How to Store a Seed Phrase Safely: What Steel, a Passphrase and Multisig Do for Your Wallet Backup

Seed phrase storage: the weak point that decides who keeps your coins

The attack on Coldcard devices, running since the end of July, has steered the debate towards manufacturers, firmware and supply chains. Where a wallet backup actually sits, and in what condition, has barely come up. For most retail investors, that is the more practical question.

Coinkite, the manufacturer, set out the issue itself in its security advisory of July 30, 2026: funds from affected seeds are at risk unless the seed rests on at least fifty independent dice rolls thrown in private. That is a statement about how a seed comes into being, not about how it is stored. It leads to the same place all the same. A seed is a piece of information whose value depends entirely on who knows it. The scale of the damage remains open; estimates in the first days of August ranged between $86 million and more than $130 million, depending on the survey and the cut-off date. We described the case and the manufacturer question in our assessment of the Coldcard attack.

This article deals with the other half of the problem: how to store those twelve or twenty-four words so that they survive a house fire, a burglary, a house move and fifteen years of time. Which devices even qualify for the job is set out in our hardware wallet comparison.

What the 12 or 24 words of a seed phrase actually contain

The words are not passwords, and they are no shorthand for account access either. They are a readable encoding of a random number. Grasp that, and better storage decisions follow almost automatically.

Why the word list holds exactly 2,048 entries

The standard behind it is called BIP-39. It defines a list of 2,048 words, which means every word carries exactly eleven bits. The length of a phrase therefore reveals the underlying entropy directly: 128 bits give twelve words, 160 bits fifteen, 192 bits eighteen, 224 bits twenty-one and 256 bits twenty-four words.

Some of those bits carry no random information at all. They form a checksum, which BIP-39 builds from the first ENT/32 bits of the SHA256 hash of the entropy. In practice that means a phrase with one word copied down wrongly is rejected as invalid by any correctly implemented wallet, instead of quietly opening an empty wallet. A transcription error therefore shows up at the first recovery attempt, and not years later.

How the words become the seed

The derivation is laid down as well: PBKDF2 with HMAC-SHA512, 2,048 iterations, the string "mnemonic" followed by an optional passphrase as the salt, and 512 bits as the result. Two consequences follow from this that matter considerably for storage.

First, recovery needs no device from any particular manufacturer. Anyone holding the words reconstructs the seed with any software that implements the standard. That is the real insurance against a manufacturer disappearing from the market. Second, there is no confirmation prompt and no undo button. Whoever knows the words is the owner.

Three ways to lose a seed phrase backup

Before turning to materials and methods, a sober list of the ways a backup gets lost is worth having. Measures against one of them routinely raise the risk of another.

• Someone finds it. The slip of paper in the drawer, the photo in the phone gallery, the note in the password manager. The typical case is rarely a targeted attack. It is an ordinary burglary in which the paper happens to catch someone's eye.
• It gets destroyed. Fire, water, mould, fading ink. House moves belong here too, when a box never turns up again.
• Your own memory. Anyone who wants to keep a passphrase in their head alone, or invents a personal encryption scheme whose rule they can no longer reconstruct eight years later, loses access without any external event at all. Inheritance comes on top of that.

A seed phrase on paper: how long a sheet really lasts

Almost every hardware wallet ships with a cardboard card on which the words are meant to be noted down. For the first day that is fine. As a permanent solution, paper has a second weakness alongside the familiar physical one, and it is considered far less often: the writing itself. Ballpoint ink fades depending on how much light reaches it, and handwriting turns ambiguous after years, particularly with words that resemble one another. The BIP-39 list is built so that the first four letters are unique, but that only helps as long as they stay legible.

Anyone staying with paper should write in block capitals with an archival pen and number the sequence. The real safeguard, however, is a second copy in a different place, not the material.

A steel plate for your seed phrase: what the construction has to get right

Metal backups have been the standard advice for years, and the advice is sound. Yet "steel" says nothing about quality. The differences between designs are considerable, and some products fail at precisely the scenario they are sold against.

What the stress tests measure

The most usable public data on this is the open-source project metal-bitcoin-storage-reviews by Jameson Lopp, which has assessed backup devices to a consistent method for years. The results are condensed into three grades: one for heat, one for corrosion and one for crushing. That split makes sense, because a device can be excellent in one category and useless in another.

Two patterns run through the evaluation. Plate designs that hold the information through holes or punched patterns in solid material score well throughout. Designs that rely on sealing, coating or inserted carriers fail heat and corrosion tests unusually often. What is missing from the metal itself can burn off or come away.

Stamping, punching, engraving

A ranking follows from that for practical purposes. Ahead are the methods that remove or deform material, meaning punching, stamping with letter punches and deep engraving. Behind them come systems with individual letter tiles, which are heat-resistant but can shift when dropped or crushed. At the end sit all the variants where the writing merely rests on the surface.

After this week, that strikes us as the more important criterion: what decides the matter is not whether a backup is made of metal, but whether the information sits in the metal or only on it. Anyone who already owns a plate can check that in two minutes by running a fingernail across the characters.

One note on practice: never stamp your only copy. Letter punches slip, and a character set wrongly cannot be corrected. Transfer the sequence from paper first, and destroy that paper once the plate has been checked.

