The situation
Coldcard’s product walkthroughs lived at coldcard.com/docs/guides, alongside firmware documentation. The docs are written by the people who build the
device, for people who already own one, and are thorough and comprehensive.
Two things followed from that approach to guides. Anything under /docs reads to a search engine as reference
material for existing owners, which is not the right signal for someone wanting to know “how do I set up my first hardware wallet”. That query comes from someone who has not
bought anything yet, and the content that serves a current owner well assumes a reader who
already knows what a PSBT is and why they want one, which leaves the first-time buyer with an educational hurdle.
Neither of those is a flaw in the documentation. They are a sign that one body of content was being asked to serve two audiences with significantly different needs.
The strategy
Give the guides their own top-level path at /guides, separate from /docs, and write them
for someone at the beginning of self-custody.
The URL recommendation took ten minutes to reach and was worth more than any sentence I wrote afterwards, because it let the two audiences stop competing. The docs kept doing their job for established owners, while the guides could change the approach without breaking anything.
From there, the guides were built so a reader moving between guides never relearns where things are: breadcrumbs, on-page navigation, an editorial byline with a review date, a “before you begin” list, a numbered procedure, a troubleshooting table, key takeaways and related guides. Each guide links out to the Learn library wherever a reader needs a concept explained instead of more steps, using the same layered approach I built at Strike. In this space, teaching how bitcoin works is part of teaching how the product works, and a guide seeking to explain both can become burdensome.
There was also an editorial rule that existed across all guides: be precise about where the danger is and matter-of-fact everywhere else. A guide that says “be careful” multiple times has told the reader nothing, and continuous hedging becomes dilutive. Urgency is spent where it counts, on the irreversible steps involving private keys and secrets.
Selected work
- Coldcard Q in its factory-sealed tamper-evident bag.
- Power source. 3x AAA batteries are recommended for a fully air-gapped setup. Batteries are not included in the box and must be sourced separately.
- A pen. A paper backup card is included in the box for writing down your PIN, anti-phishing words, and seed phrase.
- MicroSD card. Not required for initial setup, however it is recommended to have at least one available. MicroSD cards must be FAT32 or FAT12 formatted and be 512 MB to 32 GB.
The engineering documentation had no equivalent “before you begin” section, because the person writing it always has the batteries. Every item here is something a first-time buyer discovers they are missing at step four with the device already powered on.
Every time you log in, these words appear after you enter your prefix and before you enter your suffix. In the future, if you correctly enter your PIN prefix and the anti-phishing words that are displayed are not correct, stop and do not enter your suffix. Unfamiliar words mean the device may have been tampered with or swapped.
Written in the future tense on purpose, because the moment this matters is months away and the reader will not have the guide open. The underlying message across the guides was to establish intentionality and skepticism, so that when something unfamiliar happens it is best to pause and double-check.
Never photograph or screenshot your seed phrase. Never type it into a phone, computer, or any app. Never email, message, or store it in any digital form, including cloud storage or password managers. Never share it with anyone, including someone claiming to be Coldcard or Coinkite support.
This is the only paragraph in guides that raises its voice, which is what makes it work. Support impersonation is the most effective attack on this audience, and a vendor unwilling to warn against itself is not much use.
| Symptom | Likely cause | Resolution |
|---|---|---|
| Device does not power on when USB-C is connected | Q requires manual power-on and does not auto-start from USB-C | Hold the power key in the top-left corner for one full second |
| Anti-phishing words look unfamiliar at a later login | Prefix PIN entered incorrectly, or device has been swapped | Re-enter the prefix carefully; if words still do not match, do not enter the suffix and contact support |
| Seed quiz fails repeatedly | Transcription error in written backup | Re-read each written word carefully; check for visually similar BIP-39 words such as “caught” vs. “cause” |
| Device shows Login Countdown after PIN failures | Multiple incorrect PIN attempts triggered a delay timer | Wait for the countdown to complete; do not power off during the countdown |
Troubleshooting is in a table format for quick reference. Symptom comes first, since that is all the user has, followed by cause and resolution for a logical approach to a fix.
Outcome
Seven guides at their own top-level path for the first time: setup for both device models, getting started with self-custody, third-party wallet pairing, MicroSD signing, QR signing, and a 2-of-3 multisig build.
Every one follows the same template, so a reader moving between them never relearns where anything is, and every one links into the Learn library at the point a concept is needed rather than trying to teach it inline. The set now competes for the searches that happen before a purchase, which is a job the docs were never structured to do and were never meant to.
Written as a content consultant for Coldcard, March to June 2026, published under a house team byline. Guides titled “How to secure your [asset] with Coldcard” are not mine.