Is Ledger open source?

Ledger is open source in part, not in full. The company publishes the code for its Ledger Wallet app (formerly Ledger Live), its software development kits and the apps that run on its devices. The lowest layer of its firmware, the code that drives the secure element chip, remains closed, and Ledger says it cannot legally release it.

Which parts of Ledger are open source?

As of October 2026, Ledger's own explainer lists several public pieces. The Ledger Wallet app is published under the permissive MIT license, so anyone can copy or fork it. Ledger's wallet API and secure SDK, including its cryptography library, are on GitHub. The embedded apps that handle each coin can be reviewed through Ledger's developer documentation.

Within the device operating system, which Ledger calls BOLOS, the company says the commands dispatcher and the entry points of its Ledger Recover feature are open for review. In May 2023, Ledger's CEO described "a portion of the operating system" as already public and promised to open as much more as possible.

Why is Ledger firmware not fully open source?

Ledger devices are built around a secure element, a tamper-resistant chip. Ledger says its agreement with STMicroelectronics, the chip's maker, legally prevents it from exposing the low-level code that talks to the chip's hardware blocks.

Ledger calls this a trade-off, choosing a secure chip with most code open over a weaker chip with all code public. To make up for the closed part, it points to its internal security team, called Donjon, a genuine check that lets users confirm their device is authentic, and an outside lab that audits the operating system before each release. Critics say users must trust code they cannot read. Our Trezor vs Ledger guide compares this with Trezor's approach.

What was the Ledger Recover controversy?

In May 2023, Ledger announced Ledger Recover, an optional paid service that encrypts a device's recovery phrase, splits it into three fragments and stores them with Ledger, Coincover and EscrowTech. Restoring it requires government ID checks.

Many users objected. They had understood that keys could never leave a Ledger device, and a firmware update that could export an encrypted copy looked to them like a backdoor. A Ledger spokesperson said the phrase could only be extracted if the user approved it on the device.

On May 23, 2023, CEO Pascal Gauthier apologized for how the service was communicated and tied its release to an accelerated open-source roadmap. In June 2023, Ledger published a white paper on the Recover protocol on GitHub. As of October 2026, Ledger lists Recover as opt-in and available in the EU, the UK, Canada and the US.

Does open source matter for your security?

Gauthier argued that open source is a transparency feature rather than a security feature in itself. Either way, Ledger's own explainer notes that no device can protect a user who signs a malicious transaction or exposes the recovery phrase. An optional passphrase is not included in a Recover backup, Ledger says. The basics of how these devices work are in what is a hardware wallet.