Trezor Safe 5 vs Safe 7: Is The Upgrade Worth It?

Where The Backup Is Protected

The recovery material belongs to you whichever model you choose. Trezor Suite prepares transactions on the host, and approval occurs on the hardware.

Safe 5 stores encrypted private keys on its main microcontroller. A secret in its OPTIGA Trust M secure element works with the PIN to protect that storage. Safe 7 adds TROPIC01 to a design in which two secure elements contribute separate secrets. Its encrypted wallet backup remains in the STM32U5 microcontroller's flash and is not stored on either secure element.

Trezor documents different retry limits: 16 incorrect PIN entries for Safe 5 and 10 for Safe 7 before the device resets or erases the wallet. Restoration then depends on a usable backup. The PIN limit therefore affects access to that device, not someone's ability to restore stolen backup words elsewhere.

What You Can Inspect

GPLv3 core firmware and published reproducible-build instructions cover both models, allowing comparison of a build with a release.

OPTIGA software is proprietary, and Donjon identifies proprietary portions of TROPIC01, including its CPU boot ROM and laser detectors. Suite uses a separate reference-source license that restricts reuse and distribution. Paying for Safe 7 does not buy an entirely unrestricted open-source device-and-app stack.

Readable Approval Has Limits

Color touchscreens and haptic feedback are included on both devices. Safe 7's screen is larger, but a larger display cannot decode an unsupported contract. Trezor's September 2026 Clear Signing release covers supported Ethereum and EVM transactions on updated standard firmware for both models.

The feature uses ERC-7730 descriptions to present supported actions, amounts and destinations. An unsupported contract still triggers the blind-signing experience and warning. Trezor's announcement does not specify the required firmware version.

The OPTIGA component in each model has CC EAL6+ certification. The evaluation concerns that component, not the complete wallet, a dApp or every firmware release.

The TROPIC01 Disclosure

TROPIC01 samples were the target of a June 2026 disclosure from Donjon, the research team at rival manufacturer Ledger. Laser fault injection bypassed signature verification and enabled unauthorized firmware. The work required prepared chips and laboratory equipment, rather than a Bluetooth message sent to an untouched wallet.

The finding expanded after the initial experiment. Hardware-protected secrets resisted Donjon's first investigation, but further work by the lab and Tropic Square found ways to compromise them. Restricting maintenance mode also proved insufficient: Donjon reached it using an extra fault before installing its firmware.

For Safe 7 owners, chip compromise and complete wallet recovery are distinct outcomes. These published experiments establish the former, not extraction of the wallet. Trezor attributes that separation to its remaining hardware protections and says the TROPIC01 flaw alone cannot reveal the PIN or backup. It also acknowledges that affected hardware cannot receive a complete remote fix.

Safe 5 does not contain TROPIC01. That fact does not prove it wins every physical-attack scenario. Donjon's separate supply-chain demonstration targeted Safe 3. Trezor's response excludes Safe 5 from that particular finding, citing its different microcontroller.

Recoverability Is Largely Shared

Recovery on either device accepts SLIP39 backups of 20 or 33 words, or legacy BIP39. SLIP39 can use one share or several shares with a threshold. In a two-of-three arrangement, two valid shares from that set restore access, while a single share is insufficient.

Earlier valid recovery copies remain usable after you create a replacement multi-share set. Protect those copies too, and do not combine shares from separate sets to meet a threshold.

An optional passphrase derives a separate wallet. Its exact characters are needed alongside the backup, including spaces and capitalization. A typo can open an empty wallet, and customer support cannot reset the missing secret. Keep its offline recovery record separate from the backup and device.

Trezor documents SLIP39 restoration in compatible third-party wallets, including Electrum and Sparrow. Asset support and account derivation still need to match. Both Trezor touchscreens allow on-device recovery input. Safe 7 can check an existing wallet's backup on the device without Suite, using its battery. Starting a wallet recovery still requires Suite, so the standalone check is not a complete computer-free restoration procedure.

Safe 5's MicroSD Is An Access Control

The optional microSD feature in Trezor Safe 5 binds device access to a secret on a card. Format the card as FAT32, then enable the feature with Trezor's command-line utility, trezorctl. Afterwards, unlocking needs both the paired card and the PIN.

The card contains no recovery words and cannot replace the wallet backup. If it is lost or damaged, recovery depends on that backup and any passphrase. Keeping the card separately creates another access requirement, but also another item to retrieve whenever you need the configured device.

Safe 7 does not provide this microSD feature. Its two secure elements stay inside the device, while Safe 5's card secret can be kept separately.

Compare An Asset And An Operation

Suite supports Bitcoin, Ethereum, Solana and Cardano on both models. Using Bitcoin-only firmware removes the altcoin functions. A hardware purchase therefore needs to match the selected firmware as well as the assets you intend to hold.

For supported EVM interactions, both can use Suite and compatible WalletConnect or Trezor Connect integrations. Clear Signing coverage depends on the contract description and firmware. Holding a token on the device does not guarantee that every third-party interface supports its staking or contract operations.

Before a withdrawal, check that the receiving account's network works through your chosen hardware-and-app combination.

Monero Requires A Separate App Check

Monero is outside Suite. Trezor documents Safe 5 use with Monero GUI and CLI, but its Safe 7 guide still describes companion support as pending. In contrast, Cake's v6.2.0 release announced Trezor Monero integration, and a July Trezor forum reply identifies Cake as a Safe 7 route. Other replies report difficulty finding that connection.

