What is a seed phrase: how it works and how to store it

A seed phrase (also called a recovery phrase or mnemonic) is a list of 12 or 24 words from which a crypto wallet derives all of its private keys and addresses. Whoever knows those words controls the coins; the device, the app and your phone's passcode are secondary. That is why a seed phrase belongs offline only, on paper or metal, in more than one copy, and never typed into a website or handed to "support".

What is a seed phrase, in plain terms

Your bitcoin doesn't sit inside your wallet. It's recorded on the blockchain against addresses, and the wallet holds the keys that can spend it. A modern wallet uses many keys, often a fresh address for every incoming payment, so backing up each key one by one would be hopeless. In 2013 the BIP-39 standard solved that: a single large random number is encoded as a short list of ordinary words, and every key in the wallet is derived from it deterministically.

That gives the seed phrase its defining property: the phrase is the wallet. If your phone breaks, your hardware wallet goes missing or your laptop dies, you install any compatible wallet, type the same words and see the same coins. The flip side is just as true: anyone who sees your words doesn't need your device. They can restore the wallet on their own and sweep it.

For where the keys themselves should live, see our guide to the bitcoin cold wallet.

How a seed phrase works: BIP-39 under the hood

BIP-39 defines the whole path from randomness to keys:

1. The wallet generates a random number, the entropy, between 128 and 256 bits long.
2. A checksum is appended: the first bits of the SHA-256 hash of that entropy (one bit per 32 bits of entropy).
3. The resulting bit string is cut into 11-bit chunks. Each chunk is a number from 0 to 2047, which is an index into a list of 2,048 words.
4. You write those words down. That is your seed phrase.
5. To get keys, the wallet runs the phrase through PBKDF2 (HMAC-SHA512, 2,048 iterations) and produces a 512-bit seed, from which BIP-32 derives a whole tree of keys.

Phrase length depends on entropy, per the table in the BIP-39 specification:

Two practical details follow. The word list is designed so each word can be identified by its first four letters, which is why metal backup plates often store just those. And thanks to the checksum, a wallet usually catches a typo: a wrong word most often produces an "invalid phrase" error rather than silently opening a different wallet.

12 or 24 words: which is more secure?

A 12-word phrase carries 128 bits of entropy, roughly 3.4 × 10³⁸ possibilities. No computer in existence can brute-force that, so for most people 12 words is plenty. Twenty-four words (256 bits) adds extra margin, but also twice as many chances to make a mistake when writing it down.

What matters more than length is how random the entropy really was. A weak random number generator shrinks the search space from 10³⁸ to something attackers can actually scan. That's how 1,404 wallets on the Qubic network were drained in October 2026: seeds generated in browsers on Apple devices turned out to be predictable. See our Qubic hack breakdown. The lesson is simple: let the device or a well-established wallet generate the phrase, never a website "generator" and never your own imagination.

Passphrases (the "25th word") and derivation paths

A passphrase is an optional extra defined in the same BIP-39 standard. It's mixed into the seed calculation, so every passphrase opens a separate wallet. The specification describes this as plausible deniability: any passphrase yields a valid wallet, just a different one. The upside: someone who finds your 24 words without the passphrase gets an empty wallet. The downside: nobody can recover a forgotten passphrase, and a typo in it also opens an empty wallet without any error.

A derivation path tells the wallet which branch of the key tree to look in. The same phrase can show different addresses in different apps if they look in different branches:

• BIP-84, path m/84'/0'/0': native SegWit addresses starting with bc1q;
• BIP-86, path m/86'/0'/0': Taproot addresses starting with bc1p;
• older formats: BIP-44 (addresses starting with 1) and BIP-49 (starting with 3).

If a restored wallet shows a zero balance, the coins are usually still there and the wallet is simply scanning the wrong branch. Check the address type and path before you panic.

How to store a seed phrase: options compared

Storage has two jobs that pull against each other: keep the phrase away from others, and make sure you never lose it.

Shamir Backup (the SLIP-39 standard) splits the secret into shares. According to Trezor, you can create 1 to 16 shares of 20 or 33 words each, and recovery needs a set threshold, such as any 2 of 3. Since June 2024 it has been the default backup type on Trezor Safe devices. Note that SLIP-39 uses a different word list and isn't interchangeable with BIP-39 phrases.

How to make a backup properly:

1. Write the words by hand when the wallet is created, numbered, with no corrections.
2. Verify the copy straight away. Most devices ask you to confirm words; a test recovery on a wiped device is even better.
3. Move the phrase to metal if the amount matters to you.
4. Make a second copy and keep it in a different location.
5. If you use a passphrase, store it separately from the words, also in two places.
6. Leave your family instructions on where the backup is and how to use it, not the phrase itself in plain view.

Real example, Oct. 25, 2026: what 12 words are worth

As of 2:00 PM ET on Oct. 25, 2026, bitcoin traded near $80,796 (CoinLab dashboard). So a sheet of paper with 12 words controlling 0.1 BTC was worth about $8,080, and one controlling 0.5 BTC about $40,400. That's real money in paper form, and paper is exactly what scammers go after.

The FBI's numbers show the scale. In its 2025 IC3 report, Americans reported $11.4 billion in crypto-related losses, $4.4 billion of it from people aged 60 and over. Not all of those cases involve seed phrases, but tricking someone into revealing their phrase is one of the most common playbooks. In October 2026 came another variant: Ledger devices sold by the reseller CryptoBilis contained a foreign module that read the 24 words during setup (see our Ledger implant breakdown). For bitcoin's latest price, check the bitcoin page.

Common mistakes

• Typing the phrase into a website, a "verification" app or a bot. No manufacturer, exchange or police force will ever ask for your recovery words. Scammers even send paper mail: Cointelegraph reported Ledger and Trezor owners receiving letters with a QR code and a demand to complete a "check" that led to a phishing site asking for the phrase.
• A photo on your phone or a note in the cloud. That turns a cold wallet into a hot one.
• A device that arrives with a phrase already printed in the box. A genuine wallet generates the words itself on first setup; a pre-filled card is a red flag.
• A single copy. One fire, flood or move and access is gone for good.
• A phrase you made up yourself. Humans are bad at randomness, and such phrases get brute-forced.
• Keeping the phrase next to the device. A thief who grabs the bag gets everything at once.

FAQ

Can I recover a lost seed phrase? No. Neither the manufacturer nor any server has it. If the device still works and you remember the PIN, create a new wallet with a new phrase right away and move your coins there.

What if I forgot one word? If one word is missing and you know its position, there are only 2,048 candidates, which offline recovery tools can check. With two or more missing words the job gets much harder fast.

Is a seed phrase the same as a private key? No. A private key unlocks one address; a seed phrase unlocks every key in the wallet. That makes a leaked phrase far more dangerous than a leaked single key.

Will my phrase work in another wallet? If both support BIP-39, yes, though you may need to pick the address type or derivation path. Not every wallet supports SLIP-39 (Shamir) shares.

This is not investment advice.