How to back up your seed phrase (and what never to do)

Your seed phrase is the one thing that can bring your bitcoin back if a hardware wallet breaks, gets lost or gets stolen — and the one thing a thief needs to take it without the device. The questions bitcoiners keep asking are practical: can I keep a photo of it? Is a password manager okay? Paper or metal? 12 or 24 words? Should I add a passphrase? Somebody asked me to “verify” it — is that real? This guide answers each of those, in order, with the standards and maker documentation linked so you can check every claim.

Short version: write it down by hand, in order, from your device’s screen; never make a digital copy; never type it into anything except your hardware wallet; check it on the device; keep it somewhere durable and private, away from the device.

What a seed phrase actually is

A seed phrase (also called a recovery phrase, mnemonic or, in Trezor’s current wording, a wallet backup) is a list of words that encodes the random number your wallet’s keys are derived from. The common standard is BIP39: the wallet generates 128 to 256 bits of randomness, adds a short checksum, and maps the result onto words from a fixed list of 2048 words. That gives 12, 15, 18, 21 or 24 words, with 12 words for 128 bits and 24 words for 256 bits (BIP39). BIP39 says the point is to let people write computer-made randomness down on paper; it is explicitly not meant for phrases people make up themselves (“brainwallets”).

Trezor’s guide puts the stakes plainly: the backup gives full access to the wallet, and while a stolen device is hard to use without the PIN, someone who steals the backup can spend your coins from a different device or wallet (Trezor). Your coins are on the blockchain, not in the device; the words are what prove they are yours.

A common worry on X is that the word list is public, so seeds must be guessable. The list is public by design (BIP39 English wordlist). Security comes from the randomness, not from a secret list: Trezor says a 12-word BIP39 backup carries 128-bit security, a 24-word one 256-bit, and that guessing a backup of any of its lengths would take longer than the age of the universe — as long as the words were truly random and generated by the device, not picked by a person (Trezor).

One exception worth knowing: some wallets do not use a seed phrase at all. Bitkey, for example, is a 2-of-3 multisig wallet (phone key, hardware key, and a key held on Bitkey’s servers) with its own recovery model instead of a seed phrase (Bitkey, Bitkey). This guide is about wallets that do give you words to back up.

What never to do

Most seed losses are not clever hacks. They are a copy in the wrong place, or the words typed into the wrong box. Trezor’s rules, which apply to any wallet that shows you a seed phrase:

• No digital copies. At all. Trezor lists screenshots, photographs, emails, Dropbox and even encrypted folders as things not to do, and says never to store the backup digitally because digital copies can be made without you noticing (Trezor, Trezor). A password manager, a notes app, a phone gallery synced to the cloud and a text to yourself are all digital copies.
• Never type it into a website, app or computer. Trezor’s rule is to never enter the backup anywhere unless your Trezor device itself prompts you, and warns that fake apps and websites try to trick people into typing their words (Trezor, Trezor). That includes importing your hardware wallet’s seed into a phone wallet “just to check the balance”: once the words have been on an internet-connected device, treat them as exposed.
• Ignore anyone who asks for it, including “support.” Trezor says it will never ask for your wallet backup, even when you are talking to its customer support, and that scammers pose as Trezor support on social media and chat forums (Trezor). The same goes for every wallet maker, exchange and “recovery service.”
• There is no such thing as a legitimate “seed verification” site. Any page, pop-up, airdrop claim or “wallet sync” tool that wants your words to verify, validate, unlock or upgrade a wallet is phishing. Trezor even tells people checking their backup format never to type the words into any app or website to do it (Trezor). The only safe place to check a backup is the hardware wallet’s own check feature, covered below.
• Don’t read it out loud or write it with a camera nearby. Trezor advises doing the backup alone, minding cameras and microphones on your phone and computer, and not reading the words aloud (Trezor).
• Don’t cut it in half. Storing words 1–12 in one place and 13–24 in another sounds clever, but Trezor points out that each half leaks usable information and narrows an attacker’s search; if you want a backup split across places, SLIP39 multi-share does it properly (Trezor).
• Don’t use a device that came with words already filled in. A new hardware wallet should ask you to create a wallet and show you a new backup. If a recovery sheet arrives pre-written, do not use it. The hardware wallets guide covers buying and setup.

How to write it down correctly

Expect to see the words only during setup — Trezor notes its devices reveal the backup only once, during the backup procedure (Trezor). Get it right the first time:

1. Do it alone, away from cameras, with the backup card that came with the device.
2. Copy every word from the device screen, in the exact order, and check spelling. Trezor says that if the words are lost or written incorrectly, the wallet cannot be recovered (Trezor).
3. Number the words. Order matters as much as the words do (Trezor).
4. Complete the device’s verification step when it asks you to pick specific words — it is there to catch copying mistakes (Trezor).

Handy detail: both word lists are designed so the first four letters identify each word unambiguously (BIP39, SLIP-0039). That is why many metal backups only have you stamp or punch four letters per word.

