for air-gapped QR signing, and a rechargeable battery. Same virtual-secure-element architecture as the Core (it does not add a physical/dedicated secure element).

(The earlier note of a separate ”~$99 mid-tier Jade Core” was speculative and is corrected here: the lineup is just Core $79 + Plus $149.)

Firmware: Fully open-source under MIT licence (OSI-approved). Source code on Blockstream’s GitHub.

Architecture: This is the structurally unusual choice. Jade uses an ESP32 microcontroller (a general-purpose chip with WiFi/Bluetooth capability — though the relevant radios are disabled in the firmware for signing operations) and implements a “virtual” secure element entirely in firmware. Blockstream has published the rationale: a transparent open-source firmware on a general-purpose chip is, in their view, a better security trade than an opaque secure element. Some practitioners disagree; the synthesis treats this as a contested design choice worth flagging.

Connectivity: USB-C for connected workflows; Bluetooth (firmware-disabled by default in signing operations); no NFC. Camera for QR-based air-gap signing is a Jade Plus feature only — the Jade Core has no camera (relay QRs via the companion app, or connect over USB/BT).

Who this is for

Jade is a strong fit for:

Budget-conscious first-time hardware-wallet holders — at $79, the price-to-capability ratio is excellent
Multi-vendor multisig diversification — Jade as the fifth device in a 3-of-5 multisig is a clean way to add vendor diversity without spending another $200
Unchained users — as of 2026, Jade is fully integrated with Unchained’s collaborative-custody platform; Unchained users can use Jade as one of their personal keys with full coordinator support
Blockstream ecosystem users — Liquid sidechain, Blockstream Green wallet, Blockstream Satellite — the integration is tight
Holders of Tier 1 holdings — for $1K–$50K balances, Jade is genuinely sufficient

Jade is less appropriate for:

Tier 2+ holdings as the sole signing device — the virtual-secure-element choice is contested; for substantial holdings, a device with a dedicated secure element (Coldcard, BitBox02, Trezor Safe 5, Passport) is the safer default
The very privacy-conscious — Blockstream’s broader business interests (Liquid, the satellite, business relationships) sometimes inform their product design in ways the strictly-privacy-focused holder may find suboptimal
Holders who want strict air-gap workflows — Jade’s QR signing works but the integration is less polished than Foundation Passport’s

Features and capabilities

Jade specifics

ESP32 microcontroller — the controversial architectural choice; general-purpose chip with virtual secure element
Colour display — small but adequate
Camera — for QR code scanning (air-gap signing mode)
USB-C — for connected signing and firmware updates
Buttons — physical buttons for navigation and confirmation; no touchscreen
Bluetooth — present but disabled in default signing operations; some use cases enable it for specific workflows
Battery — small rechargeable battery for portable use

Common to Jade

Fully open-source firmware (MIT)
Bitcoin and Liquid support — Liquid sidechain is supported (a Blockstream product) as well as standard Bitcoin
PSBT v2 support
BIP-380 output descriptors
BIP-39 passphrase support
Native multisig
QR-based air-gap signing — supported but the workflow is less polished than Passport’s
Multi-account support — multiple wallet contexts on one device

Jade-specific quirks

The virtual secure element — the central design choice. The argument: a verifiable open-source firmware on a known chip is better than an opaque secure element. The counter-argument: physical attacks (chip-decapping, fault injection) are harder against a dedicated secure element. The synthesis flags this as contested; different holders will weight the trade differently.
The “Pin Server” concept — Jade uses a Blockstream-hosted “PIN server” to enable the rate-limiting and PIN-protection features. Blockstream has published the protocol; the server cannot decrypt the wallet keys, only assist with PIN validation. Some holders object to any reliance on a Blockstream-hosted service; others see it as fine because the structural security argument is sound.
Liquid integration — Jade natively supports Liquid (Blockstream’s Bitcoin sidechain), which is a feature some Bitcoin holders consider out-of-scope.

Tradeoffs vs alternatives

Dimension	Blockstream Jade	Coldcard Mk4	BitBox02 BTC-only	Trezor Safe 3	Foundation Passport
Price	$79	$150	$137	$79	$199
Bitcoin-only	No (Bitcoin + Liquid)	Yes	Yes	No (multi-coin)	Yes
Open-source	Yes (OSI MIT)	Source-available	Yes (OSI)	Yes (GPL)	Yes (OSI)
Secure element	Virtual (firmware-based)	Yes (physical)	Yes (physical)	Yes (physical)	Yes (physical)
Air-gap signing	Plus: yes (QR via camera) · Core: no (USB/BT)	MicroSD only	No	No	Yes (strict QR-only)
Native SLIP-39	No	No	No	Yes	No
BIP-85	Limited	Excellent	Good	Good	Limited
Lopp 100-input signing	Adequate (slower than top devices)	Fast	Fast	Moderate	Fast
Unchained integration	Excellent (2026)	Good	Good	Good	Good

The principal differentiator for Jade is price. Other mainstream Bitcoin-only hardware wallets are 2-3× more expensive. For budget-constrained holders or for multi-vendor multisig where Jade fills the fifth slot, the price-to-capability ratio is excellent.

