Setting Up Solflare on a New Device: Transfer Without Exposing Your Seed Phrase

A Solana user receives a new phone or needs to move from browser extension to mobile app and faces a practical dilemma: their SOL tokens, SPL-standard token holdings, and staked balances are tied to a wallet on the old device. The most direct solution—importing the seed phrase on a new device—carries real risk. Each time a recovery phrase is exposed to a new environment, the surface area for compromise expands. A compromised device, screenshot capture, clipboard history, or device backup could create a copy of that phrase in an unexpected location. The better question is whether a seed phrase transfer is necessary at all, or whether alternative approaches can accomplish the same result with lower operational security exposure.

Solflare is designed as a non-custodial wallet where you retain control of your private keys, but that control is only meaningful if the process of maintaining it does not accidentally expose those keys. Moving between devices—whether from an older phone to a newer one, from a browser extension to a mobile app, or from a standard phone to a hardware-backed device—requires a deliberate strategy. The wallet supports multiple paths for account recovery, hardware wallet integration, and wallet-to-wallet export features that can reduce the need to copy a seed phrase into an insecure channel. Understanding which method applies to each migration scenario is the difference between a secure transition and one that creates unnecessary risk.

Why every seed phrase exposure matters

A 12 or 24-word seed phrase is the master key to every account, balance, and transaction history derived from that phrase. In Solflare’s case, the phrase generates a keypair that controls SOL, SPL tokens, NFTs, and staking positions. Writing it down in one place (ideally offline) is secure practice. Typing it into a new device screen, pasting it from clipboard history, storing it in a cloud note, or reading it aloud to transcribe are each moments where the phrase moves through a medium it was never intended to pass through.

Device security at the moment of seed phrase entry is worse than it may appear. A device running the latest operating system can still have screen-capture malware, keyboard loggers installed through seemingly legitimate apps, or cloud-sync enabled by default. Pasting from clipboard is particularly dangerous because clipboard managers, cloud services, and backup utilities often retain the content. If a device is later sold, stolen, reset, or accessed by another person, that clipboard history may still be recoverable. The safest assumption is that every time you expose a seed phrase to a new device, that device becomes a potential attack vector for that phrase.

For users migrating SOL balances and staking rewards between devices, this creates a genuine tension. The traditional recovery approach—writing down the phrase on the old device, then typing it into the new one—reduces custody risk (no third party holds your funds) but increases exposure risk (the phrase moves through a new environment). Solflare’s design offers several alternatives that can reduce that tension, but they require understanding which tool is appropriate for each situation.

Method 1: Import via private key instead of seed phrase

Solflare allows account import using a private key, which is derived from the seed phrase but is not the phrase itself. This is a narrower exposure: a private key controls one account, while a seed phrase can regenerate every account that was ever created from it. For a user migrating a single account to a new device, importing via private key means the new device never needs to hold the master seed phrase.

The operational sequence is: on the old device, export the private key for the account you wish to migrate. Most wallets (including Solflare) provide this option in settings or account menus, usually protected by a password prompt. Copy that key to a secure medium—ideally written down or transferred directly without using cloud services or email. On the new device, open Solflare and select the import-account option, then paste or enter the private key. The new device now controls that account without holding the seed phrase.

The trade-off is important. If the private key is ever compromised, an attacker can drain that account. But the attacker cannot regenerate other accounts from the same seed phrase, and they cannot take your staking positions or other holdings created under different paths. Private key import is therefore strongest when you are migrating a single account or a small subset of accounts, and when you can control the transfer method carefully.

This method also avoids the recovery-phrase problem entirely: if the new device is later compromised, the damage is bounded to accounts imported using that key, not to every account ever derived from your seed phrase. For this reason, many security practices recommend keeping a seed phrase offline and using private keys for day-to-day wallet operations.

Method 2: Hardware wallet connection without importing a phrase

If you have migrated your Solflare account to a Ledger Nano S, Keystone, or other hardware wallet, you may not need to import a seed phrase to the new device at all. Instead, you can connect Solflare on the new device to the same hardware wallet, which will restore access to the same accounts without ever exposing the seed phrase to the new phone or browser.

The process is: on the new device, download and install Solflare. During setup, select the option to connect an external wallet or hardware device rather than creating or importing a local account. Then connect your Ledger or Keystone using the appropriate cable or Bluetooth, and approve the connection on the hardware device itself. The new Solflare installation will now control the same accounts that were on the old device, because those accounts are derived from the seed phrase stored on the hardware wallet, not on your phone.

This approach offers several advantages. The seed phrase never leaves the hardware device, so a compromised phone cannot expose it. The hardware wallet remains the single point of trust, and you can add Solflare to as many devices as you wish without additional exposure. Transactions still require approval on the hardware device, which prevents malware on your phone from moving funds without your knowledge. For users who already have a hardware wallet or are willing to obtain one, this is the strongest method for multi-device access.

The limitation is practical: you must have the hardware wallet with you when setting up the new device. If the hardware wallet is in storage or another location, this method cannot be used immediately. In that case, a temporary private key import (with the private key later deleted from the new device and recreated on the hardware wallet) can bridge the gap.

Method 3: Careful seed phrase transfer to a single trusted device

If neither private key import nor hardware wallet connection is feasible, a seed phrase transfer becomes necessary. This should be treated as a high-risk procedure and should happen only when the new device is known to be secure and the transfer method is controlled carefully. The goal is to minimize the number of intermediaries and the amount of time the phrase is exposed.

