How to protect a wallet's seed phrase

When you create a crypto wallet that stays under your control, the app or device shows a list of words and asks you to write them down. This list is usually called a seed phrase, recovery phrase or mnemonic. It is the most important item in the entire wallet.

This article explains what the phrase represents, the two risks it faces (theft and loss) and which precautions reduce each of them. There is no brand, product or asset recommendation here.

What the seed phrase is

Most wallets today follow the BIP 39 standard, a Bitcoin Improvement Proposal that defines how to turn a random number into readable words (BIP 39). According to the specification:

• The phrase has 12 to 24 words, depending on the amount of randomness used (128 to 256 bits).
• The words come from a fixed list of 2,048 terms. Among the desired qualities for this list, the document mentions that each word can be identified by its first four letters.
• Part of the phrase works as a check (checksum). That is why a wrong word is usually detected by the wallet.
• From the phrase, a standardized calculation generates the binary seed from which all the wallet’s private keys are derived.

The private key is the secret number that authorizes moving the funds. The article what Bitcoin is and how it works explains the relationship between key, address and blockchain. The central point for security is this: since all keys derive from the phrase, whoever has the phrase can recreate the entire wallet on any device, without needing your phone or your password.

Why it is worth as much as the funds

The funds are not stored on the phone or the physical device. They are recorded on the blockchain. The phrase is what allows them to be moved. Two consequences follow.

Theft. If someone else gets the phrase, they can transfer everything to another address. Ethereum.org’s security guide reminds readers that a sent transaction is irreversible (ethereum.org, Security). There are no chargebacks.

Loss. If the device breaks and you do not have the phrase, the funds become inaccessible. Bitcoin.org notes that password recovery options are very limited and that bitcoins can be lost forever if no one knows where the wallets and passwords are (Bitcoin.org, Secure your wallet).

The two risks pull in opposite directions. More copies reduce the risk of loss and increase the risk of theft. Hiding too much reduces the risk of theft and increases the risk of loss. Protecting the phrase means finding a balance between the two.

Rule number one: the phrase never goes digital

The phrase should not exist anywhere connected to the internet. That includes:

• a photo or screenshot;
• a notes app, text document or spreadsheet;
• an email sent to yourself;
• a message in a chat app, even to someone you trust;
• cloud storage.

Ethereum.org explains why: screenshots can be automatically synced to a cloud provider, and obtaining private keys from the cloud is a common attack vector. A stolen phone, a hacked email account or a computer with spyware is enough to expose a digital copy.

In the editorial team’s assessment, password managers are also a risky place for the phrase of a wallet holding significant amounts. They concentrate many secrets in a single account and, if that account is compromised, the phrase goes with it.

How to store the phrase in the physical world

Paper, with care

Write the words by hand, in the exact order, legibly. Number each one. Check the spelling against the wallet screen before moving on. Do not use a printer: it may keep a copy in memory and is usually connected to the network.

Durable material

Bitcoin.org recommends keeping copies in more than one physical location and using durable storage media. Paper is lost to water, fire and time. There are metal plates made for engraving the words. Since the words on the list are designed to be recognized by their first four letters, some people engrave only those letters. Before doing so, check against the list your wallet uses that no abbreviation is ambiguous.

More than one location

A single copy kept at home is exposed to fire, flooding or moving house. Two or three copies in different locations reduce that risk. Each copy, however, is one more point through which the phrase can leak. Choose locations where you control who has access.

Discretion

Do not label the paper as “crypto wallet phrase”. Do not mention on social media that you own cryptocurrency or how much. CERT.br, Brazil’s computer security incident response center, points out that scammers use what you post to make their scams more convincing (CERT.br, Golpes: Não se Deixe Enganar).

The phrase is typed in only one place

There is only one moment when it is legitimate to type the phrase: when you decide to restore the wallet, in a wallet app or device you installed yourself from the official source. Outside of that, no request for the phrase is legitimate.

Ethereum.org is blunt: never share your recovery phrase or private keys, for any reason. It also notes that legitimate project teams do not contact users through private, unofficial channels, and that you should never allow remote access to your computer.

Fake requests come in several disguises:

• Fake support. Someone poses as a wallet or exchange support agent and asks for the phrase to “verify”, “sync” or “unlock” the account.
• Rewards and airdrops. An FBI alert from June 2025 described tokens sent for free to wallets, with a link in the transaction’s memo field. The link led to a site that asked for, among other data, the seed phrase, which was then used to steal the funds (FBI IC3, PSA I-060325).
• Imitation sites and apps. Pages that look identical to a well-known wallet and ask for the phrase to “import” or “update”.

CERT.br sums up the right attitude toward any such request: be suspicious, get informed and verify. When money or personal data is involved, its guide recommends assuming it is a scam until proven otherwise. In the case of the seed phrase, there is nothing to prove: the request itself is the warning sign.

The article phishing in crypto wallets details these and other scams.

Extra layers of protection

Additional password (passphrase)

BIP 39 provides for an optional password, sometimes called the “25th word”, which goes into the seed calculation together with the words. With it, someone who finds only the phrase cannot reach your funds.

There is an important detail in the specification: any password generates a valid wallet. If you type the password with a typo, the wallet opens normally, only empty, and does not warn you that anything is wrong. This adds protection but creates a new risk of loss. If you use this feature, the password needs its own backup, stored in a different place from the phrase.

Multisignature

Bitcoin.org suggests multisignature wallets, which require more than one independent approval to spend. A single compromised device or location is not enough for a thief. In exchange, setup is more complex and each part needs its own backup.

Offline wallet

For amounts you do not plan to move often, Bitcoin.org recommends offline storage. Ethereum.org notes that, in hardware wallets, the private key never touches the internet. This protects the key against spyware on your computer, but it does not protect the phrase written on paper. The physical precautions still apply.

Splitting the phrase into parts

Splitting the words across two pieces of paper kept in different places seems like a good idea but, in the editorial team’s assessment, it creates more problems than it solves: whoever finds one part is already halfway there, and losing one of the parts can mean losing everything. If the goal is to require more than one location to move the funds, multisignature does that in a planned way.

Think about who comes after you

Bitcoin.org reminds readers that funds can be lost forever if no one knows where the wallets and passwords are. Think about how a trusted person would get to the phrase if something happens to you, without leaving the phrase exposed in the meantime. Sealed instructions with a lawyer or a will are paths many people use. Inheritance rules vary and, for significant amounts, professional advice is worthwhile.

If you think the phrase has leaked

The phrase cannot be changed. It is the mathematical origin of all the keys in that wallet. If you suspect someone has seen, photographed or received it:

1. Create a new wallet, with a new phrase, generated on a device you consider secure.
2. Write down the new phrase following the precautions above.
3. Transfer the funds from the old wallet to the new one as soon as possible.
4. Do not use the old wallet again.

Be wary of anyone who later offers paid help to “recover” stolen funds. This is a common scam targeting people who have already been victims, as described in the phishing article cited above.

Key takeaways

• The seed phrase is the wallet. Whoever has it controls the funds, and there is no one to turn to in case of theft or loss.
• Store it only in the physical world, on durable material, in more than one location you control, with no eye-catching label.
• Type it only to restore an official wallet, on your own initiative. Any request for the phrase, from anyone, is a scam.
• An additional password and multisignature increase protection, but also complexity. Each extra layer needs its own backup.