Firmware updates

Keeping your Trezor firmware up to date ensures you have the latest security patches, features, and cryptocurrency support. Suite makes firmware updates safe and straightforward.

Firmware updates are signed and verified by Trezor. Suite automatically checks signatures before installation.

Why update firmware?

Security improvements

Patches for discovered vulnerabilities
Enhanced cryptographic implementations
Improved secure element integration (Safe 3)
Protection against new attack vectors

New features

Support for additional cryptocurrencies
UI/UX improvements on device
Enhanced privacy features
Performance optimizations

Bug fixes

Resolution of reported issues
Stability improvements
Edge case handling

Check the changelog before updating to see what’s new in each firmware release.

Checking for updates

Suite automatically checks for firmware updates when you connect your device.

Notification system

When a new firmware is available:

A notification appears in Suite
The device dropdown shows an update badge
Settings page displays the update option

You can also manually check for updates in Settings → Device → Firmware.

Update types

Required updates
Optional updates

Critical security updates:

Marked as “Required”
Strongly recommended to install immediately
May limit features until updated

Example: Firmware 1.9.4 → 1.10.0 (security patch)

Update process

Updating firmware is a multi-step process that requires careful attention.

Never disconnect your device during a firmware update. This could brick your device.

Standard update flow

Backup check

Suite verifies your device is backed up. If not, you’ll be prompted to create a backup first.

Always ensure you have a valid backup before updating. If something goes wrong, you’ll need it to recover your funds.

Download firmware

Suite downloads the firmware file from Trezor servers and verifies the signature.

Enter bootloader

Follow on-screen instructions to put your device into bootloader mode:

Model One: Hold both buttons while connecting
Model T/Safe 3: Touch screen while connecting

Upload firmware

Suite uploads the firmware to your device. Progress is shown in real-time.

This step takes 1-2 minutes. The device screen shows progress.

Verify fingerprint

After upload, verify the firmware fingerprint displayed on your device matches the one shown in Suite.

Install firmware

Confirm installation on your device. The device will:

Install the firmware
Verify installation
Restart automatically

Complete

Your device restarts with the new firmware. Re-enter your PIN and you’re ready to use Suite.

Update timeline

Typical update duration:

const updateDuration = {
  download: '30-60 seconds',       // Depends on connection
  bootloaderEntry: '10 seconds',   // Manual step
  upload: '60-120 seconds',        // To device
  verification: '5 seconds',       // Signature check
  installation: '30-60 seconds',   // On device
  restart: '10 seconds',           // Device reboot
  total: '3-5 minutes'             // End to end
};

Firmware verification

Suite implements multiple verification steps to ensure firmware authenticity.

Signature verification

All firmware files are signed by Trezor:

// Firmware signature structure
interface FirmwareSignature {
  version: [number, number, number]; // e.g., [2, 5, 1]
  vendorHeader: string;               // Vendor signature
  image: {
    code: string;                     // Code section hash
    data: string;                     // Data section hash
  };
  signatures: string[];               // Multiple signatures
}

Firmware requires multiple signatures from Trezor’s signing keys. This prevents unauthorized firmware from being installed.

Fingerprint verification

After upload, verify the fingerprint:

Device displays firmware hash
Suite displays the same hash
Verify they match character by character
Confirm on device to proceed

If fingerprints don’t match, DO NOT proceed with installation. Contact Trezor support.

Bootloader check

Bootloader is verified during update:

Checks bootloader authenticity
Verifies bootloader hasn’t been tampered with
Ensures compatibility with new firmware

Special update scenarios

First-time firmware installation

Brand new devices come without firmware:

Connect new device

Suite detects the device needs firmware.

Automatic download

Suite automatically downloads the latest firmware.

Install

Device is already in bootloader mode. Follow installation prompts.

Setup

After installation, proceed with device setup (create or recover wallet).

Downgrading firmware

Downgrading firmware is generally not recommended and may not be possible due to bootloader restrictions.

Some firmware versions prevent downgrading:

Security-critical updates may block downgrades
Bootloader updates are irreversible
Check release notes for downgrade restrictions

Beta firmware

For developers and testers:

Enable debug mode in Suite (click “Settings” header 5 times)
Access Settings → Device → Firmware
Select “Show beta versions”
Choose beta firmware version

Beta firmware is for testing only. It may contain bugs and is not recommended for managing real funds.

