In short A wallet whose keys never touch the internet, typically a hardware device.
Transactions are signed on the device and only the signature leaves it. Buy hardware wallets from the manufacturer, never second-hand, and keep the seed phrase offline.