The procedure is: on the old device, have the seed phrase written or stored only in a secure offline location. Do not retrieve it from cloud backup, email, or notes. If you cannot remember the phrase and must recover it, use the official solflare wallet on the old device to display the phrase one final time, in a secure setting (alone, with the phone screen facing you only, in a location without cameras or observers). Write the phrase on paper or another offline medium by hand.

Next, prepare the new device: ensure it has the latest operating system updates, unnecessary apps uninstalled, and no shared accounts with other users. Install the Solflare app directly from the official app store (Apple App Store for iOS, Google Play for Android) rather than from an alternative source. Do not use a browser extension on a freshly set-up computer; use a mobile device instead, as it is more resistant to screen-capture and clipboard-logging malware.

Open Solflare on the new device and select the option to import an existing account using a seed phrase. Read the phrase from your handwritten copy (never from a screenshot, text message, or digital file) and enter it directly into the wallet. Do not type it into a notes app first and copy from there; type directly into the wallet application. Once import is complete, verify that the account address matches what you recorded on the old device, and confirm that your SOL balance and token holdings are visible.

After verification, delete the Solflare app from the old device (which removes the local account but does not affect the blockchain or other devices). Store your written seed phrase in a physical location you control, such as a safe or safety deposit box. Do not photograph it or store a copy anywhere digital. If you later need to access the account again, you now have a clear record of where the phrase is stored and can retrieve it from that single location.

Handling staking balances and reward recovery

Solana staking introduces an additional consideration: your SOL tokens and staking rewards are on-chain, but the Solflare interface on each device simply displays them. Migrating a device does not affect your staked balance, because the stake account is controlled by your wallet address on the Solana blockchain, not by the app on your phone.

When you import your account on a new device, the staking interface should immediately show your current stake, any pending rewards, and available unstaking options. If this information does not appear, it may be because the app is still syncing with the Solana network. Allow a few minutes for synchronization to complete; you can check by refreshing the app or checking your account directly on a Solana blockchain explorer using your wallet address.

A common misconception is that staking is tied to a particular device. It is not. Your stakes are tied to your wallet address, which is derived from your seed phrase (or hardware wallet). As long as you can access that account—whether on a new device, in a different app, or through a web-based wallet—you have full access to your staking positions. Rewards accrue on the blockchain, and you can claim them from any device or interface that controls your account.

If you have delegated your stake to a validator and want to migrate devices, there is no action necessary. The delegation is recorded on-chain and remains in effect. You can continue to monitor or adjust your stake from the new device using Solflare’s staking tools. If you want to change validators during your migration, you can do so by unstaking from the old validator (which takes one epoch to process) and then delegating to a new one from the new device, but this is a choice, not a requirement.

Securing setup before the migration

Before beginning any migration, take three preparatory steps on your current device. First, verify the exact address of your Solflare account. You can do this by viewing your wallet address in the app settings and writing it down. Second, take a screenshot of your current balance and any token holdings (not the seed phrase, just the asset list and amounts). Third, note the validator you are currently staking with, if applicable, and the current unstaked balance.

These reference points serve as a final verification step. After you complete the migration and import on the new device, you can confirm that the address is identical, that the balances match, and that your staking validator is unchanged. This verification prevents the most common mistake: importing into a different account by accident, or misreading the seed phrase and creating a new account that looks empty.

You should also prepare your backup medium before beginning. If you are writing a seed phrase on paper, use archival-grade paper and pen in a secure location. If you are using a physical cold-storage device, set it up and test it on a small amount before migrating your full balance. The migration itself should happen on a day when you can complete it without rushing, and when you are alert and can verify each step carefully.

Post-migration verification and cleanup

Once the account is imported and visible on the new device with correct balances and addresses, perform a final verification. Send a small amount of SOL (0.01 SOL or less) from the new device to a known address, such as an exchange account you control or a separate Solflare account. Confirm that the transaction appears on the Solana blockchain using a block explorer (Solscan or Solanabeach both work well). This confirms that the account is fully functional and that you can send funds.

Next, on the old device, delete the Solflare app. This removes the cached account data and the app itself but does not affect the blockchain or your funds. You still control the account from the new device, and the seed phrase (stored offline) remains the backup recovery method. Deleting the app from the old device reduces the risk that it could be compromised or accessed by someone else later.

For the final step, change any passwords or recovery methods you may use. If your Solflare setup included a password to encrypt the local wallet file or to protect sensitive settings, verify that you remember it. Consider whether you want to update security settings on any services that may be connected to your Solflare account (such as exchange accounts where you might deposit SOL or withdraw funds).

Choosing a solflare download source and avoiding compromise during setup

The entire migration can be compromised if the new device is set up from a fraudulent or modified copy of Solflare. Always download Solflare from official sources only: the Apple App Store for iOS, Google Play for Android, or the official Chrome Web Store for the browser extension. Do not install from third-party app stores, APK files found in emails or forums, or side-loaded applications.

Verify the publisher: on iOS, the app should show “Dokia Capital” as the developer. On Android, check that the package name is exactly “com.solflare.mobile”. On Chrome, verify that the extension ID matches official documentation. Fraudulent copies often have slightly different names (“Solflare Wallet” versus “SolFlare” or “Solflare Pro”) or unverified publishers.

Before entering any seed phrase or private key, test the app in a minimal way: open it, verify the interface looks correct, and check that it connects to the Solana network (you can see this in any message that appears about network status). Only after this basic verification should you proceed with the import process. This small delay can catch many obvious fake apps before you expose sensitive information.