Choosing and preparing an air-gapped laptop

Some product links in this guide are affiliate links. How that works.

An air-gapped laptop is a computer with its wireless radios physically removed, used only to create wallets and sign transactions. It works for every coin, gives you a full screen to check transactions on, and costs around $200 used.

This guide covers which laptops make good offline machines, how to remove the radios, and how to set it up.

What makes a good offline laptop

You want four things:

1. A removable Wi-Fi card. Wi-Fi and Bluetooth usually live on one small card. If you can unscrew it, you can remove both radios in minutes.
2. No surprise radios. Some business laptops have a cellular modem (WWAN) card as well.
3. Good Linux support, so Tails runs without trouble.
4. A webcam, so you can pass transactions by QR code instead of USB stick.

USB-C charging is a nice extra. It means one charger for everything.

Recommended: ThinkPad T480, T490 or X280

Used Lenovo ThinkPads from around 2018 to 2019 fit almost perfectly. The ThinkPad T480 is the classic choice.

• Price: about $150 to $250 used, on eBay or from refurbishers.
• Wi-Fi card: a small M.2 2230 card held by one screw under the bottom panel. Bluetooth is on the same card.
• Charging: USB-C.
• Build: sturdy. Lenovo advertised military-spec durability testing for this line. It isn’t a rugged laptop, but it handles everyday knocks.
• BIOS: lets you disable the camera, microphone and wireless as a second layer.

The T490 and X280 work the same way. The X280 is smaller. Check the specific listing: some configurations differ, and condition varies a lot on the used market.

Laptops to avoid

• MacBooks. Wi-Fi and Bluetooth are soldered to the main board. You can’t remove them.
• Most thin ultrabooks and many consumer laptops. Same problem: soldered wireless. Look up a teardown of the exact model before you buy.
• Older ThinkPads with a Wi-Fi whitelist, if you plan to swap the card. Lenovo added the whitelist in 2012. It affects roughly the T430/X230 generation through Haswell-era models like the T440p. Their BIOS accepts only approved wireless cards. With an unapproved card fitted, they refuse to boot and show error 1802. Reports differ on what happens with no card at all, so check a forum for your exact model. The T480 has no whitelist.

Before buying any laptop, search for ” wifi card replacement” or a teardown video. If the card is soldered, choose a different laptop.

Other options

• Rugged laptops like Panasonic Toughbooks or Dell Latitude Rugged models also have removable cards. They cost $300 to $700 or more used. Check that the specific model charges over USB-C if that matters to you.
• Framework 13. The Wi-Fi card is designed to be removed and it charges over USB-C. It costs $400 or more used, which is a lot for a single-purpose machine.

Step 1: Update the BIOS (once)

While the laptop is still a normal computer, update its BIOS using the maker’s official tool. After this, the laptop never goes online again. Doing it now avoids needing a network later.

Step 2: Remove the Wi-Fi card

These steps are for a ThinkPad T480. Other models are similar; follow a guide for your exact laptop.

1. Disable the built-in battery first. On the T480, this is a BIOS option (under the power settings) that disconnects the internal battery so you can work safely. The laptop shuts off and won’t power on until you plug in the charger.
2. Remove the external battery if your model has one.
3. Loosen the screws on the bottom panel. They’re captive, so they stay in the panel.
4. Gently pry the panel off, starting from a corner.
5. Find the Wi-Fi card. It’s a small card with two thin antenna wires clipped on.
6. Unclip the antenna wires. Tape their ends so they don’t touch the board.
7. Remove the one screw holding the card and slide it out.
8. Look for a second card slot with antenna wires. That’s WWAN (cellular). Remove that card too if one is fitted.
9. Put the panel back on.

Keep the removed card somewhere separate, or destroy it. Don’t leave it in the laptop bag where it might go back in.

Step 3: Lock down the BIOS

1. Plug in the charger to wake the laptop.
2. In the BIOS, disable the microphone.
3. Disable wireless options if they still appear.
4. Leave the camera on only if you’ll sign by QR code. Otherwise disable it.
5. Set a BIOS password if you want to stop others changing these settings.

Step 4: Confirm the radios are gone

Boot any operating system (Tails works) and check:

• No Wi-Fi networks show up.
• No Bluetooth option appears, or it reports no adapter.

If anything wireless still appears, you missed a card. Check the board again.

Step 5: Set up Tails and your wallet

1. On your normal computer, download Tails, verify it, and write it to a USB stick.
2. Boot the offline laptop from that stick. Choose no network at the welcome screen.
3. Create your wallet:
   • Bitcoin: use Sparrow. Full steps are in cold storage without a hardware wallet.
   • Ethereum and EVM chains: tools like Foundry’s cast wallet can create keys and sign transactions offline. You then broadcast the signed transaction from an online machine.
4. Back up the seed words. For real money, stamp them into steel with a stamping kit. See seed backups.

Step 6: Move transactions safely

You’ll pass unsigned transactions to the laptop and signed ones back.

• QR codes (preferred). Sparrow can display and scan QR codes. Nothing physical connects the two computers.
• USB stick (fallback). Use one stick only for this job. Don’t plug it into random computers.

Always read the destination address, amount and fee on the offline laptop’s screen before signing.

Step 7: Test recovery

Before trusting the laptop with real money:

1. Receive a small amount.
2. Do one full offline sign and broadcast.
3. Reboot Tails, restore from your backup, and confirm the same addresses appear.

Rules for living with it

• Never connect it to a network again. No “just this once.”
• Install nothing else. It’s a signing machine only.
• Label it. “Offline only” on the lid prevents mistakes by you or anyone in your house.
• Store it securely, but remember the backup matters more than the laptop. If the laptop dies, your seed restores the wallet anywhere.

Compare your options

An air-gapped laptop is the right pick if you hold coins other than Bitcoin or want a big screen. For Bitcoin only, a SeedSigner is cheaper and has no radios at all. See every option side by side in the cold storage kits.