Updating your KeepKey
A step-by-step walkthrough.
To use most clients, you must keep the firmware on your device current. Updates ship security fixes, new chain support, and improvements to on-device verification. The current updater is built into KeepKey Vault Desktop.
- (Legacy) KeepKey Desktop: the previous desktop app, originally built by ShapeShift. No longer the recommended updater.
- (Current) KeepKey Vault Desktop: the standalone replacement. Wallet, dApp interface, and firmware updater in one app, with the API Bridge off by default.
Step one: Install KeepKey Vault Desktop
Download the latest build from keepkey.com/desktop.
- The site detects the right build for your OS (macOS, Windows, Linux).
- Windows users: you may need to continue past unsigned-download warnings.
- You can leave your device unplugged until the app starts.
Step two: open Vault Desktop and follow the prompts
- Plug your device in normally — without holding down the button. (Holding the button is for updater mode, covered below.)
- Vault Desktop reads the firmware and bootloader versions on your device.
If an update is available, you'll see this prompt:
Step three: enter updater mode
- Unplug your KeepKey.
- Hold down the device button.
- While continuing to hold the button, plug the device back in.
The screen below confirms the device is in updater mode:
Step four: update the bootloader (if prompted)
- Vault Desktop checks the bootloader first and updates it before firmware if needed.
- Press the Update button in the app.
Approve the "Verify Backup" prompt on the device
Note: Updating firmware does not wipe your device under normal circumstances.
- Force-unplugging or powering down your computer mid-update can leave the device in a fault state — don't.
- If your device is brand new and out of box, you'll still see the verify-backup prompt. There are no private keys on it yet, so you can ignore the warning.
- In all other cases, take a moment to confirm the location of your paper recovery seed before continuing. Always.
Press and hold the device button to continue updating.
Step five: update the firmware
After the bootloader update finishes, the app moves on to the firmware update. The device stays in updater mode — you don't need to unplug or replug it.
- Press Install Official Firmware.
- Confirm the action on the device when prompted.
When the install completes, Vault Desktop will show a restart screen while the device reboots into the new firmware:
That's it — your device is current and ready to use with Vault Desktop, the Browser Extension, and any third-party app you authorize through the API Bridge.
Troubleshooting
- Device not detected. Try a different USB cable (data, not charge-only) and a direct USB port — avoid hubs. On Windows, the FIDO filter driver can hide USB devices; Vault Desktop's HID fallback usually works around this.
- Update stalled or failed. Unplug, re-enter updater mode (hold button while plugging in), and retry. Firmware/bootloader images are signed — the device will refuse anything tampered with.
- "Verify backup" warning on a device with funds. Don't dismiss it. Confirm your recovery seed is recoverable before continuing. If you can't find it, stop, sweep funds to a known-good wallet, then update.