The translucent housing came back from the printer this week, and it turned out to be the clearest statement of intent we have made so far. The PHYLAX hardware wallet has no secure element in it. That is a deliberate choice, and it follows from three rules — all three of which are visible in the photograph above.
Update 11 covered what we are building instead of a secure element, and that remains the technical answer. This post is about why the question was settled before we started: what the three rules are, how each one shows up in the hardware, and what each one costs. A hardware wallet is one of the few consumer objects where the reasoning matters as much as the result, because you are being asked to keep money on it.
One — transparency is security
A certified secure element is a tamper-resistant chip that holds the seed, and it is completely closed. The consequence is the part we could not accept: in most hardware wallets, the most sensitive component is the one component nobody outside the manufacturer can inspect. You can read the firmware and still not know what the chip beneath it does. So the schematic is published, every part number is on the specification page, and the firmware is stock Trezor Model One, unmodified — which means you can build it yourself and hash-match it against the device, and none of our code sits in the signing path.
Update 17 argued that the ten screws belong on the front where you can see them. The clear case goes one step further: you do not have to undo them. It is worth answering the obvious objection head on — does letting people see inside help an attacker? No. An attacker holding your device opens it in under a minute, screws or no screws. Concealment never protects the owner from a determined attacker; it only protects the manufacturer from the owner.
Two — robust by design
Robust here does not mean armoured. It means fewer things that can fail, and the ones that can are replaceable. There is no battery, so nothing inside ages chemically in a drawer for five years. There is no Bluetooth, no Wi-Fi and no NFC, so there is no radio to attack and no radio to go wrong. The USB line is guarded by an MF-MSMF050-2 resettable polyfuse, a BAT60JFILM Schottky against reverse polarity, a PRTR5V0U2X ESD array and 22 Ω series resistors on the data pair. The two tactile switches are rated for 500,000 presses. And the housing comes apart with a hex key, because a device you can open is a device you can repair.
What we have not earned yet: three rows on the specification page still say planned — the sixteen-pin USB-C receptacle, the moulded boost inductor and the automotive-grade RET7 microcontroller are all chosen and none of them are on the board in this photo. We also have no drop-test data, no temperature-cycling data and no idea how this material looks after two years in a pocket. Robust is the design intent. It is not yet a measured result, and we would rather say so here than let a specification sheet imply otherwise.
Three — simple, no fancy
Two buttons, one screen, one cable. That is the entire interface, and it is the whole feature list. No touchscreen, no camera, no wireless pairing, no companion app store, no battery. Every feature we did not add is attack surface we did not add, and on a device whose only job is to keep a key secret and show you honestly what you are about to sign, features are mostly a liability. Choosing stock firmware over our own fork is the same instinct: the boring option, on purpose.
The cost is real and worth naming. Entering a passphrase with two buttons is slower than a keyboard. There is no phone pairing, so the device is tethered to a computer by a cable. It is Bitcoin-only, so it will not hold the rest of your portfolio. If those things matter more to you than an auditable design, another wallet is genuinely the better buy — and we would rather you worked that out from this page than from an unhappy purchase.
What the clear case does not prove
It is translucent, not transparent. You can see the glow of the screen through the wall and the vague shape of what is behind it, but you cannot read a part number through this material — look at the photo and you can see the light bleeding out around the display, which is pretty and is also a reminder that the light path is not sealed. It will show fingerprints, and any dust that gets inside will be on permanent display. A see-through case is a reminder of the argument, not evidence for it. The evidence is the published schematic, the part numbers and the firmware you can rebuild.
Three rules, one object: transparency is security, robust by design, simple over fancy. The full parts list is at /specs, the reasoning on the seed is in Update 11, and the prototype will be at Bitcoin Thailand Conference 2026 if you would like to argue about any of it in person.