Hardware wallet
A physical device that stores private keys in a secure chip and signs transactions without the key leaving it.
A hardware wallet protects the key from malware on the connected computer, which is the most common way self-custodied funds are stolen. It does not protect against approving a malicious transaction; the device signs whatever the user confirms. Buy directly from the manufacturer — resold devices can arrive with a pre-known seed.