Who holds the keys

There are two ways to hold XRP.

Custodial. An exchange or app holds the XRP for you, usually on an account it manages. You have a login, not keys. If you forget the password, the company can help. The company also controls the funds, and a service holding many people's funds is a bigger target.

Self-custody. You hold the secret, and no company sits between you and your funds. No one can rescue you either. Lose the secret and there are no recovery options.

A hardware wallet is a physical device that stores keys. It can stay disconnected from the internet when not in use.

Two common self-custody wallets for the XRPL are Xaman and Joey. The facts below come from their own sites.

Xaman

• Phone app for the XRP Ledger and the Xahau network.
• Keeps private keys on your device, behind a passcode or biometrics.
• New accounts use Secret Numbers. It can also import a family seed or a mnemonic.
• Xaman has no copy of your Secret Numbers and cannot recover them.
• Official support runs only through the Support xApp inside Xaman. Never through social media.
• Official domain: xaman.app and its subdomains, sometimes xumm.app.

Joey

• Apps for iPhone and Android, plus a browser extension for Chrome and other Chromium browsers.
• Offers self-custody or a social login through Web3Auth.
• Joey cannot recover your keys. Keep the recovery phrase backed up.
• Joey never asks for your recovery phrase, private key, PIN or password, and never sends the first message offering support.

Where the keys live.

Install safely. Joey says to download only from the App Store, Google Play or the Chrome Web Store, through links on joeywallet.xyz. It warns against search ads and links sent to you. Xaman warns that fake sites can differ from the real one by one letter. Check URLs character by character.

Before you rely on a backup. Xaman's test: start an account import with the paper secret, compare the r-address it shows with your account, then go back without pressing Confirm.

Exchanges. Moving XRP between an exchange and your own wallet is a normal Payment. Exchanges often use one address for many customers and ask for a destination tag to know whom to credit. See Destination tags.

Setup steps for either wallet are on the wallet page. Read Scams and signing first.