The principal trade-off is the virtual secure element. For Tier 2+ holdings where physical-attack resistance becomes relevant, the dedicated-secure-element devices are structurally safer.

Setup and operation

The setup flow:

Verify packaging — tamper-evident packaging from Blockstream
Connect via USB or pair with Blockstream Green mobile app — initial setup
Generate seed — 12 or 24 words displayed on device screen
Verify the seed — on-device flow
Set PIN — works with Blockstream’s PIN server protocol
Optionally set up a passphrase — entered on device
Pair with a coordinator — Blockstream Green for single-sig; Sparrow, Specter, Nunchuk for multisig; Unchained app for collaborative-custody as of 2026

The signing flow:

Coordinator builds PSBT
Transfer to Jade via USB (cable) or QR code (camera scan) — Jade supports both
Jade displays transaction details; the holder verifies on the small screen
Holder confirms via buttons
Signed PSBT returns to coordinator via USB or QR
For multisig, the same flow with multiple devices

Recovery — restoring the wallet on a fresh device

As of 2026-09-12, checked against Blockstream’s own help center and repository (linked inline). Two things set Jade apart in recovery: unlocking by PIN normally needs a companion app with an internet connection, because the PIN works with Blockstream’s blind oracle; and a seed can be loaded for one session without any PIN or oracle at all. Menu labels have changed across firmware versions — Options or Settings, Duress PIN or Wallet-Erase PIN, Temporary Signer or Recovery Phrase Login, Xpub Export or Export Xpub — and each pair names the same function.

What may be in hand

Four hardware generations per the official repository: the original Jade with a selection wheel, Jade 1.1 with a rocker, Jade Plus with a larger screen, left/right buttons, a camera and a battery, and Jade Core, a Jade Plus without camera or battery that runs from USB-C or Bluetooth only. A Jade Core cannot scan anything, so every QR-based route below is Jade Plus (or original Jade with its camera) only. The home screen reports the state — Uninitialized (no wallet stored), Initialized (wallet stored, PIN required), Active, or Active (Temporary) with a clock icon — and shows the firmware version when locked and the eight-character wallet fingerprint when unlocked. Blockstream recommends a firmware update before setup but does not require one; devices shipped below firmware 1.0.38 want a factory reset around their first upgrade. Updates run from the Blockstream desktop app, a WebSerial upgrade portal in Chrome, or the JadeLink accessory.

Unlocking a device that still holds the seed

The PIN is six digits. Jade encrypts its key material with the PIN, a device secret and a secret held by Blockstream’s blind oracle; at unlock, the companion app — Sparrow included — relays an encrypted exchange with that server, so an offline computer cannot unlock a Jade by PIN. The oracle stores only a hash of the PIN and never learns the keys; a self-hosted oracle is possible, and if a holder ran one the PIN works only while that server is reachable. Three wrong PINs delete the keys on both Jade and the oracle, returning the device to Uninitialized. A holder may also have set a Duress PIN (older label Wallet-Erase PIN): entering it wipes the device and shows only “Internal Error” — so an error straight after a PIN entry means the device just erased itself, and the written words are still good. A correct PIN gives Active status, the fingerprint in the corner, and a session the companion app can read xpubs from and sign with. Jade Plus adds QR PIN Unlock under QR Mode, four scans against a Blockstream web page that still needs to be online.

The escape hatch when the PIN is unknown or the oracle unreachable: with the words in hand, Options › Temporary Signer types the phrase for a session, or Scan SeedQR (Jade Plus) loads it from a SeedQR — no PIN and no oracle, forgotten at power-off. Blockstream’s own check for whether a written phrase matches a PIN-locked wallet is to compare the fingerprint shown after the PIN with the fingerprint shown after a Temporary Signer load of the words.

Wiping the device

From the boot menu — click, not hold, the select button once while the logo shows — choose Factory Reset and type back the confirmation number; no PIN is needed. Or in a session, Options › Device › Factory Reset. Three wrong PINs and the duress PIN wipe it too. Registered multisig configurations go with the wallet data. A reset is not needed to use a different seed once: Temporary Signer loads any phrase for a session.

