A cryptocurrency holder with significant Ethereum or EVM-chain assets faces a familiar security dilemma: how to maintain practical access to decentralized applications while minimizing exposure to network-based threats, malware, and compromised browser environments. The conventional solution—install a wallet extension, connect to dApps, and sign transactions—trades security for convenience. An alternative approach uses offline installation and air-gapped signing, where a dedicated device never touches the internet and private keys remain isolated from any network connection. This method is not frictionless, but for users prioritizing extreme isolation over daily usability, the effort is justified.

Rabby Wallet, a non-custodial wallet built for Ethereum and compatible blockchain networks, supports this use case through careful architecture and manual setup discipline. The wallet does not require constant internet connectivity for private key storage or recovery phrase management, because it never holds those secrets on its servers. Users who download and install Rabby on an offline device can create or import accounts, verify transaction details, and prepare signed data for later broadcast to the network. The distinction between signing and broadcasting—keeping these functions separate across different machines—is the core security mechanism that air-gapped workflows depend on.

Why offline installation matters for rabby wallet security

A wallet extension running in a connected browser has several vulnerability points. The browser itself can be exploited through zero-day vulnerabilities, malicious extensions, or compromised websites that inject code into the page context. Updates can be forced or intercepted. DNS resolution can be poisoned. Network traffic can be monitored. Even with HTTPS and content security policies, the attack surface remains substantial. Rabby’s transaction analysis feature—which shows users exactly what a dApp is requesting before signing—mitigates some of these risks by making consent explicit and visible. But analysis cannot protect against a compromised signing environment.

Offline installation addresses this by removing the network as an attack vector during the most sensitive operation: key generation and transaction signing. A device that has never been connected to the internet cannot receive malware updates, be compromised through a zero-day browser exploit, or have its network traffic intercepted. The private keys remain on the offline machine and never travel across any network. Signing happens locally, producing a cryptographically valid transaction that can then be transported via USB drive, QR code, or manual data transfer to a connected machine for broadcast.

The trade-off is operational friction. Users must maintain two separate machines or use a device that is reliably airgapped before every signing operation. Transaction review requires either memorizing instructions or recording them on paper. The connection between offline signer and broadcast device must be unidirectional: data flows from the online machine to the offline machine for signing approval, then from offline back to online for broadcast. This is the opposite of how most users interact with wallets, where a single device does everything.

For a user considering whether this extreme approach is appropriate, the question is not whether offline signing is theoretically more secure. It is whether the probability and impact of a compromise justify the recurring inconvenience. A holder of a large balance in a single account, a user whose device is shared or frequently exposed to untrusted networks, or someone managing institutional funds may find the answer is yes. A casual user with a small balance and a secure personal device may reasonably decide that the friction exceeds the marginal benefit.

Downloading Rabby for offline use

The first step in setting up an air-gapped workflow is obtaining the Rabby wallet software in a way that does not require internet access on the offline device itself. This typically means downloading the installer or extension file on a connected machine, verifying its authenticity, and then transferring it to the offline machine via removable media or direct cable connection. Users can access the official source and begin the download process by visiting the rabby wallet download page, which provides the browser extension for Chrome, Brave, Firefox, and Edge.

Verification is a critical step that many users skip. A downloaded file can be checked against a published hash—typically SHA-256 or similar—to confirm that it has not been modified in transit or corrupted. The official Rabby project documentation or GitHub repository should publish these hashes prominently. On a connected machine, calculate the hash of the downloaded file using command-line tools (sha256sum on Linux and macOS, certUtil on Windows, or equivalent utilities on other systems) and compare the result to the published value byte-for-byte. If they do not match, do not proceed; delete the file and try downloading again from a different network or at a different time.

After verification, the installer or extension file should be written to a USB drive, external SSD, or other removable media that will be transferred to the offline machine. This media should be newly formatted or explicitly wiped beforehand to minimize the risk of carrying unrelated malware. On some systems, the transfer itself can be done via USB cable while the offline machine remains powered off or in airplane mode. On others, the media is removed from the connected machine, physically transported, and connected to the offline device. The goal is ensuring that the offline machine never directly connects to the internet or any network device that has.

For users installing Rabby Wallet on a desktop or laptop that will be airgapped, the process depends on the operating system and browser. A browser extension is typically unpacked into a local directory and then loaded as an unpacked extension by enabling developer mode and pointing the browser to that directory. Desktop and mobile versions may use different installation channels. The key principle is that the installation medium itself—the USB drive or local file—is the source of truth, not an online update server. After installation completes, verify that the wallet launches and displays its interface without attempting to connect to the internet. Check the network settings to confirm that connectivity is disabled.

Creating and importing accounts on an airgapped machine

Once Rabby is installed and running offline, the next step is either creating a new account or importing an existing one via recovery phrase. For a new account, Rabby generates a recovery phrase (also called a seed phrase or mnemonic) and displays it on screen. This phrase is the master secret from which all private keys and addresses are derived. Writing it down by hand on physical paper that is then stored in a secure location—a safe, safe deposit box, or similar—is the standard practice. Do not photograph it, do not store it on any device, and do not create digital backups unless that backup is itself airgapped and physically secured.

