Blog

How to Store ZEC Safely and Privately (2026 Guide)

Vizor team

  • zcash
  • zec
  • cold storage
  • ledger
  • keystone
  • shielded
  • privacy

Updated November 3, 2026.

To store ZEC safely and privately, move it off the exchange and into a self-custody wallet that keeps it shielded. For larger amounts, use a hardware wallet that signs shielded transactions, such as a Ledger or a Keystone 3 Pro. Your keys stay offline and your balance stays private. Where you keep ZEC affects more than security. A transparent address shows your balance and every payment to anyone who looks.

Where to store ZEC: quick comparison

Option Who holds the keys Shielded? Best for
Exchange account The exchange Depends on the exchange. Many withdraw only to transparent addresses Trading, not storage
Transparent-only wallet (for example, Trezor) You No. Balances and history are public Storage without privacy
Shielded software wallet (for example, Vizor) You Yes. Vizor shields by default Everyday amounts
Hardware wallet with a shielded wallet app (Ledger or Keystone 3 Pro with Vizor) You, with keys kept on the device Yes Long-term holdings, larger amounts

Transparent vs. shielded ZEC: why it matters where you store it

Zcash has two kinds of addresses:

  • Transparent addresses (starting with t) work like Bitcoin addresses. The sender, the receiver, and the amount are all public on-chain.
  • Shielded addresses keep the amount, the addresses, and the memo encrypted. Today's shielded wallets hand out Unified Addresses (starting with u1), which can include a shielded receiver.

A wallet that supports only transparent ZEC exposes everything you hold in it. Trezor, for example, says plainly that its devices "only support public transactions using t-addresses," and that shielded transactions are not compatible. If your exchange knows who you are and you withdraw to a transparent address, anyone who links that address to you can follow your balance from then on.

Before you choose a wallet, check its own documentation for shielded support. Don't assume a wallet that "supports Zcash" supports shielded ZEC.

Option A: store ZEC in a shielded software wallet

A software wallet is the quickest way to get ZEC off an exchange and into shielded storage. Vizor is a self-custody, open-source Zcash wallet for macOS, Windows, Linux, iOS, and Android. Transactions are shielded by default.

  1. Download Vizor from vizor.cash/get. On desktop you can check the build against the latest GitHub release.
  2. Create a new wallet.
  3. Write the recovery phrase on paper and store it somewhere safe and offline. Vizor can't recover your funds if you lose it.
  4. Set an app password. It protects access on this device only and does not replace your recovery phrase.
  5. Open Receive and copy your shielded Unified Address. Use it whenever you're paid or move ZEC in.

For larger balances, add a hardware wallet (Option B) so your keys never sit on an internet-connected device.

Option B: shielded ZEC cold storage on Ledger or Keystone

Some AI summaries still say Ledger supports only transparent ZEC. That is no longer true. Ledger's Zcash app now supports shielded ZEC in the Ironwood pool, and Ledger Wallet Desktop added native shielded support in September 2026. Vizor works with Ledger and Keystone. Your keys stay on the device and you approve every send, receive, and shield on its screen.

Ledger (USB or Bluetooth)

  1. In Ledger Wallet, update your device firmware and install the Zcash app, version 3.10.0 or newer. Vizor requires this version for NU7 and for moving Orchard funds to Ironwood.
  2. Open Vizor and connect the Ledger to set up a wallet or add an account.
  3. Choose USB or Bluetooth. USB works on macOS, Windows, and Linux. On Windows and Linux, desktop Vizor connects over USB only. Linux users may need to install the Ledger USB permission rules that come with the app.
  4. Check and approve each transaction on the Ledger screen.

Keystone 3 Pro (air-gapped QR)

  1. Install Keystone's Cypherpunk firmware edition. It's the edition that supports shielded ZEC, and Ironwood support requires version 3.0.2 or later. Keystone warns that once you upgrade to 3.0.2, you can't downgrade to the 3.0.0 Multi-Coin or BTC-Only firmware. Read the firmware notes first.
  2. In Vizor, import your Keystone account.
  3. To send, scan Vizor's QR code with the Keystone, approve the transaction on the device, then click Get Signature in Vizor and scan the signed QR code back in.

Nothing travels over USB or Bluetooth with Keystone. The keys stay on the device and only QR codes cross the gap. Keystone points out that you never need to enter your recovery phrase on a computer, phone, or browser.

How to move ZEC off an exchange and shield it

Some exchanges only support transparent withdrawals. Here's the safe way through:

  1. In Vizor, open Receive and copy your transparent address.
  2. Withdraw a small test amount from the exchange to that address and wait for it to arrive.
  3. Withdraw the rest.
  4. Shield the funds in Vizor. Vizor sends only from your shielded balance, so transparent funds have to be shielded first anyway.
  5. From then on, give people your shielded Unified Address.