Restoring from the backup

From first boot: Set up Jade › Begin Setup (or Advanced Setup, which offers the phrase length, a SeedQR export and a passphrase) › Restore Wallet › 12 or 24 words, or QR Scan on a camera model › type the words on the on-screen keyboard › connect to a companion app by USB, Bluetooth or QR › create the six-digit PIN. The phrase is not saved to the device until the PIN step completes. Entry is on the device only; the keyboard restricts entry to BIP-39 words, and a missing final word can be calculated from the first 11 or 23. Every maker page says 12 or 24 words; 18-word phrases and Shamir shares are not mentioned, and there is no encrypted backup file — the only alternative format is a hand-drawn SeedQR, which must never be scanned by an online device. Seeds from Ledger, Trezor, Coldcard and software wallets restore the same way. After the PIN is set the seed is stored encrypted on the device; after a Temporary Signer or SeedQR load it is not.

The passphrase

Blockstream calls it the BIP39 Passphrase, enabled under Options before a wallet is active. Two settings shape what a survivor sees. Frequency — Disabled (never asked), Next Login Only (asked once, which the maker notes conceals that a passphrase is in use), or Always Ask. Method — Manual, a full character keyboard, or WordList, which builds the passphrase from lowercase BIP-39 words separated by single spaces. The passphrase is never stored and is asked for after the PIN or after a temporary load. Case-sensitive, spaces count, and there is no concept of an incorrect passphrase: “bitcoin”, “bitcoins”, “bit coin” and an empty field open four different wallets. The check is the wallet fingerprint in the lower-right corner, which the maker advises recording; a typo produces a different fingerprint and an empty wallet.

Connecting to Sparrow and confirming the first address

Jade works with Sparrow both ways. USB, per Blockstream’s Sparrow page: close the Blockstream app, New Wallet › Connected Hardware Wallet › Scan › enter the PIN on Jade (Sparrow relays the oracle exchange, so the computer must be online) › Import Keystore (default Singlesig, Native Segwit; the arrow picks another path) › Apply. The original Jade and Jade Plus may need the CH34x or CP210x USB drivers on macOS and Windows and dialout group membership on Linux, per Blockstream’s driver page and Sparrow’s FAQ. QR (camera models): unlock, ideally in QR Mode, then Options › Wallet › Xpub Export shows an animated QR (native segwit m/84'/0'/0' by default; Options switches to nested segwit m/49'/0'/0' or the multisig paths m/48'/0'/0'/2' and /1'); in Sparrow, choose the matching policy and script type › Airgapped Hardware Wallet › Jade › Scan. QR mode is Bitcoin-only. A wallet made in the Blockstream app before April 2022 is a server-cosigned “2FA” or Multisig Shield wallet and will not appear in Sparrow at all; it opens only by reconnecting the Jade to the Blockstream app.

Address check: connected, Sparrow’s Receive › Display Address shows the address on Jade for comparison; in the Blockstream app the button is Verify on Device. Air-gapped on Jade Plus, Scan QR reads the address from Sparrow’s screen and searches the wallet’s addresses in blocks of 500, with Skip for high indexes and Edit Root for change addresses or another account. A failed match usually means an unsupported path or an unusually high index, and Blockstream’s wrong-balance checklist — wrong wallet, passphrase typo, wrong phrase, wrong network, wrong script type or account index — ends with “none of these issues mean your funds are permanently lost”.

Multisig

Jade registers and stores multisig configurations on the device, up to eight 8-of-8 wallets, so it can verify receive and change addresses. Registration happens when the coordinator asks Jade to verify or display an address over USB, or when the exported wallet configuration is scanned with Scan QR in a session; Jade walks through each signer for confirmation. Options › Wallet › Registered Wallets lists them and can Export one as QR codes for a companion app to rebuild — which means a still-unlockable Jade can hand back a multisig descriptor that no wallet file survived. Jade’s own cosigner key is the multisig native segwit path in Xpub Export. See Multisig setups and PSBT and wallet descriptors.

Security considerations

Strengths

Fully open-source firmware (MIT, OSI-approved)
Bitcoin-focused vendor with deep Bitcoin Core involvement — Blockstream employs many of the principal Bitcoin Core developers
QR-based air-gap option — workflow is supported even if less polished than Passport’s
Affordable enough to enable vendor diversity — the $79 price point makes adding a Jade to a multisig setup low-friction
Unchained integration — the 2026 partnership makes Jade a first-class option in collaborative custody

Known concerns

The virtual secure element — the central security debate. Blockstream’s published rationale is reasonable; many practitioners disagree. For substantial holdings, dedicated-secure-element devices are the safer default.
The PIN server reliance — for full PIN-protection functionality, Jade communicates with a Blockstream-hosted server. The protocol is published; the server cannot decrypt keys. Some holders prefer not to rely on a vendor-hosted service for any part of the security model.
Smaller community than Trezor or Ledger — fewer third-party reviews, fewer tutorials. Official documentation is good but the broader ecosystem is thinner.
The ESP32 chip has WiFi/Bluetooth capability — these are disabled in default signing operations, but the hardware capability exists. For the strictly paranoid, this is a concern.