If the user is importing an existing recovery phrase—perhaps one previously generated elsewhere—Rabby provides an import interface that accepts the phrase in text form. After entry, the wallet displays the derived addresses and asks the user to confirm the intended account. At this point, the private keys exist only on the offline machine in the wallet software’s memory and in Rabby’s encrypted local storage. They have not been broadcast to any service, backed up to a cloud provider, or exposed to any network.

For users managing multiple accounts or chains, Rabby’s support for multiple addresses and EVM-compatible networks becomes relevant. Each blockchain (Ethereum mainnet, Arbitrum, Optimism, Polygon, and dozens of others) has a separate address derived from the same seed phrase. The wallet displays them clearly and allows the user to manage balances across chains. On an airgapped machine, this means the user can review account states and prepare transactions for all relevant chains before any network connectivity. The information about which addresses own what cannot be updated without internet access, but the capability to construct transactions that spend from those addresses is entirely local.

Recovery phrase security is non-negotiable at this stage. The recovery phrase written on paper should be stored separately from the machine, tested once (by importing it into a second airgapped instance to verify that the same addresses are derived), and then the test import should be deleted. The paper copy should never be digitized. If the user must create a backup backup—a second physical copy—it should be stored in a geographically separate location so that a single fire, flood, or theft does not destroy both. Users often underestimate this step, treating recovery phrases as afterthoughts. For an airgapped setup, the recovery phrase is arguably more important than the machine, because the machine can be rebuilt or replaced, but the phrase is irreplaceable.

Preparing and signing transactions offline

The central operation in an air-gapped workflow is preparing a transaction on the online machine, transferring its details to the offline machine for review and signing, and then bringing the signed transaction back to the online machine for broadcast. Rabby facilitates this through its transaction details display and ability to generate unsigned transaction data. On the online machine, the user constructs the transaction details: destination address, amount, contract interaction parameters, gas settings, and other relevant fields. These details are encoded into a format that can be transported—typically as a file, QR code, or manual text transcription.

The offline machine receives this data and Rabby decodes and displays it. This is where the wallet’s emphasis on transaction transparency becomes critical. The user can read exactly what the transaction does, verify that the destination address is correct, confirm the amount and token type, and check that the gas parameters are reasonable. Rabby’s interface is designed to make these details legible rather than hidden behind technical abstractions. After review, the user approves the transaction and Rabby signs it using the private keys stored locally. The result is a signed transaction object—cryptographic proof that the holder of the private keys has authorized this specific transaction.

The signed transaction is then exported from the offline machine, typically as a file or manually copied data, and transferred back to the online machine. On the online machine, Rabby (or another tool) broadcasts this signed transaction to the network. The transaction is now publicly visible and will be included in a block as long as the gas price is appropriate and the network is accepting transactions. The signed transaction is cryptographically bound to its specific parameters; it cannot be modified after signing without invalidating the signature.

The security property here is that the private keys have never traveled across any network and the machine holding them has never been exposed to internet-based attacks. The online machine could be completely compromised—malware, screen capture, keylogger, everything—and it still cannot extract the private keys or forge transactions, because those keys never existed on that machine. The attacker could learn what transaction is being prepared and where it is being sent, but they cannot intercept and redirect it without the offline machine’s participation.

Managing the boundary between air-gapped and online machines

The enforceability of air-gapped security depends entirely on the user maintaining strict separation between the offline and online machines. This means several operational disciplines must become habitual. The offline machine should have no wireless connectivity enabled—wifi, Bluetooth, cellular, everything disabled at the hardware level if possible. USB ports should be used only for the specific purpose of transferring data to and from the online machine; no other devices should be connected. The machine should not be used for any activity other than wallet and transaction operations, because each additional use introduces new attack vectors and software dependencies.

On the online machine, the user must be aware that it can be compromised and should take appropriate precautions. This means maintaining good security hygiene: keeping software updated, using anti-malware tools, avoiding suspicious websites and downloads, and being cautious with permissions granted to applications. The online machine should not have access to the offline machine’s storage media except during explicit, intended transfers. USB drives used for this purpose should ideally be dedicated to that single function and not reused for other data transfers that might introduce malware.

The transfer medium itself—the USB drive, SD card, or other storage—should be treated as potentially contaminated after each use. Ideally, a new drive is used for each transfer or the drive is wiped thoroughly before reuse. Some users go further and use write-once media such as CDs or DVDs, which cannot be reinfected after data is written. The principle is that the offline machine’s integrity depends on everything that enters it from the outside being clean. A single piece of compromised software or data transferred from the online machine could undermine the entire isolation.

