Seed Phrase Security — Taking Custody

Film · Not a password. The key to your money. · 1:35

Block ———

A short film for module 3 of Self-Custody: fiat currency in a bank, behind a password the bank resets; the seed phrase, 12 or 24 words from BIP 39's list of 2,048, shown only as an example never to use; why no one guesses it (128 random bits, a number 39 digits long); never on a screen or in a photograph; written by hand, stamped in metal, copies kept apart; never shared; your own randomness from dice, and a passphrase that must be backed up too; multisig, where one lost or leaked seed alone does not cost your savings, with its own risks and the wallet descriptor to back up; and fiat currency against bitcoin.

Read the film, with its sources

Module 3 of 4Seed phrase security. Your seed phrase is the most important thing you will ever secure. What is it, and how do you guard it?
In a bankWith fiat currency in a bank, a password only opens an account the bank keeps. Forget it, and the bank resets it. The money is the bank’s to hold; what you hold is a claim on it.
The seed phraseBitcoin works differently. When you set up a wallet, it gives you a seed phrase: 12 or 24 words from a standard list of 2,048 (BIP 39). It is the master backup from which the wallet’s keys are derived, so for a single-key wallet it rebuilds everything on its own. Whoever has the words has the coins. The words on screen are an example that controls nothing: never use them.BIP 39, Mnemonic code for generating deterministic keys (Bitcoin Improvement Proposals, status Deployed)
The oddsEach word is one of 2,048, so it carries 11 bits: BIP 39 splits the bits into groups of 11, “each encoding a number from 0-2047”. Twelve words make 132 bits, 128 of randomness and a 4-bit checksum; twenty-four make 264, 256 and 8. 128 random bits allow 340,282,366,920,938,463,463,374,607,431,768,211,456 possibilities, a number 39 digits long: no one finds a phrase by guessing. The real danger is someone finding a copy.BIP 39, Mnemonic code for generating deterministic keys (Bitcoin Improvement Proposals, status Deployed), Generating the mnemonic
Never on a screenKeep the words off anything connected. Never type them into a phone, a computer or a website; never keep them in a notes app, a password manager or a cloud service; never photograph them. Any digital copy can be reached remotely, by malware or by anyone who gets into your account.
Written downWrite the words on paper, by hand, as soon as the wallet shows them. For savings meant to last years, stamp or engrave them into metal, which survives fire and flood far better than paper. Keep at least two copies in separate places, each one secure: a single copy in a single place is a single point of failure, and if every copy is lost, so are the coins.
Never share itNever share the words, with anyone. No genuine support person, wallet maker or developer will ever ask for your seed phrase; anyone who does is trying to steal your coins.
Your own randomnessBetter still, make the randomness yourself, so it never depends on anyone else’s: at least 50 fair dice rolls, each independent and done in private (50 rolls give about 129 bits; 128 is the bar). You can also add a passphrase, sometimes called the twenty-fifth word. BIP 39 puts it simply: “A user may decide to protect their mnemonic with a passphrase.” Make it strong and unique, never a PIN. The same words with a different passphrase make a different wallet, so the words alone are not enough to take the coins. But the passphrase must be backed up too: forget it, and the coins are lost as surely as if you had lost the words.BIP 39, Mnemonic code for generating deterministic keys (Bitcoin Improvement Proposals, status Deployed), From mnemonic to seed
MultisigIn a multisig wallet, the next module, coins need several keys to move, say 2 of 3 (BIP 11), each key from its own seed, kept in its own place. One leaked seed alone can’t spend the coins, and one lost seed alone doesn’t lose them, so long as you still hold enough of the others.BIP 11, M-of-N Standard Transactions (Bitcoin Improvement Proposals, status Deployed)
Its own risksMultisig has risks of its own. Back up the wallet descriptor as well as the seeds: BIP 380 says of backups made of keys alone that “this backup solution is insufficient”, and three seeds without the descriptor will not recover the wallet. Fall below the threshold of keys and the coins are gone; there are more steps to get wrong, and it is harder for heirs. Practise recovery with small amounts first. If this is more than you will maintain, that is a legitimate answer, and it should change what you keep in cold storage.BIP 380, Output Script Descriptors General Operation (Bitcoin Improvement Proposals, status Deployed), Motivation
The contrastFiat currency in a bank is a claim on the bank, behind a password the bank can reset. A seed phrase is the coins themselves: no one to ask, and no one to reset it. Keeping it safe takes care, and that is the point: not your keys, not your coins.
The Bitcoin TransitionNot a password. The key to your money.

