Key takeaways
A seed phrase is not a password. It is the wallet. Anyone who reads your words can move your funds from anywhere in the world, and no company, developer or support team can reverse that.
The safest backup is offline, physically durable, and stored in more than one location. Paper works for small amounts, stamped metal survives fire and water, and screenshots or cloud notes are the most common way people get drained.
Most losses come from human error and social engineering, not broken cryptography. Verify your backup before you fund the wallet, and treat every request for your words as a scam.
How to Write Down and Store a Seed Phrase Safely
When you set up a self-custody wallet, the software shows you a list of 12 or 24 words and tells you to write them down. That moment is the single most important security decision in self-custody, and most people rush it. This guide explains what those words are, how to record them correctly, where to keep them, and which shortcuts create real risk.
What a seed phrase actually is
A seed phrase, also called a recovery phrase or wallet backup, is a human readable encoding of a random number. It follows a standard called BIP39, published in 2013 and now used by most major wallets across Bitcoin, Ethereum and other chains.
The process works in a fixed order. Your wallet generates random data, either 128 bits for a 12 word phrase or 256 bits for a 24 word phrase. It adds a short checksum, splits the result into groups of 11 bits, and maps each group to one word from a fixed list of 2,048 words. That list is public and standardised, and no two words share the same first four letters, which makes transcription errors easier to catch.
The words are then run through a key stretching function to produce a master seed, and every private key and address in your wallet is derived from it. This is why the phrase matters more than the device. Lose the hardware wallet and you can buy another and restore. Lose or expose the phrase and the wallet is gone.
Guessing a phrase is not a realistic threat. A 12 word phrase carries roughly 128 bits of entropy, which is far beyond any brute force capability that exists or is expected to exist. The risk lives entirely in the physical and human layer.
Why the writing step is the weak link
Two failure modes account for almost all real world losses.
Loss. Chainalysis has estimated that several million bitcoin are permanently inaccessible, a large share of it tied to lost or destroyed backups. Faded ink, a house fire, a flooded basement, a discarded envelope during a house move.
Theft through social engineering. On 10 January 2026, a holder was persuaded by someone impersonating Trezor customer support to hand over a 12 word phrase, and roughly 282 million dollars in bitcoin and litecoin was moved within minutes. Investigators described it as pure social engineering, with no flaw in the wallet software. In February 2026, attackers escalated further by mailing physical letters with realistic branding to Trezor and Ledger owners, directing them to phishing sites that requested their recovery words. In August 2026, a fake Trezor page reached the top of Google’s sponsored search results and collected phrases from users who clicked it.
The lesson is consistent. The cryptography is not the target. You are.
Step by step: writing the phrase down correctly
Do it in private. No video calls, no smart speakers or cameras in view, no one looking over your shoulder.
Write directly from the device screen. Never copy the words into a text editor, password manager field, notes app, email draft or messaging app first.
Number every word. Order is part of the secret. Write 1 through 12 or 1 through 24 down the page.
Use clear block capitals. Handwriting that you can read today may be ambiguous to someone reading it under stress in ten years.
Watch the confusable pairs. Words like “trip” and “tribe”, or “cat” and “catch”, look similar when rushed. Because BIP39 words are unique in their first four letters, recording only the first four is technically valid, but full words are safer for a beginner.
Write the wallet type and word count on a separate note, for example “24 words, hardware wallet, standard BIP39”. Do not write the exchange name, balances, or “crypto” on the backup itself.
Check the phrase twice against the device before you leave the setup screen.
Never photograph it. Phone cameras sync to cloud storage by default, and cloud accounts are a routine target.