Supply-chain integrity

Buy directly from blockstream.com. Tamper-evident packaging. Avoid generic marketplaces.

The Ledger 2020 leak does not affect Blockstream; the customer database has not had a public leak.

Pricing and acquisition

As of 2026-07-17 (reconciled to blockstream.com/jade; prior review 2026-07-15):

Jade Core: $79 USD — the base device (plastic; no camera/battery)
Jade Plus: $149 USD — aluminium body, larger display, built-in camera + rechargeable battery; retains the virtual secure element

Authorized channels: blockstream.com directly; authorized Bitcoin-focused resellers. Avoid generic marketplaces.

Bulk pricing: available for multi-key setups.

Common pitfalls

Buying Jade as the sole device for a Tier 2+ holding. The virtual secure element is the central concern. For substantial holdings, pair Jade with dedicated-secure-element devices or use a more conservative device as the sole signer.

Treating Jade’s Bluetooth as a security non-issue without verifying. The firmware disables Bluetooth in default signing operations, but holders should verify the configuration matches their threat model.

Skipping the Blockstream PIN server understanding. The PIN server protocol is published and the cryptographic argument is sound — but holders should engage the question rather than assume.

Buying Jade for Liquid sidechain operations and treating it as Bitcoin-only. Jade supports Liquid natively; this is a feature for Liquid users but the holder should be aware of what code paths exist in the firmware.

Three Jades in multisig. Same vendor-diversity pitfall. Pair Jade with Coldcard, BitBox02, Trezor, or Passport.

Treating Jade as inferior across the board. For Tier 1 holdings and budget-constrained holders, Jade is genuinely good — the price-to-capability ratio is excellent. Dismissing it as “the cheap option” misses where it actually fits.

Tooling and resources

Blockstream documentation (as of 2026-05-14):

blockstream.com/jade — official site
Blockstream Jade user manual — comprehensive
The Blockstream blog — release notes, security advisories
The Adam Back, Pieter Wuille, and broader Blockstream developer team’s writing

Coordinator software supporting Jade:

Blockstream Green — official, mobile + desktop
Sparrow Wallet — multisig-friendly
Specter Desktop — multisig-focused
Nunchuk — desktop and mobile
Unchained app — 2026 integration; full collaborative-custody support

The synthesis document: Bitcoin Self-Custody & Security (LegacyCipher, April 2026) — Jade treated as the budget-conscious option with the 2026 Unchained integration as a recent development.

As of 2026-07-15: Jade has been shipping since 2021; firmware is actively updated. The Jade Plus (aluminium body, larger display, retaining the virtual secure element) is now shipping at ~~$149–$169, and a Jade Core (~~$99) has joined the lineup. (Prior review 2026-05-14.)

Open questions for further development

The virtual secure element design choice is contested. Has the empirical record validated Blockstream’s argument that transparent open-source firmware on a general-purpose chip is competitive with dedicated secure elements? Or have physical attacks against Jade’s architecture been demonstrated?
The 2026 Unchained integration meaningfully changes Jade’s positioning. Does this make Jade the canonical choice for collaborative-custody users who don’t already own hardware wallets?
The rumored Jade Plus (once speculated to add a dedicated secure element) would address the principal concern about the current Jade. When does it ship, and at what price point? (Update 2026-07-15: the Jade Plus now ships at ~$149–$169, but it retains the virtual secure element — the metal body and larger display are the upgrades, not a physical secure element — so this open question is largely moot.)

The framing context:

Hardware wallets overview — the framework
Self-custody configuration ladder — Jade fits well across Configurations 1, 4, 5, particularly as a vendor-diversity component

Per-device alternatives:

Coldcard — the premium alternative
BitBox — the comparable open-source Bitcoin-only alternative ($137 vs Jade’s $79)
Trezor — the SLIP-39 alternative
Foundation Passport — the polished air-gap alternative
Bitkey
Ledger considerations and tradeoffs

Relevant capabilities:

Custody configurations:

Multisig setups — Jade as a vendor-diversity component
Collaborative custody services — Unchained integration as of 2026

Operational practice:

The principal practitioners:

Jameson Lopp
Adam Back — Blockstream founder
Pieter Wuille — Blockstream/Bitcoin Core developer
Greg Maxwell — Blockstream co-founder

The sub-MOC home:

Practical self-custody and sovereignty