The passphrase: the 25th word as an additional layer of protection

The optional passphrase from BIP-39 is the most powerful and at the same time the most dangerous tool in this field. It enters the derivation as part of the salt, and so turns the same twelve words into an entirely different wallet.

A backup found on its own is therefore of no use to a thief any more. The standard describes the property explicitly: every passphrase produces a valid seed and with it a working wallet, but only the right one opens the intended wallet. That creates the option of running a second, lightly funded wallet alongside the actual holdings, which can be shown under duress.

The price for this often goes unmentioned. If the passphrase is lost, the seed is gone beyond recovery, and the standard puts it in exactly those terms. There is no checksum that flags a misremembered passphrase. The wallet simply opens empty, which regularly leads those affected to assume their device is broken.

Our own view on this is cautious. A passphrase is worth having if it is written down and kept separately from the word backup. Anyone who insists on holding it in their head alone trades a theft risk for a markedly higher risk of forgetting. For sums that matter in everyday life, we rarely consider that a sensible trade.

Multisig and SLIP-0039: splitting the seed phrase instead of hiding it

Anyone holding more than a small amount eventually runs into the limits of a single backup. One location is always either too accessible or too inaccessible. Two established methods resolve this in very different ways.

Multisig

In a multisignature wallet the authority to sign is divided up, rather than the backup. Spending then requires two of three keys, for example, and those keys can sit on devices from different manufacturers. A single compromised device no longer suffices, and that was precisely the lesson of the Coldcard case. The drawback is the effort involved: alongside the keys you have to back up the wallet descriptor, otherwise the construction cannot be reconstructed later on.

SLIP-0039

The Shamir standard from SatoshiLabs splits the secret itself into several shares; reconstruction happens only once enough shares are brought together. SLIP-0039 works on two levels: a group threshold across up to sixteen groups, and a member threshold of up to sixteen shares per group. Rules such as two of your own four shares, or three of five friends together with two of six family members, can be modelled that way. Technically the standard uses a word list of its own with 1,024 words. One share runs to twenty words for a 128-bit secret and thirty-three words at 256 bits; tampered shares are detected through a digest check.

The drawback is obvious. The method is far from supported by every device, and at the moment of reconstruction the complete seed sits on a single device once again. Anyone whose main concern is redundancy against destruction is still better served by it than by three identical copies. Where the goal is protection against one faulty device, multisig is the more suitable tool. Which software handles both methods is set out in our overview of software wallets.

Where a seed phrase backup should be kept

In practice the question of location decides more than the material does. A brief orientation:

• At least two locations that cannot be hit by the same event. A flat and the cellar of the same building do not qualify.
• No location where strangers work regularly, so neither the office nor a holiday home.
• A safe deposit box suits the second copy, not the only one. Access is tied to opening hours, and in the event of inheritance the release takes time.
• One location should be reachable without travelling, otherwise the annual test never happens.
• The passphrase and the words never belong in the same place.
• Record in writing where the copies are, and leave that description with a person you trust or in your will, without naming the words themselves.

The recovery test for your hardware wallet

A backup that has never been checked is an assumption. The test takes little effort and should be carried out once a year, ideally on a fixed date.

Reset a second, inexpensive device or a wallet application on a clean computer, and restore exclusively from the backup, never from memory. Then compare the first receiving address with the one from your production wallet. If the two match, the backup is complete, passphrase included. Afterwards you wipe the test device again.

Anyone working with a passphrase checks the exact spelling in the same pass. An extra space or a capital first letter leads to a different wallet, and deviations of that kind otherwise surface only when it counts.

Common mistakes in storing a seed phrase

The following list comes from reader correspondence and forum cases of recent months. It is not representative, though the patterns repeat strikingly often.

1. The photo of the words on a smartphone that syncs automatically to the cloud. This is by far the most common mistake.
2. Entering the phrase on a website that offers to check whether it is valid. Such forms are a known attack pattern.
3. The printout from the office printer, which keeps the file in the device memory.
4. Splitting the phrase into two halves in two places.
5. A home-made encryption, such as shifting every word by three positions. After years, nobody recalls the rule.
6. The backup that a partner holds but cannot operate.

Point four deserves a note, because it resembles a Shamir split without being one. Halving twelve words substantially lowers the effort for an attacker who finds one half. At the same time the risk of loss rises, because two locations now have to work where one did before.

What you should take away from this

1. Check today what your words are written on. If the phrase sits on the cardboard card from the packaging, plan the move to a metal backup in which the characters sit inside the material. Which devices suit that and what they cost is in the hardware wallet comparison.
2. Fix a second location and put the test date in your calendar. Two copies in places independent of each other, plus one recovery on a test device each year. If you want to move to multisig or SLIP-0039 in the process, the software wallet overview helps with picking the right application.
3. Document your holdings separately from the words. Record which wallets exist and where the backups are kept, without noting the phrase itself. For a running overview and the tax export, the tools from our comparison of portfolio trackers and tax software are the ones to use.

Transparency: the linked comparison pages contain partner links. If you sign up through such a link, we may receive a commission. This has no influence on our assessment of the methods described here; the technical details come from the linked standards.

The technical parameters in this article come from the original specifications: BIP-39 and SLIP-0039.

(As of August 7, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)