Hardware wallets are physical devices which securely generate and store Private/Public key-pairs and by extension, addresses. These devices are designed with a component that handles the secure generation of keys, and is never exposed to an internet connection. Signing of transactions happens inside this sequestered portion of the device, and only the resulting outcome, the signature, is broadcast to the network.