When you set up a new Bitcoin wallet — hardware or software — the device generates a seed phrase. This is typically 12 or 24 English words, drawn from a standardised list of 2,048 words (BIP-39). The seed phrase is a human-readable encoding of the master key from which all of your wallet's private keys are derived.

This means the seed phrase can fully reconstruct your wallet. If your hardware wallet is lost, destroyed, or stolen, the seed phrase is all you need to recover every address and every balance. It is the single point of recovery — and the single point of failure. In a multi-signature wallet, the last module in this course, no single seed carries that weight, but the seeds alone will not recover it either: the wallet descriptor must be backed up with them.

The Rules

Seed phrase security is not complicated, but it is absolute. There are no partial measures. Either the phrase is secure or it is not.

1. Write it down on a physical medium

Write the seed phrase on paper immediately when the wallet generates it. Do not type it into a computer. Do not take a photograph. Do not store it in a notes app, a password manager, or a cloud service. Any digital copy is a copy that can be remotely accessed by malware, by a compromised cloud provider, or by an attacker who gains access to your account.

2. Use a durable medium for long-term storage

Paper degrades. It burns. It dissolves in water. For savings you intend to hold for years or decades, stamp or engrave the seed phrase into metal. Stainless steel backup plates, which you stamp or engrave yourself, are made for this purpose; we do not name brands. A stainless steel plate with stamped letters will survive house fires, floods, and the ordinary entropy of time.

3. Store it in a secure location

The seed phrase should be stored somewhere that is physically secure and that you control. A home safe is a reasonable first step. A safety deposit box at a bank adds geographic separation but introduces a third party. The right choice depends on the amount being secured and your threat model.

4. Create a backup in a separate location

A single copy of the seed phrase in a single location is a single point of failure. If that location is destroyed — fire, flood, theft — the funds are gone. Create at least one backup, stored in a different physical location. Both copies should be equally secure.

No legitimate service, support agent, wallet manufacturer, or Bitcoin developer will ever ask for your seed phrase. Anyone who does is attempting to steal your funds. There are no exceptions to this rule.

The Passphrase Option (25th Word)

Most hardware wallets support an optional passphrase — sometimes called the "25th word" — that is added to the seed phrase during key derivation. The passphrase creates an entirely different set of keys and addresses from the same seed phrase. Without the passphrase, the seed phrase alone produces a different (empty) wallet.

This provides two benefits. First, it adds a layer of protection: an attacker who obtains the seed phrase but not the passphrase cannot access the funds. Second, it enables plausible deniability: the base wallet (without passphrase) can hold a small amount, while the real funds are in the passphrase-protected wallet.

The trade-off is that the passphrase must also be backed up. If you lose both the seed phrase and the passphrase, the funds are unrecoverable. If you remember the passphrase but lose the seed, the passphrase alone is useless.

What You Are Protecting

The seed phrase is not a password. A password protects access to an account held by someone else. The seed phrase is the account. It is the mathematical root from which your entire Bitcoin holdings derive. Losing it is not "forgetting your login." It is the permanent, irrecoverable loss of the funds.

Treat it accordingly. The time you spend securing it is proportional to what it protects.

← Previous

Wallet Types

Multi-Sig Basics