Firmware types

Bitcoin-only firmware

Specialized firmware for Bitcoin purists:

Features
Limitations

Only Bitcoin support
Smaller code footprint
Reduced attack surface
Identical security model

Universal firmware

Standard firmware with all supported cryptocurrencies:

All coins and tokens supported
Regular feature updates
Most users should use this

You can switch from universal to Bitcoin-only, but switching back requires wiping the device.

Troubleshooting updates

Update failed or interrupted

Don’t panic: The bootloader protects against bricked devices.Recovery steps:

Disconnect and reconnect device
Device should be in bootloader mode
Start update process again
If problems persist, try different USB port/cable

Device stuck in bootloader

Symptoms: Device shows bootloader screen on every connectionSolution:

Connect device to Suite
Suite detects bootloader mode
Install firmware normally
Device will exit bootloader after installation

Signature verification failed

Cause: Downloaded firmware is corrupted or invalidSolution:

Clear Suite cache
Retry firmware download
Check internet connection
If persists, contact support

Never proceed with installation if signature verification fails.

Bootloader mode entry fails

Model One:

Hold both buttons BEFORE connecting
Keep holding until bootloader screen appears
Try different USB port

Model T/Safe 3:

Ensure screen is completely off
Touch screen before connecting
Keep touching until bootloader screen

Low battery warning (Model T/Safe 3)

Symptom: Update cannot proceed due to low batterySolution:

Keep device connected and charging
Wait 30-60 minutes
Retry firmware update

Firmware updates require adequate battery to prevent interruption.

Post-update steps

Verify update success

After updating:

Check firmware version in Suite
Verify it matches the expected version
Test basic operations (account access, transaction signing)

Check new features

Review the changelog:

New coins available in Settings → Crypto
Updated features in device settings
Security improvements (usually transparent)

Re-enable metadata

If you had metadata enabled:

Metadata keys remain valid after update
Reconnect to your storage provider if needed
Labels should sync automatically

Security best practices

Always update through official Trezor Suite

Verify firmware signatures (Suite does this automatically)

Never download firmware from third-party sources

Ensure you have a valid backup before updating

Verify fingerprint during installation

Keep Suite updated to get latest firmware releases

Never install firmware from unofficial sources. This could compromise your device and funds.

Firmware release cycle

Release channels

Development: Active development, frequent changes
Beta: Testing phase, available to developers
Stable: Public release, recommended for all users

Version numbering

Firmware uses semantic versioning:

Major.Minor.Patch
  2  . 5  .  1
  │    │    └─ Bug fixes
  │    └───── New features
  └──────── Breaking changes

Update frequency

Typical release schedule:

Security patches: As needed (immediate)
Minor updates: Every 2-3 months
Major updates: Annually

Device management

Managing devices and connections

Backup and recovery

Backup before updating firmware

Device settings

Configure device after updating

Security

Overall security best practices

Core Features

Advanced Features

Settings & Security

​Firmware updates

​Why update firmware?

​Security improvements

​New features

​Bug fixes

​Checking for updates

​Notification system

​Update types

​Update process

​Standard update flow

​Update timeline

​Firmware verification

​Signature verification

​Fingerprint verification

​Bootloader check

​Special update scenarios

​First-time firmware installation

​Downgrading firmware

​Beta firmware

​Firmware types

​Bitcoin-only firmware

​Universal firmware

​Troubleshooting updates

​Post-update steps

​Verify update success

​Check new features

​Re-enable metadata

​Security best practices

​Firmware release cycle

​Release channels

​Version numbering

​Update frequency

​Related topics

Device management

Backup and recovery

Device settings

Security

Build docs developers (and LLMs) love

Firmware updates

Why update firmware?

Security improvements

New features

Bug fixes

Checking for updates

Notification system

Update types

Update process

Standard update flow

Update timeline

Firmware verification

Signature verification

Fingerprint verification

Bootloader check

Special update scenarios

First-time firmware installation

Downgrading firmware

Beta firmware

Firmware types

Bitcoin-only firmware

Universal firmware

Troubleshooting updates

Post-update steps

Verify update success

Check new features

Re-enable metadata

Security best practices

Firmware release cycle

Release channels

Version numbering

Update frequency

Related topics