Methodology

The four axes

We wanted a grading system that could not be gamed by a marketing department and that produced a number meaning the same thing across a Bitcoin-only air-gapped signer and a free phone app. Four axes, fixed weightings, applied to everything.

Security architecture — 40%

The largest single factor, and it is assessed in five parts. Key isolation: can the signing key ever be read by an internet-connected device? This is binary and it is why no software wallet can score above the hardware category. Chip protection: whether a dedicated secure element guards the key against physical extraction, and at what Common Criteria assurance level — EAL6+ being the current benchmark. Auditability: whether the firmware is published, and whether builds are reproducible so you can verify the binary matches the source. Attack surface: fewer interfaces and fewer supported assets means less code and fewer ways in. Update path and disclosure behaviour: whether firmware can be patched at all, and whether the maker publishes advisories and responds to researchers.

That last item deserves emphasis because it is unusual. We treat "can receive verified firmware updates" as a first-class security property, not a convenience. The July 2026 Ledger Donjon laser fault-injection disclosure against Tangem's cards showed why: a genuine finding on an EAL6+ certified chip, affecting every card in circulation, permanently unfixable because the product has no update mechanism. That is reflected in the score.

Interface and companion apps — 25%

Weighted this heavily because the losses we read about are overwhelmingly verification failures rather than cryptographic ones. We assess address display and verification, network selection clarity, fee visibility, transaction preview and simulation, recovery flow, and how the software behaves when something goes wrong.

Where possible we watch people who have never used crypto attempt a real task — receiving funds, verifying an address, completing a wipe-and-restore — and record where they hesitate and where they get it wrong. That is how we concluded that screen size on a hardware wallet is a security feature rather than a comfort, and why Phantom's transaction simulation scores as highly as it does.

Value for money — 20%

Judged against alternatives at the same price point rather than in the abstract. A device with an EAL6+ secure element at NZ$99 scores extremely well. A device whose advantage over a cheaper sibling is a larger screen and wireless charging, at four times the price, does not. We are explicit where more money buys you no additional security — which across Ledger's range, for instance, it largely does not.

New Zealand availability — 15%

Landed cost including 15% GST, whether anyone stocks it domestically, realistic delivery time to a New Zealand address, the warranty route, and whether the Consumer Guarantees Act 1993 applies — it does when you buy from a New Zealand retailer and effectively does not when you import directly.

This axis is why our rankings differ from overseas sites, and we think the difference is correct. A brilliant device that takes three weeks to arrive and offers no local warranty path is genuinely less useful to a reader in Invercargill than a very good one available for NZ$99 from Christchurch. Readers deciding what to actually buy are served by that being in the number.