A hardware wallet keeps your private keys on a dedicated device, away from the phones and computers you use every day. That is the whole point of owning one. But it raises a practical question: if the keys live on a device in a drawer, how do you keep an eye on your funds without plugging it in every time?
The answer for many owners is a watch-only wallet. It lets you see balances and incoming activity on your phone, while the keys never leave the hardware device.
What a watch-only wallet is
Every wallet has two kinds of keys. The private key authorizes spending. The public key is used to generate the addresses where you receive funds. Anyone can look at the public side of a wallet. Only the private side can move anything.
A watch-only wallet is an app that holds just the public side. You export that public information from your hardware wallet once, import it into the app, and the app can then look up your addresses on the network and show what is there.
Because the app never receives a private key, it has nothing that can sign a transaction. If your phone is lost, stolen or infected with malware, whoever gets hold of it can see your balances, but cannot spend them.
Think of it as a window, not a door. You can look in from anywhere. You still need the key on the hardware device to open anything.
What it can do
A watch-only setup covers most of the everyday reasons people check a wallet:
- Show your balances across the accounts you have imported.
- List incoming and outgoing transactions, with their confirmation status.
- Generate receive addresses, so you can give someone an address to pay you while the hardware device stays at home.
- Send alerts when funds arrive, if the app supports notifications.
- Help you prepare a transaction in some setups. You draft the payment on the phone, then approve and sign it on the hardware device.
For many owners this is enough to stop connecting the device for routine checks. Less handling of the device means fewer chances to plug it into a computer you do not fully trust.
What it cannot do
The limits matter as much as the features.
- It cannot spend. Every outgoing transaction still has to be confirmed on the hardware wallet itself. This is the protection, not a flaw.
- It cannot restore your wallet. The public information is not a backup. If the hardware device is lost, you recover your funds from your recovery phrase, not from the phone.
- It cannot guarantee that what it shows is true. The app relies on the data it receives. A compromised phone could, in principle, display a wrong balance or a wrong receive address.
That last point leads to an important habit. Before you share a receive address for a meaningful amount, confirm it on the hardware wallet's own screen. The device screen is the part of the system you can trust, because it does not depend on your phone.
Privacy is the hidden trade-off
To show your full history, many watch-only setups use an extended public key. This one piece of information lets the app work out every address in an account, past and future.
That is convenient, and it also means anyone who sees the extended public key can see your entire balance and transaction history for that account. They still cannot spend your funds, but they learn a lot about them.
Treat it as private information:
- Do not post it, paste it into chats or store it in shared notes.
- Import it only into apps you have reason to trust.
- Remember that most apps look up your addresses through a server. Unless you connect the app to your own node, that server can see which addresses belong to you.
Setting up a watch-only wallet sensibly
The exact steps depend on your device and the app you choose, but the general approach is the same:
- Export the public information from your hardware wallet using its companion software. Never enter your recovery phrase into a phone app to do this. A genuine watch-only setup does not need it.
- Import it into a watch-only app that clearly states it does not hold private keys.
- Check one address against the device. Generate a receive address in the app and confirm it matches the address shown on the hardware wallet's screen.
- Lock the app with a PIN or your phone's biometric lock, so a borrowed or lost phone does not reveal your balances.
- Keep the hardware wallet as the place where approvals happen. The phone watches, the device decides.
If any app asks for your recovery phrase to "connect" or "sync" a watch-only wallet, stop. That request turns a window into a door, and it is a common sign of a scam.
Where it fits in your routine
A watch-only wallet works best as a daily companion to a hardware wallet, not a replacement for one. Use the phone to look, receive and plan. Use the device to approve. Keep the recovery phrase offline and separate from both.
Set up this way, checking your funds becomes something you can do in a few seconds, with your keys still exactly where they belong.