How to back up a seed phrase properly

What the seed phrase actually is

Most wallets show you a list of 12 or 24 common words when you first set up. This is a mnemonic defined by the BIP-39 standard. Behind the words is raw randomness: 128 bits of entropy for a 12-word phrase and 256 bits for a 24-word phrase. BIP-39 appends a short checksum (the first ENT/32 bits of the entropy’s SHA-256 hash) so that an invalid phrase can be detected, and the words are drawn from a fixed list of 2,048 English words. That phrase, run through PBKDF2-HMAC-SHA512 for 2,048 iterations, produces a 512-bit seed from which every key in the wallet is derived.

The consequence is simple and unforgiving: anyone who has the words has the wallet, and anyone who loses the words with no other copy loses the wallet. The backup is not a convenience — it is the wallet, in the only form that survives a broken, lost, or wiped device.

The rule that matters most: never digital

The single most important backup rule is that the phrase should never exist in digital, networked form. Do not type it into a notes app, a password manager synced to the cloud, an email to yourself, a spreadsheet, or a photo. ethereum.org states the principle directly: “Never, for any reason, share your recovery phrase or private keys!” and warns that screenshotting a seed phrase “might sync them to a cloud data provider, which could make them accessible to hackers.”

The reasoning is that a digital copy inherits every weakness of the device and account holding it: malware, cloud breaches, account takeovers, and shared-device mistakes. A phrase written only on paper or metal cannot be exfiltrated remotely. The inconvenience is the point.

Paper is fine; metal is more durable

A phrase written clearly on paper and stored securely is a valid backup and far better than a digital copy. Its weaknesses are physical: fire, flood, fading ink, and being mistaken for rubbish. A metal backup — words stamped, engraved, or assembled into a stainless-steel plate — addresses the environmental risks and is the reason “metal backup” is standard advice for larger or long-term holdings. Metal is not more secret than paper; a thief who finds either can read it. Metal only buys durability, so it must still be stored somewhere private.

Order and legibility are part of the backup

BIP-39 words are position-sensitive: the same words in a different order produce a different wallet. Number each word. Write clearly enough that a “6” cannot be read as a “b”, and record only words from the BIP-39 list spelled in full — the standard is designed so that the first four letters of each word are unique, but there is no benefit to guessing later. Verify your written copy by reading it back against the device before you move any funds, and again after you have wiped the setup screen.

The optional passphrase (the “25th word”)

BIP-39 allows an optional passphrase that is combined with the mnemonic when the seed is derived. It is sometimes called a “25th word”, though it can be any string you choose. Because every different passphrase produces a completely different but valid wallet, the passphrase creates what is often called a “hidden wallet”: the 12 or 24 words alone open one wallet, and the words plus the passphrase open another.

This is powerful and dangerous in equal measure. The upside is that someone who finds your written seed phrase does not automatically have your funds if a passphrase is required. The downsides are strict: BIP-39 provides no way to verify that you entered the correct passphrase — a wrong one silently opens a different, empty-looking wallet — and there is no recovery if you forget it. A passphrase must be memorised and/or backed up with the same never-digital discipline as the seed, and ideally stored separately from the words so that finding one does not reveal the other.

Splitting a backup: threshold schemes

Writing the whole phrase in one place creates a single point of failure. Naively cutting the phrase in half is a bad idea, because each half leaks information and neither half alone can be checked. A better-engineered option some wallets offer is a threshold backup based on SLIP-39 (Shamir backup), which splits the secret into multiple shares with a required threshold — for example, any 3 of 5 shares reconstruct the wallet, while any 2 reveal nothing. Trezor documents that individual shares below the threshold “do not leak any information about the shared secret.” Shamir shares are longer word lists than a BIP-39 phrase (20 words per share at the 128-bit level, 33 words at 256-bit) and are a distinct format, so use it deliberately rather than mixing it with a plain BIP-39 backup.

Where to keep it

A backup you cannot find in an emergency is not a backup, and one that a single accident destroys is not much better. The practical goals are: protected from theft, protected from fire and water, and duplicated across at least two separate physical locations for anything you cannot afford to lose. A home safe plus a second secure location is a common pattern. Avoid telling the backup’s location to anyone who does not need it, and avoid clever hiding places you will forget.

Common mistakes

• Photographing the phrase “just for setup” and forgetting the photo syncs to the cloud.
• Storing the only copy in one place that a single fire or flood can destroy.
• Trusting a printed card from a device box that arrived with words already filled in — a genuine device generates the phrase on the device, never pre-prints it.
• Using a passphrase but never backing it up, then losing access permanently.
• Entering the phrase into a website or “wallet validator” that asks for it — no legitimate service ever needs your full phrase.

A note on derivation paths and compatibility

The recovery phrase encodes the seed, but the specific accounts and addresses a wallet shows you also depend on a derivation path — the BIP-32 route used to generate keys from that seed. Different wallets sometimes default to different paths, which is why restoring a phrase into another wallet can occasionally show an empty account even though the funds are safe: the wallet is simply looking down a different branch. This is worth knowing so that a blank screen after a restore does not trigger panic. The fix is to select the correct path or use the original wallet, not to assume the backup failed. Recording which wallet and account type the phrase belongs to, alongside the backup, avoids this confusion later.

Planning for someone else to recover it

A backup only you can understand becomes worthless the day someone else must use it — after an accident, or as part of an estate. Without exposing the words prematurely, it is worth leaving clear, separate instructions describing that a recovery phrase exists, what device it belongs to, whether a passphrase is required, and where the copies are held, so that a trusted person can act when needed. The words themselves stay protected; the map to them lives separately. This is the difference between a backup that survives you and one that dies with the knowledge in your head.

Sources

• BIP-39 specification (bitcoin/bips)
• ethereum.org — Never share your recovery phrase; avoid screenshots
• Trezor — What is Shamir backup (SLIP-39)
• Trezor firmware docs — SLIP-39
• Trezor — Passphrases and hidden wallets