Trezor Bridge® — Connect Your Web3 World Securely™

Quick summary

Trezor Bridge runs on your computer as a background service and exposes a controlled, local API for browser-based applications to interact with Trezor devices over USB. It is a communication layer only — Bridge never has access to your private keys or recovery seed. All signing and sensitive operations occur on your Trezor hardware device, which always requires on-device confirmation for actions that matter.

Use Bridge when you need browser-based dApp compatibility. For purely desktop workflows, Trezor Suite or native integrations may be sufficient and do not require Bridge.

Why Trezor Bridge exists

Modern browsers restrict direct hardware access to protect users and their devices. Different browsers implement USB and security models in slightly different ways. Trezor Bridge provides a stable, consistent, and audited interface that simplifies developer integration and reduces attack surface by limiting direct browser-level access to the device. It also avoids complex extension-based approaches and centralizes safety checks in a trusted local application.

• Compatibility: Bridge works across Chrome, Firefox, Edge, and other browsers.
• Usability: Developers use the same API whether users are on Windows, macOS, or Linux.
• Security: Keeps secret material on the device and centralizes origin checks and permission flows.

Download Bridge from the official source

Always download Bridge only from the official Trezor website. Do not trust attachments, emailed links, or search results that point to unknown domains.

1. Open a browser and go to trezor.io/start.
2. Choose the Trezor Bridge installer for your platform (Windows, macOS, Linux).
3. Download the package. Advanced users may verify checksums or signatures if published on the official site.
4. Run the installer and, if necessary, grant permissions when prompted by your operating system. Bridge typically runs as a background service (daemon).

If you detect anything unusual (unexpected prompts, unknown publishers), stop the installation and contact Trezor Support via the official site.

Install and start Bridge

Installation steps differ slightly by operating system, but broadly the process is consistent:

• Run the downloaded installer. On Windows, the installer will register a service. On macOS and Linux, follow the OS-specific package instructions.
• After installation, Bridge should start automatically and place an icon in the system tray or menu bar. If it doesn’t, start it manually from the applications menu.
• Open a supported web3-enabled site (for example, the Trezor web Suite or a dApp that supports Trezor). The site should detect Bridge and prompt you to connect your device.

If a browser cannot detect Bridge, try restarting the browser, ensuring Bridge is running, and checking firewall settings that might block localhost ports.

How Bridge communicates with web apps

Bridge exposes a localhost HTTP/WebSocket API. Web pages use an official client library (such as Trezor Connect) which handles communication with Bridge. When a web app requests an operation (like retrieving an address or signing a transaction), the library sends the request to Bridge, which forwards it to the connected Trezor device. The device asks for explicit user confirmation on-device; only after the user approves will the device perform signing or reveal requested public data.

Key mechanisms include:

• Origin validation: Bridge and the client library validate the requesting website’s origin to prevent cross-site exploitation.
• User confirmation: All sensitive operations require manual approval on the Trezor device screen.
• Localhost binding: Bridge binds to a localhost-only address to avoid exposing the service beyond the machine.

Using Bridge with web3 apps — a typical flow

1. Open a compatible web wallet or dApp and choose "Connect Hardware Wallet" or a Trezor-specific option.
2. The web app triggers the Trezor Connect/Bridge handshake. Bridge notifies the browser when the Trezor device is available.
3. Plug in and unlock your Trezor device. If required, open the blockchain-specific app on the device (e.g., Ethereum).
4. Approve the connection and any subsequent signing requests on the Trezor device. The web app receives only the requested public data or signatures — private keys never leave the hardware.

Always verify transaction details on the device screen — the hardware display is the only trusted source for the exact destination address, amount, and data you are signing.

Security model and best practices

Trezor Bridge is designed to minimize risk while enabling convenient web interactions. Follow these best practices to maintain security:

• Install Bridge only from the official Trezor domain (trezor.io).
• Keep Bridge and Trezor firmware up to date through official channels. Updates patch vulnerabilities and improve compatibility.
• Verify the origin (URL) of any web app before connecting. Phishing sites can pose as legitimate dApps to try to trick users.
• Never enter your recovery seed into a website or browser — only into the device during official device recovery flows.
• Prefer hardware security keys (U2F/WebAuthn) or an authenticator for account-level web logins where supported.

Bridge itself doesn't access keys; however a compromised system or malicious browser code could attempt to misuse Bridge. Rely on the device’s on-screen confirmations to detect unauthorized operations.

Permissions, privacy, and what Bridge sees

Bridge acts as a middleman and does not collect personal data about your keys. It facilitates local communication and will log minimal diagnostic information for functionality. However, when you interact with web apps, those apps may request permissions to view public addresses or request signatures. Be conservative with permissions and only grant them to trusted services.

• Bridge communicates over localhost and typically does not cross the network boundary.
• The web app you connect to may record addresses and transaction metadata — assume activity is visible to that service.
• For privacy-sensitive workflows, consider using separate browser profiles or temporary sessions, and clear caches after sensitive operations.

Developer guidance — integrating with Bridge

If you build web3 applications or wallet integrations that support Trezor, follow these principles:

• Use the official Trezor Connect library rather than crafting direct Bridge calls. The library handles origin checks and compatibility nuances.
• Request only necessary permissions and explain clearly to users why you need them.
• Implement graceful error handling for device disconnection, user cancellation, and Bridge absence. Detect Bridge and show helpful prompts to install it if missing.
• Test across browsers and OS versions — differences in USB stacks or firewall configurations can impact behavior.
• Keep dependencies up to date and regularly audit code that interacts with Bridge to reduce supply-chain risks.

Developers should consult Trezor’s official developer docs and GitHub repositories for API details, examples, and security guidance.

Troubleshooting common Bridge issues

Bridge not detected by browser

• Ensure Bridge is running — look for its icon in the system tray (Windows) or menu bar (macOS).
• Restart the browser and, if necessary, the Bridge service. Some browsers cache device availability.
• Check firewall or security software is not blocking localhost ports used by Bridge.
• Reinstall Bridge from the official site if detection fails repeatedly.

Site cannot communicate with my device

• Make sure your Trezor device is connected and unlocked (enter PIN on-device).
• Open the relevant blockchain app on the device if prompted (e.g., Ethereum app for ETH transactions).
• Confirm any prompts on-device — otherwise signatures won’t be produced.

Origin or permission errors

If you receive warnings about origin mismatch or unauthorized requests, verify the web page domain and use a bookmarked or official link. If a site requests unfamiliar permissions, cancel and investigate before proceeding.

Updates and maintenance

Regularly update Bridge and device firmware to stay protected against vulnerabilities and to support new features. Follow these steps:

1. When Bridge indicates an update is available, download and install the update from the official site or through the Bridge prompt.
2. Use Trezor Suite or official channels to update device firmware — firmware updates require on-device confirmation.
3. For developers, track release notes for breaking changes affecting integrations.

Avoid installing Bridge or firmware from untrusted sources. If an update seems suspicious, verify publication on the official Trezor domain.