The withdrawal is public, and so is the transparent amount that goes into the shielded pool. After the funds are shielded, what you do with them is not.

Back up your recovery phrase and wallet birthday

Your recovery phrase is the wallet. Your phone, laptop, Ledger, or Keystone is just a way to use it.

  • Write the recovery phrase on paper or metal. Never save it as a photo, cloud note, password-manager entry, email, or chat message.
  • Note the wallet's birthday, the date (or block height) when you created the wallet. When you restore, a birthday lets the wallet start scanning near your first transaction instead of at the beginning of the chain. Vizor asks for a birthday date when you import a wallet.
  • Store copies in at least two secure places and test a restore before you deposit large amounts.
  • Never share your phrase with anyone, including support. Vizor support tells you not to share your recovery phrase, private keys, or passwords.

Privacy limits to know about

Shielding hides amounts and addresses on-chain. It doesn't hide everything.

  • Your server sees network metadata. Light wallets sync through a lightwalletd server. Vizor scans shielded transactions on your device, but the server can still see network metadata such as your IP address and when you make requests.
  • You can choose your server. Vizor lets you pick a preset lightwalletd endpoint or enter your own.
  • Tor on desktop. Vizor desktop can route wallet syncing and transaction traffic through Tor. Some third-party services may reject Tor connections.
  • Private queries (experimental). On mainnet, Vizor can look up supported transactions without revealing their IDs to servers. It's off by default.
  • Transparent activity stays public, including any funds you haven't shielded yet.

Read Vizor's privacy policy for what the app itself collects.

Ironwood and NU7: what to update

Two network upgrades affect how you store ZEC this year:

  • Ironwood (NU6.3), activated July 28, 2026. It added a new shielded pool called Ironwood. The original Orchard pool is now restricted, and funds leaving Orchard pass through a turnstile into Ironwood. Orchard funds don't expire, but moving them into Ironwood takes a migration transaction from an Ironwood-compatible wallet. Vizor walks software-wallet and Keystone users through it. Ledger accounts use Immediate migration, which moves funds in one go, so the amount crossing over is visible on-chain.
  • NU7, expected around November 5, 2026 (UTC), at mainnet block 3,543,405. NU7 cuts block time from 75 seconds to 25 seconds. It also makes version 4 transactions invalid, so any funds still in the old Sprout pool become unspendable. The block height, not the date, triggers activation.

What to do:

  1. Update Vizor to the latest release. Vizor v0.0.63 switches to NU7 automatically at the activation height.
  2. Ledger: update the device firmware and install Zcash app 3.10.0 or newer before NU7.
  3. Keystone: run current Cypherpunk firmware, and before activation check Keystone's firmware page for any NU7 update.
  4. Expect some transaction actions to pause briefly around activation. If an Ironwood migration in progress is interrupted by the upgrade, Vizor shows what's left and helps you move the rest.

FAQ

What is the safest way to store ZEC?

Keep it in a self-custody wallet that holds it shielded. For larger amounts, use a hardware wallet such as Ledger or Keystone 3 Pro so your keys never leave the device, and keep an offline backup of the recovery phrase.

Can I store shielded ZEC on a Ledger?

Yes. Ledger's Zcash app supports shielded ZEC in the Ironwood pool. Vizor can use a Ledger over USB or Bluetooth. Before NU7 activates, Vizor asks Ledger users to install Zcash app 3.10.0 or newer.

Does Keystone support shielded Zcash?

Yes, on the Keystone 3 Pro with Keystone's Cypherpunk firmware. Ironwood support needs Cypherpunk 3.0.2 or later. Vizor connects to Keystone through air-gapped QR codes.

Does Trezor support shielded ZEC?

No. Trezor says its devices support only transparent t-address transactions for Zcash, so balances and history on those addresses are public.

Why is my exchange withdrawal transparent?

Some exchanges only support transparent withdrawals. Withdraw to your wallet's transparent address, then shield the funds once they arrive. Vizor can send only from your shielded balance, so you shield the funds first anyway.

Do I need to do anything for NU7?

Update your wallet before NU7 activates at mainnet block 3,543,405, which is expected around November 5, 2026 (UTC). Ledger users in Vizor should also update the device firmware and install Zcash app 3.10.0 or newer.

Ready to move your ZEC somewhere private? Get Vizor. It's free, open source, and works with Ledger and Keystone. Questions? Visit Vizor support or browse the code on GitHub.