Paper vs metal

Paper works and costs nothing, but Trezor notes it is vulnerable to fire and flood, and mentions reports of backups lost to house fires, hurricanes and simply being thrown out (Trezor). Because a single 12- or 24-word backup is a single point of failure, Trezor says people using one benefit from engraving or punching it into metal (Trezor).

If you use Trezor’s own metal backup, pick the plate that matches your backup length. The Trezor Keep Metal 20-word is made for the 20-word SLIP39 single-share backup that current Trezor devices create by default, and the Trezor Keep Metal 24-word is made for 24-word BIP39 backups. Both are stainless steel plates where you punch the first letters of each word, and Trezor describes them as fire-, water- and impact-resistant (Trezor, Trezor). Trezor lists both at the same price, so choose by word count, not cost. Prices and availability may change. Check Trezor’s site for current pricing.

Honest downsides of metal: it costs money where paper is free, punching letters takes time and care (a wrong letter is a wrong backup), and it protects against fire and water, not against someone finding it. A metal plate is only as safe as where you keep it. Trezor also notes that with a SLIP39 multi-share backup, metal may add less, because losing one share is not fatal (Trezor). For product questions, go to Trezor Support. I’m not an official Trezor partner; the Keep Metal links above are affiliate links.

12, 20 or 24 words? BIP39 vs SLIP39 single-share

• BIP39, 12 or 24 words. The format most wallets understand, which makes it easy to restore with other wallets (Trezor). 12 words are 128-bit security; 24 words are 256-bit, which Trezor calls vastly more than needed and says exists to support the Model One’s recovery process (Trezor). If you already have a 12- or 24-word backup, Trezor says it remains secure and supported.
• SLIP39 single-share, 20 words. SLIP-0039 is SatoshiLabs’ standard for Shamir’s Secret Sharing of wallet backups. It uses a 1024-word list; a 128-bit secret becomes 20 words, and the last three words are a checksum that is guaranteed to detect errors in up to three words (SLIP-0039). A single-share backup is simply a 1-of-1 setup: one 20-word list that fully controls the wallet. It is the default on the Trezor Safe 3 (from June 2024), Safe 5 and Safe 7 (Trezor, Trezor). Trezor says the extra words hold metadata and the checksum, not extra security, so it is still 128-bit. On the newer format, words 3 and 4 both read “academic” (Trezor).
• SLIP39 multi-share. The same standard can split a backup into up to 16 shares with a threshold, such as any 2 of 3 or 3 of 5; fewer shares than the threshold reveal nothing about the secret (SLIP-0039, Trezor). A newer single-share backup can be upgraded to multi-share in Trezor Suite without moving funds — but the old single share stays valid until you destroy it (Trezor).

The trade-offs: BIP39 and SLIP39 are mostly not compatible with each other (SLIP-0039), and you can’t convert an existing BIP39 backup into SLIP39 — you would create a new wallet and move the funds (Trezor). SLIP39 is supported by fewer wallets than BIP39, though Trezor lists third-party wallets that support it, including Sparrow, Electrum and BlueWallet (Trezor, Trezor). Whichever you have, write down which format it is — a future you, or your family, will need to know.

Where to store it

Trezor frames the job as two things: the backup must be somewhere only you can access, and it must survive accidents (Trezor). Its guide walks through the usual options:

• A hidden home safe. One of the few ways to control who has access, but a visible safe attracts thieves, and it may not suit you if people can connect your bitcoin to your address (Trezor).
• A discreet, hard-to-reach spot on your property. Less secure than a hidden safe, and depends on your home’s layout (Trezor).
• Burying it. Often suggested, but Trezor lists real problems: damp, acidic ground degrades materials, you must control who can access the land, and you have to remember where it is (Trezor).

Two habits matter wherever it lives. Keep it apart from the hardware wallet, so one burglary or one fire doesn’t take both. And keep a low profile: Trezor notes that just being outspoken about owning bitcoin can make you a target, and recommends not talking about how much you hold (Trezor).

One copy or several? The theft trade-off

Every extra copy of a seed protects against losing it and adds one more place someone can find it. SLIP-0039 states the problem directly: redundant backups help, but when the backup is worth a lot, there is a real risk that whoever holds a copy runs off with it (SLIP-0039). Options, from simplest to most robust:

• One well-protected copy. Simple, but a single point of failure (Trezor).
• Two full copies in two places. Survives one fire or flood, but either location alone is enough to steal everything — so both need the same protection.
• SLIP39 multi-share. For example 2-of-3 shares at home, at a relative’s and somewhere else: one share can be lost or stolen without losing or exposing funds. Trezor recommends not overcomplicating it — 2-of-3 or 3-of-5 cover most needs — and checking on shares regularly, since you must always keep enough to meet the threshold (Trezor).
• Multisig. Several independent keys, each with its own backup in a different location, so one compromised location is not a disaster. Trezor notes it is more complex to set up than multi-share, but useful when several people share custody (Trezor).