Users should also establish a protocol for what happens if the online machine shows signs of compromise—a ransomware attack, sudden slowness, unexpected network traffic, or strange files appearing. The decision to use that machine for any transactions should be reconsidered. The offline machine should be assumed clean unless proven otherwise, so even if the online machine is compromised, the ability to sign new transactions remains. The signed transaction from the offline machine cannot be altered by malware on the online machine, so the compromise affects broadcasting and visibility but not the validity of the cryptographic commitment.

Rabby wallet download verification and ongoing updates

Keeping the wallet software itself current presents a challenge in an air-gapped setup. Traditional automatic updates cannot work when the machine has no internet connection. Instead, updates must be deliberately downloaded, verified, and transferred using the same process as the initial installation. This adds friction, but it also gives the user a moment to pause and consider whether the update is necessary and whether the update file itself is authentic.

The process is identical to the initial rabby wallet download process: obtain the new version on the connected machine, verify its hash against the official source, and transfer it to removable media. On the offline machine, uninstall the old version of Rabby (or simply move it to a backup location), then install the new version from the transferred media. After installation, verify that the wallet still displays the expected accounts and balances. If something appears wrong, delete the new version and revert to the previous one; then investigate further before attempting the update again.

Some users question whether updates are even necessary in an airgapped context. If the wallet software is not connecting to the internet and is only receiving data transferred by the user via removable media, the attack surface for remotely exploitable vulnerabilities is reduced. However, vulnerabilities in local software—bugs that could be triggered by maliciously crafted transaction data, UI flaws, or cryptographic errors—can still exist. Updates that fix these issues are valuable. The judgment about whether to update should balance the risk that the current version has an unknown vulnerability against the risk that something goes wrong during the update process.

Official sources for updates should come from the Rabby project’s GitHub repository or official website, not from third-party download sites. The official sources publish release notes explaining what has changed and why, security advisories if relevant, and file hashes for verification. A user should read these notes before updating to understand what they are installing. Updates that make dramatic changes to the interface or core functionality might warrant extra caution; bug fixes and security patches are generally lower-risk.

Practical limitations of air-gapped signing with a non-custodial wallet

Air-gapped security is powerful, but it does not eliminate all risks and it introduces some practical limitations worth understanding. First, address and balance information is fundamentally dependent on network connectivity. On the offline machine, Rabby cannot automatically refresh the balance or show recent transactions; the user must manually check a blockchain explorer on the online machine. This creates a information gap: the user may sign a transaction intending to send a certain amount, only to discover afterward that the balance has changed or that recent activity has already committed those funds elsewhere.

Second, the lack of real-time gas price information means the user must either estimate gas parameters or obtain current gas prices from the online machine and manually enter them into the offline machine. If the estimate is too low, the transaction will remain pending; if it is too high, the user overpays. This is a usability cost, but it is not a security cost. The transaction is still valid and signed; it will simply take longer to confirm or cost more than optimal.

Third, any dApp interaction that requires a response to an on-chain event—such as confirming a transaction within a short time window or responding to a price-sensitive offer—becomes difficult or impossible in an airgapped setup. If the user is several minutes behind because they must manually construct and sign transactions, time-sensitive opportunities may be lost. This is acceptable for long-term holding and security-critical transactions; it is not acceptable for trading, providing liquidity, or participating in yield farming where timing matters.

Fourth, the recovery phrase security depends entirely on the user’s discipline. If the recovery phrase is lost, damaged, or forgotten, the funds locked to that account are irrecoverable. There is no customer service, no account recovery email, no second-factor authentication bypass. For a user accustomed to account recovery services, this is a psychological adjustment as much as a security one. The funds are yours, which means the responsibility for them is entirely yours as well.

When to choose air-gapped signing over connected wallets

Air-gapped security is not universally necessary. Most users are better served by a conventional connected wallet, security-hardened according to best practices: a strong unique password, a reputable device, software kept up to date, and caution about which dApps they authorize. Air-gapped security becomes relevant when the user meets several conditions simultaneously. First, they are holding a balance significant enough that a compromise would be genuinely painful—not merely an annoying loss, but a substantive financial impact. Second, they are willing to tolerate the operational friction and learning curve. Third, they understand that air-gapped security only protects the signing step; it does not protect the recovery phrase, the offline device’s physical security, or threats that occur after the transaction is broadcast.

Users who are managing institutional funds, holding long-term reserves that they rarely move, or operating in high-threat environments—where their devices are frequently exposed to untrusted networks or where malware is prevalent—are candidates for airgapped setups. Users who are actively trading, participating in time-sensitive DeFi protocols, or using dApps frequently are generally better served by a connected wallet with strong per-transaction security rather than the friction of air-gapped signing.

The decision to set up an air-gapped workflow with Rabby is ultimately about aligning security practice with personal risk tolerance and financial circumstances. The non-custodial nature of Rabby means that security is the user’s responsibility regardless; whether they choose to exercise that responsibility through air-gapping or through other means is an individual choice. For those who do choose to implement it, the steps outlined above provide a concrete path to downloading, installing, and using Rabby in a way that maximizes isolation and minimizes network exposure of private keys and transaction data.