Choosing the material
Medium | Durability | Cost | Best for | Main weakness |
|---|---|---|---|---|
Paper or the card supplied with the wallet | Low | Free | Very small balances, short term | Fire, water, fading, accidental disposal |
Archival paper in a sealed bag | Low to medium | Low | Beginners on a budget | Still destroyed by fire |
Stamped stainless steel plate or washers | High | 20 to 100 USD | Most self-custody users | Poor stamping can be illegible |
Engraved metal | Medium to high | 20 to 80 USD | Users with an engraving tool | Surface engraving degrades faster than stamping in fire tests |
Encrypted digital file | Variable | Free | Advanced users only | Any device compromise exposes it |
Cloud storage, screenshots, email | Not recommended | Free | Nothing | Primary cause of remote theft |
Independent stress testing of metal backup devices, most notably the long running series by Jameson Lopp, has shown wide variation between products. Two findings are consistent: stamped or punched characters survive heat and corrosion better than shallow engraving, and thin plates or devices held together by small screws and loose tiles fail sooner than thick solid plates. A typical house fire reaches roughly 600 to 900 degrees Celsius, while quality stainless steel melts around 1,400 degrees Celsius, so the material is usually adequate if the construction is sound.
Where to store the backup
Storage is a trade-off between availability and exposure. Every extra copy reduces the chance of loss and increases the chance of theft.
Location | Protects against | Exposes you to |
|---|---|---|
Home safe, bolted down and fire rated | Casual theft, fire, water | Targeted burglary, coercion if known publicly |
A second private property, for example a relative’s home | House fire, local flooding | Trust and access disputes |
Bank safe deposit box | Fire, home burglary | Access hours, jurisdiction risk, inheritance friction |
Buried or hidden on your own property | Casual searches | Corrosion, forgetting the location, construction work |
Office desk or shared space | Nothing meaningful | Colleagues, cleaners, building access |
A practical baseline for most people is two copies in two separate buildings, at least one of them in metal, with a written note of where the second copy is held kept somewhere trusted.
Copies, redundancy and the 3-2-1 idea
Traditional data backup uses a 3-2-1 rule: three copies, on two types of media, with one stored offsite. Applied to a seed phrase, that means one metal backup at home, one metal or paper copy in a second location, and no digital copy at all. Three copies is the upper limit for most individuals. Beyond that, the number of places a thief could find your words grows faster than the protection you gain.
Splitting a seed phrase: what works and what does not
Splitting sounds appealing and is frequently done badly.
Method | How it works | Suitable for |
|---|---|---|
Naive splitting (writing half the words in two places) | Not a real cryptographic scheme. A partial phrase leaks entropy and can meaningfully reduce brute force difficulty. Losing one half loses everything. | Not recommended |
Shamir Secret Sharing (SLIP39) | Splits the secret into shares with a threshold, for example any 2 of 3 recovers the wallet. Below the threshold, a share reveals nothing. | Intermediate users on supporting wallets such as Trezor or Keystone |
Multi-signature | Multiple independent keys, with a threshold required to sign each transaction. Keys are never combined in one place. | Larger holdings, shared or institutional custody |
The important distinction: Shamir protects the backup and reconstructs the full secret on one device at recovery time. Multisig protects the spending process, and the complete key set never exists in a single location. SLIP39 uses a different word list and is not interchangeable with BIP39.
The optional passphrase, sometimes called the 25th word
BIP39 supports an extra user-chosen passphrase that is combined with the words to produce a different wallet. Someone who finds your 24 words but not the passphrase cannot access the funds. The trade-off is severe: a forgotten or mistyped passphrase is unrecoverable, and there is no checksum to warn you. Treat it as an intermediate technique, back it up separately from the words, and test recovery before relying on it.
Verify before you fund
Do this on day one, with an empty or nearly empty wallet.
Wipe the hardware wallet and restore it from your written backup, or use the manufacturer’s built-in backup check feature.
Confirm that the restored wallet shows the same receiving address as before.
If you use a passphrase, verify the passphrase-protected account as well, not just the base wallet.
Send a small test amount, then confirm you can spend it after restoring.
An unverified backup is an assumption, not a backup.