Those sources establish a documentation conflict, not a verified current setup on every phone. Confirm the actual Cake version and platform before relying on it. Do not assume Safe 5's GUI route works unchanged with Safe 7's different protocol. Monero recovery also has a shared limitation: Trezor's SLIP10 key derivation may prevent importing the backup successfully into another manufacturer's wallet.

Signing From An iPhone

Safe 5 uses USB-C with a compatible desktop computer or Android phone. An iPhone can provide limited portfolio functions, but cannot sign with Safe 5. Buying a different cable does not supply the missing iOS hardware connection.

Bluetooth on Trezor Safe 7 supports iPhone signing, as well as Android and compatible Windows, macOS and Linux computers. On an iPhone, USB-C charges the wallet but does not carry its signing connection. Android and desktop users can choose USB instead and disable Bluetooth in the device settings.

Trezor Host Protocol encrypts and authenticates Safe 7's USB and Bluetooth communications, and Safe 5's firmware also includes the protocol. During pairing, compare the code on the host with the device's code. An authenticated connection does not tell you whether a requested token approval is sensible or whether the connected dApp deserves access.

Screen Space And Power

Safe 5 has a 1.54-inch, 240-by-240-pixel display and weighs 23 g. Safe 7 has a 2.5-inch, 520-by-380-pixel display and weighs 45 g. Both support touch input, including PIN and passphrase entry.

Safe 7's 330 mAh LiFePO4 battery charges over USB-C or Qi2-compatible wireless charging. It is not user-replaceable. Trezor says the device can work on USB power if the battery is depleted, which helps wired users but does not create USB signing on an iPhone.

Safe 5 needs external USB power and has no battery to charge. Safe 7 has an official IP54 dust-and-splash rating, not an IP67 immersion rating.

The $120 Hardware Difference

The September 13 official offers are $129 for Safe 5 and $249 for Safe 7 in US dollars. The $120 difference buys the wireless connection, larger screen and different hardware design.

The checkout total for the selected edition adds any taxes and shipping charges to that price. Trezor directs buyers to its country selector for delivery eligibility. Optional metal backup storage, a microSD card or wireless charger belongs in a separate accessories budget.

Sending transactions incurs network fees, while purchases and swaps add the selected provider's pricing. The hardware price is separate from those transaction costs.

Provider Costs Remain Separate

Suite supports centralized swaps and decentralized EVM routes. A centralized provider receives the funds for processing, and a failed order may require identity checks before a refund. A DEX token swap can require an allowance followed by the exchange transaction. Unlimited allowance permits continuing access to that token balance, beyond a single intended swap.

Staking costs are separate from the purchase price. Trezor's published Everstake commission is 7% for SOL and 10% for ETH, charged on rewards, not on the initial stake. Registering ADA delegation needs a 2 ADA refundable deposit, with network and pool costs as well.

ETH staking depends on Everstake's contracts and infrastructure, with Trezor warning that provider failure may prevent recovery of staked funds. SOL has activation and cooldown periods. Keeping the signing keys does not eliminate these service risks or guarantee a return.

Suite's public page contains conflicting statements about iOS trading availability. Safe 7's ability to sign on an iPhone should not be treated as confirmation that every trading offer is available there. Available offers need checking in the installed app, including the provider's eligibility rules.

Suite offers controls for optional usage analytics, with Trezor documenting consent before that collection. Disabling usage data still records the decision, and manually submitted feedback is a separate action. Neither hardware model makes the companion app a zero-data service.

Desktop Suite includes Tor and custom backend options. A Bitcoin user can select a personal Electrum server instead of the default backend. These choices change who receives network requests, while public blockchain records and voluntarily shared addresses remain separate sources of exposure.

Ordering either wallet creates commerce records. Trezor's policy distinguishes ordinary order information from invoice records and provider-held payment details, with different retention rules. An identity check for an optional trading provider is also separate from generating keys on the device.

The September 2026 Brevo incident illustrates another shared dependency. Trezor said attackers used its newsletter account to send a phishing message to roughly 347,000 email addresses. SecurityWeek independently reported the incident. Trezor said no other Trezor system was touched and treated those newsletter addresses as potentially reusable for phishing, without confirming that its full list was exported.

The message tried to induce installation of software requesting wallet backups. A familiar sender address therefore cannot authenticate a recovery request. Visit the official service independently, and never provide backup words through an email link or support conversation.

Safe 5 and Safe 7 keep separate firmware changelogs. The July 2026 entries record Bitcoin and Solana signing corrections, plus a pairing-related security fix for Safe 7. Patch entries alone do not show that users were attacked.

Safe 7's quantum-ready architecture concerns device integrity. Trezor documents hybrid classical and post-quantum verification for updates, plus post-quantum microcontroller attestation. Bitcoin and other networks retain their own transaction-signature rules. Safe 7 does not make an existing Bitcoin balance quantum-proof simply by holding its keys.

Tropic Square planned revised silicon for late 2026, but Trezor's response makes no commitment about when an updated chip will appear in Safe 7. A plan for new chips is not confirmation of the revision in today's retail device.

Neither model's official product page lists a support end date as of September 13. Maintain a usable backup independently of assumptions about parts availability or future firmware.