Passphrases (the “25th word”): extra protection, extra risk

Both BIP39 and SLIP39 let you add an optional passphrase. Every passphrase produces a valid, different wallet, and there is deliberately no way for the wallet to tell you that a passphrase is “wrong” (BIP39, SLIP-0039). That design is what makes it useful — someone who finds your words still can’t reach the passphrase wallet, and SLIP-0039 describes using a decoy wallet under a different passphrase — and what makes it dangerous.

What Trezor says about the risks:

• The passphrase is not stored on the device or in Trezor Suite. Forget it and there is no recovery, reset or support ticket that can help (Trezor, Trezor).
• One wrong character, capital letter or extra space opens a different, empty wallet — passphrases are case-sensitive and every “incorrect” one creates a new hidden wallet (Trezor).
• A passphrase can’t be changed or removed; to change it you move the funds (Trezor).
• Write it down and keep it separate from both the seed backup and the device; consider an extra copy in another location (Trezor). Type it on the hardware wallet when you can, because anything typed on a computer or phone can be captured if that device is compromised (Trezor).

A passphrase also adds a second single point of failure (Trezor). Trezor suggests considering whether SLIP39 multi-share would meet your goals with fewer risks (Trezor). If you do use one, test it as described next before sending anything significant.

Test your backup safely

A backup you have never checked is a guess. The safe way to check it is your hardware wallet’s built-in check, where the words are entered on the device and compared with what it holds — not typed into a website. Trezor calls this Check backup (a dry-run recovery): the device compares the words you enter with the backup in its storage without saving anything new, and shows on its screen whether they match (Trezor, Trezor). Trezor recommends checking before you wipe or reset the device and before every firmware update (Trezor). Other makers have their own versions; follow their official guide for your model.

• If the check fails: try again in case you picked a wrong word. If you still can’t enter a correct backup, Trezor says to move your funds to a wallet with a new backup as soon as possible (Trezor).
• Multi-share: a check only tests the threshold number of shares you enter; test the others in separate checks (Trezor).
• Passphrase wallets: Trezor’s test is to create the passphrase wallet, send a small amount, close it, reopen it by entering the passphrase from your written copy, and confirm the funds and the first receive address match (Trezor, Trezor).

If your seed is exposed or lost

If anyone may have seen your words — a photo synced to the cloud, a typed-in “verification,” a missing backup card — Trezor’s advice is to assume it is compromised and move the funds immediately, doing the steps promptly and in order to shrink the window for a thief (Trezor). In outline:

1. Set up a wallet with a brand-new backup, ideally on a second device.
2. Write the new backup down, label it with the date so it can’t be confused with the old one, and check it (Trezor).
3. Verify a receive address on the device screen, then send the funds to the new wallet.
4. Treat the old backup as compromised forever: don’t reuse it, then destroy or deface it — after making sure it is the old one (Trezor).

If you lost the backup but still have a working device, the same rule applies: move the funds to a wallet with a new backup, then wipe and reset the old device (Trezor). The step-by-step version, with a test transaction first, is in how to safely move your bitcoin to a new hardware wallet. Not sure whether your setup is at risk? The Is My Wallet Safe? checker asks four questions and runs in your browser.

Inheritance: someone has to be able to find it

A perfectly hidden backup can also be perfectly lost to your family. At minimum, someone you trust should eventually be able to learn that a backup exists, roughly where, which format it is (12, 20 or 24 words; single- or multi-share), and whether a passphrase is involved. Trezor warns that if a passphrase hint is too hard to decipher, or beneficiaries have to guess it, the funds are lost (Trezor). Some wallets build this in: Bitkey’s inheritance feature lets you name a beneficiary, with a 6-month waiting period during which you are notified and can cancel a claim (Bitkey). Inheritance planning deserves its own guide; this is the part that touches your backup.

Quick checklist

• ☐ Words copied by hand from the device screen, in order, spelling checked
• ☐ No photo, screenshot, cloud, email, notes app or password manager copy
• ☐ Never typed into a website, app or computer; never shared with “support”
• ☐ Backup format written down (12/24-word BIP39 or 20-word SLIP39)
• ☐ Backup checked with the device’s own check feature
• ☐ Stored somewhere private and durable, away from the device
• ☐ Number of copies chosen knowing each copy is another thing to protect
• ☐ Passphrase (if any) written down separately and tested with a small amount
• ☐ Someone you trust can eventually find out the backup exists

What this guide can’t tell you

It can’t tell you which hiding place is right for your home, family or risk — that depends on your own situation, and Trezor’s guide is a good place to think it through (Trezor). Product steps and menus change, so follow your wallet maker’s current documentation, and take device-specific questions to the maker’s official support (for Trezor, Trezor Support). Nobody from An Honest Node will ever ask for your seed phrase or passphrase. Educational only, not financial advice.