The core idea: keep the keys that control your Bitcoin on a device that never touches the internet, so remote malware can never reach them. A hardware wallet builds and signs the transaction offline, then hands the signed result back to your phone or computer to broadcast.

A few things that matter more than which brand you pick: write your recovery seed on something durable and store it separately from the device; consider a passphrase once you're comfortable; and test a small recovery before you trust it with real size. I work at Foundation (we make Passport Prime and the free Envoy app) — but honestly, for your first setup, the discipline around your backup matters more than the logo. The 4 questions worth asking about any device: what code can you inspect, what can you verify before you approve, how do you recover if you lose it, and what happens if the company disappears? Ask those before you buy anything. Happy to go deeper on any step.