Common mistakes
Mistake | Why it fails |
|---|---|
Storing a photo or screenshot | Syncs to the cloud automatically and is exposed by any account breach |
Typing it into a “wallet validation” or “recovery” site | No legitimate service ever needs your words |
Buying a hardware wallet from a marketplace reseller | Pre-filled recovery sheets are a known scam pattern |
Keeping the only copy in one building | A single fire ends the wallet |
Splitting 12 words into two halves | Reduces security and increases the chance of total loss |
Telling people you hold crypto | Physical coercion attacks target known holders |
Leaving no instructions for heirs | Funds are lost even though the backup survives |
Planning for inheritance
A backup that only you can find is a backup that dies with you. Keep a separate, non-secret document that explains that a crypto wallet exists, which hardware or software is used, and who to contact for help. Store the location instructions with a lawyer or in a sealed letter, and keep the actual words apart from that document. The goal is that an executor knows something exists and where to look, without any single person holding both the location and the secret.
Frequently asked questions
Is 12 words less safe than 24 words? Both are secure against brute force in practice. A 12 word phrase has 128 bits of entropy and a 24 word phrase has 256 bits. Neither is realistically guessable. The choice matters far less than how you store the backup.
Can I store my seed phrase in a password manager? It reduces friction but introduces a large single point of failure, because it places the words on internet-connected devices behind one master password. For meaningful balances, an offline physical backup is the standard practice.
What happens if one word is smudged or missing? Recovery is sometimes possible because the checksum narrows the options, but the process is technical and error prone. Do not rely on it. If a backup becomes damaged, create a fresh backup, or generate a new wallet and move the funds if you believe the old phrase may have been seen.
Should I memorise my seed phrase? Memory alone is not a backup. It can support a passphrase, but human recall degrades and cannot be recovered by anyone else. Always keep a physical record.
Does a hardware wallet stop seed phrase theft? It protects the key from malware and remote attacks, but it cannot stop you from typing the words into a phishing site. The device removes technical risk, not human risk.
My wallet is compromised. What now? Assume the phrase is burned. Set up a new wallet with a newly generated phrase on a clean device and move any remaining funds immediately. Do not reuse the old phrase, and ignore anyone offering paid recovery services.
Related terms
BIP39 The standard defining how random entropy becomes a 12 or 24 word recovery phrase.
SLIP39 A Shamir Secret Sharing standard that splits a wallet backup into threshold shares.
Cold Wallet A cold wallet is a crypto wallet that stores private keys offline, making it much harder for hackers or malware to access them through the internet.
Multi-signature (multisig) A setup requiring several independent keys to authorise a transaction.
Social engineering Manipulating a person into revealing secrets, rather than attacking software.
Sources
Trezor, “What is BIP39? How 12 and 24-word wallet backups work” - trezor.io/learn
Coldcard, “What is a Bitcoin Seed Phrase?” - coldcard.com/learn
Jameson Lopp, “Metal Bitcoin Seed Storage Stress Tests” (Rounds III and VI) - blog.lopp.net
ZachXBT and ZeroShadow reporting on the 10 January 2026 Trezor impersonation theft, covered by The Block, Yahoo Finance and CCN
CCN, “Ledger and Trezor Users Security Alert: Seed Phrase Phishing Attempts Sent by Mail”, February 2026
Crypto Briefing, “Phishing site impersonates Trezor in top Google search result”, August 2026
SatoshiLabs, SLIP-0039 specification - github.com/satoshilabs/slips
FBI Internet Crime Complaint Center (IC3), guidance for cryptocurrency scam victims
Chainalysis estimates on permanently lost bitcoin, widely reported
Disclaimer: This content is for educational and informational purposes only and is not financial, investment, legal, or tax advice. Nothing here is a recommendation to buy or sell any asset or use any platform. Do your own research and manage your risk. Cryptocurrency involves risk, including the permanent loss of funds.
Read More
How to Choose a Crypto Wallet for Beginners
The Complete Beginner's Guide to Self-Custody: How to Hold Your Own Crypto Safely
Best Crypto Cards in 2025: Top 10 Reviewed, Compared, and Explained
