What is air-gapped signing, and do I need it?

The full answer

What does keeping the key offline protect against?

XRPL.org, the XRP Ledger’s documentation site, says any configuration in which outside sources may gain access to a secret key is dangerous, and is likely to result in a malicious user stealing all the XRP at that address [1]. It also says anyone who knows an address’s private key has effectively full control over it, and that no privileged administrator can undo or reverse a transaction once it has applied [2].

The documented response is to keep the key away from the internet. XRPL.org says a key pair and its address can be generated entirely offline, without contacting the ledger or any other party [3]. Writing about master keys, it says that a key kept enabled but offline cannot reasonably be reached over the internet, yet can still be fetched for an emergency [2]. FINRA’s investor guidance describes cold wallets as paper or hardware that generally aren’t connected to the internet, and says they tend to be harder for malicious actors to hack because of that [4]. In a September 3, 2024 public service announcement, the FBI told holders not to store seed phrases, private keys, passwords or wallet logins on internet-connected devices [5].

Hardware wallets follow a related model. D’CENT, a hardware wallet maker, says in its app FAQ that the app serves only as the interface for display and operation, and that the private key remains within the device’s secure chip [6].

What does air-gapped signing not stop?

The protection covers the key. It does not cover the content of what the key signs. None of these sources says an offline device checks whether a transaction matches what its owner intended; that check sits with the person looking at the screen.

Address poisoning shows the gap. FBI Denver said on April 26, 2024 that criminals send tokens from addresses that closely resemble ones a victim has used before. Because wallet software truncates addresses, the first and last characters can match a familiar address while the middle characters differ [7]. A payment to that look-alike address would be signed offline as readily as online. The same applies to a malicious signing request that dresses a harmful transaction up as a routine one. That is covered on its own page and in what to do about address poisoning.

Offline signing also cannot repair a key that was weak or exposed before it went offline. XRPL.org says a private key should be chosen using a strong source of randomness, and that holders should only use key pairs generated with devices and software they trust, because compromised applications can expose the secret [2]. D’CENT says that if a hardware wallet’s recovery phrase was ever entered into an app wallet or any other software wallet, the two share the same private keys and the hardware wallet should not be treated as isolated [6]. Questions about weak seed generation and fake or tampered devices are taken up in whether a hardware wallet can be hacked.

What should I check on the device screen before approving?

The address comes first. FBI Denver’s advice is to check the entire address to make sure it fully matches the one you mean to pay [7]. Comparing only the opening and closing characters is the habit the April 2024 warning describes attackers exploiting.

When the destination is an exchange, the destination tag matters too. XRPL.org says a payment to an exchange address can use a destination tag to tell the business which customer to credit, and that a payment to a shared address with no tag can require manual intervention and a discussion with the sender to work out who should receive it [8]. More on this is in what a destination tag is and what happens if you forget it.

The fee is the third field worth reading. XRPL.org says every transaction destroys the exact amount of XRP in its Fee field, even if that amount is much more than the current minimum, and gives the current minimum for a standard transaction as 10 drops [9]. A device screen that shows a fee far above that figure is showing something the holder did not ask for.

Which XRP-compatible devices support air-gapped signing?

XRPL.org documents offline key generation and offline storage of a master key [2][3], but it does not list devices. This page names no device and recommends none.

Does an ordinary holder need it?

No regulator, and no XRPL.org page cited here, says that individual holders need fully offline signing. What the sources agree on is narrower: keep secret keys and recovery phrases off internet-connected devices [1][5]. How much of a holding to keep in a fully offline setup is a question of amounts and convenience, set out in how much to keep in a hot wallet versus cold storage. Controls built into the ledger itself, such as keeping the master key offline and using a separate key day to day, are explained in the XRP Ledger’s account security features.

What is the strongest case against relying on it?

The strongest objection is that an offline setup moves risk from thieves to the holder. NIST said in February 2021 that both paper and digital backups of seed phrases can be lost, stolen or destroyed [10]. FINRA says hardware wallets can break down, suffer defects, or be lost or stolen, and aren’t totally immune from sophisticated hacking [4]. XRPL.org says there is no one who can restore access to an XRP Ledger account if something goes wrong [11]. The FTC says that if you lose the password to your digital wallet, you are likely to find that no one can step in to help recover your funds [12]. Those cases are gathered in how people lose XRP without being hacked.

Physical coercion is the other limit. Chainalysis defines a wrench attack as one in which violence or its threat bypasses encryption however strong it is, and reported on August 6, 2026 that 46 violent crypto-related incidents had been documented globally through late June 2026 [13]. A key that never touches the internet can still be handed over under threat.