The short answerThe ZERO is the most physically hardened consumer signing device available: an EAL7-certified secure element, no data ports of any kind, and entropy generated from the device's own camera at setup. It costs around $400 and its firmware is only partly open to review.
Best forMaximum air-gap for long-term storage
Key isolationweight 25%
9.5avg 8.6
Firmware opennessweight 20%
6.0avg 7.8
Recovery designweight 20%
8.5avg 8.1
Asset coverageweight 15%
7.5avg 7.3
Vendor conductweight 10%
8.0avg 7.9
Usabilityweight 10%
7.5avg 8.1
this service category average across 15Score = Σ mark × weight. Recommendable to most readers, with stated caveats. Methodology.
| Criterion | Mark | What we found | Source | Checked |
|---|
| Key isolation | 9.5 | not sourced yet | not sourced yet | — |
| Firmware openness | 6.0 | not sourced yet | not sourced yet | — |
| Recovery design | 8.5 | not sourced yet | not sourced yet | — |
| Asset coverage | 7.5 | not sourced yet | not sourced yet | — |
| Vendor conduct | 8.0 | not sourced yet | not sourced yet | — |
| Usability | 7.5 | not sourced yet | not sourced yet | — |
What we liked, and what fell short
Liked- EAL7-certified secure element, the highest in consumer hardware
- Complete air gap with no USB data, Bluetooth or network at all
- Steel backup plate included in the package
Fell short- Firmware is only partially open to review
- Roughly triple the price of equally secure alternatives
Why the marks landed where they did
NGRAVE built for the scenario where the device itself is the target. The secure element carries the highest certification level found in consumer hardware, the case has no USB data port, no Bluetooth and no Wi-Fi, and the initial seed is generated from a physical entropy source rather than a software random number generator.
The air gap and the workflow
All communication is by QR code between the device and the Liquid companion app. A steel backup plate is included in the box, which is a sensible acknowledgement that most recovery failures are physical rather than cryptographic.
Where it falls short of its price
Firmware is not fully open, which sits awkwardly with a product whose entire proposition is trust minimisation — the strongest certification in the world still asks you to believe the code behind it. Chain coverage is decent but behind Keystone and Ledger, and at roughly triple the price of a BitBox02 the marginal security is physical assurance rather than a different class of protection.
Who should use it
Holders storing large amounts long term, for whom the physical threat model is real and the price is immaterial relative to the balance. For everyone else, a Keystone or BitBox02 delivers most of the benefit at a fraction of the cost.
FAQ
What is EAL7 certification?+
The highest Common Criteria assurance level found in consumer secure elements, indicating formally verified design and rigorous evaluation against physical and logical attack.
Is NGRAVE ZERO worth $400?+
Only if physical attack is a genuine part of your threat model and the balance justifies it. The marginal protection over a $150 device is physical hardening rather than a different security class.
Is NGRAVE open source?+
Only partly, which is the main criticism of a device positioned around trust minimisation.
How does the ZERO connect?+
QR codes only, through its camera and screen to the companion app. There is no USB data connection, Bluetooth or Wi-Fi.
