Glossary · Wallet security

Seed phrase (secret recovery phrase)

Published 23 May 2025 · Updated 21 Oct 2026 · 12 min read

A seed phrase is a list of words that encodes the random number from which a wallet derives its keys. Other names include secret recovery phrase, recovery phrase and mnemonic. It backs up the starting randomness, not the optional passphrase, derivation path or wallet scheme needed to locate every account.

  • BIP-39 encodes 128 to 256 random bits plus a checksum, so the last word is not random.
  • Anyone with the phrase controls the funds, and wallet makers never ask you for it.
  • A passphrase creates a separate wallet, while a different derivation path selects other accounts.
How a seed phrase worksSeed phrase, secret recovery phrase and other namesOne phrase, many accountsLosing a word from your seed phraseHow attackers steal recovery phrasesHow to store a seed phraseWallets without a seed phraseDesigning wallet backup and recoverySeed phrase FAQ

How a seed phrase works

A seed phrase backs up the random number behind every key in a compatible wallet. BIP-39 is the standard most wallets follow. It makes computer-generated randomness easier to record than raw binary or hexadecimal data. The wordlist is a lookup table, not the source of randomness. The format allows 12, 15, 18, 21 or 24 words.

Number 1

Entropy

The wallet generates initial entropy, a random number containing 128 to 256 bits. This randomness comes first, before any words are selected.

Number 2

Checksum

A SHA-256 hash supplies the checksum, which is appended to the random bits. Its length is the entropy length divided by 32.

Number 3

Words

Each 11-bit group points to one entry in a wordlist of 2,048 words. The final word contains both entropy and checksum bits, rather than independent randomness.

Number 4

Seed

PBKDF2 with HMAC-SHA512 runs 2,048 iterations, using the words as the password and "mnemonic" plus the optional passphrase as the salt. It outputs a 64-byte seed.

Number 5

Keys

BIP-32 derives a master key and a tree of key pairs from the seed. This HD wallet structure uses derivation paths, with BIP-44 defining a common format.

Figure 1 · BIP-39 test vectorSee how words encode bitsSwap a test word for the previous or next wordlist entry. The 12 tiles show word numbers, 11-bit groups and the final checksum.
Selected: word 12, borrow
Checksum bits in word 120000
First 4 bits of SHA-256 of the entropy0000
ChecksumPasses
Entropy, 128 bitsc0ba5a8e 91411121 0f2bd131 f3d5e08d

This public test phrase passes the checksum. Everyone knows it, so it must never hold funds.

This public BIP-39 test vector must never hold funds. The page recomputes the checksum after each change.

Seed phrase, secret recovery phrase and other names

MetaMask replaced "seed phrase" with "Secret Recovery Phrase" in May and June 2021 because the old name understated the backup's "critical importance". In October 2026, new Trezor devices default to 20-word SLIP-39 backups. Older Trezor setups used 12 or 24 BIP-39 words, so the format matters alongside the name.

WalletTerm it usesPhrase length
MetaMaskTerm it uses"Secret Recovery Phrase"Phrase length12 words
LedgerTerm it uses"Secret Recovery Phrase" or "recovery phrase"Phrase length24 words
TrezorTerm it uses"wallet backup", formerly "recovery seed"Phrase length20 words on new devices
Coinbase WalletTerm it uses"recovery phrase"Phrase length12 words
PhantomTerm it uses"Secret Recovery Phrase"Phrase length12 words
Trust WalletTerm it uses"Secret Phrase"Phrase length12 to 24 words
ExodusTerm it uses"12-word secret key"Phrase length12 words

BIP-39 calls the words a mnemonic sentence, also known as a mnemonic phrase, while its 64-byte output is the seed. Electrum uses versioned seeds, and Monero's official wallet uses 25 words, with the last providing a checksum. Cardano's Icarus scheme runs PBKDF2 with 4,096 iterations, producing different keys from the same words. SLIP-39 is largely incompatible with BIP-39. So a backup may not restore in every wallet that accepts words.

One phrase, many accounts

A derivation path selects a branch of the key tree and gives a different address. Bitcoin uses m/44'/0'/0'/0/0 for legacy accounts and m/49'/0'/0'/0/0 for nested SegWit. Native SegWit uses m/84'/0'/0'/0/0, while Taproot uses m/86'/0'/0'/0/0. These follow BIP-44, BIP-49, BIP-84 and BIP-86, respectively. Ethereum wallets such as MetaMask use m/44'/60'/0'/0/0. A restored backup can therefore show an empty balance when another wallet follows a different path.

The optional passphrase, often called the 25th word, creates a separate wallet from the same words. It is case-sensitive and usually not stored on the device. Ledger stores one only when the user attaches it to a secondary PIN. Every value produces a valid wallet, so a typo cannot be detected through a checksum. Losing it means losing access to its associated funds. The backup words alone cannot restore that wallet.

Figure 2 · One phrase, five pathsFollow the account pathsChoose a path and toggle "TREZOR" for the public "abandon ... about" test phrase. Watch the first address change.
Path
Passphrase
Paper backup iconabandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about
What each part of the path means
mMaster key
84'Purpose: BIP-84
0'Coin: Bitcoin
0'First account
0Receiving chain
0First address
First receiving address · P2WPKH, starts with bc1qbc1qcr8te4kr609gcawutmrza0j4xv80jy8z306fyuMatches the test vector printed in BIP-84

Without a passphrase, the native SegWit and Taproot addresses match the BIP-84 and BIP-86 test vectors. Each path selects a separate account.

Addresses use the public test phrase, following BIP-84 and BIP-86 vectors or calculations under BIP-32 rules.

Losing a word from your seed phrase

Losing one word from a seed phrase does not always mean permanent loss. The BIP-39 wordlist and checksum can make small gaps recoverable. A tool still needs a known address, the master public key or an address database to recognize success. A forgotten passphrase cannot be searched exhaustively.

Figure 3 · btcrecover benchmarkMeasure missing word recoverySelect 12 or 24 words and a loss scenario. Compare candidate counts, checksum survivors and estimated search times on two example processors.
Phrase length
What is lost
Magnifier iconCandidates to try24,57612 positions × 2,048 words
Check iconPass the checksumabout 1,5361 in 16 passes
Clock iconOne laptop CPUunder 1 secondIntel i7-8750, 33,000 candidates a second
Clock iconOne consumer GPUunder 1 secondGTX 1660 Ti, 134,000 candidates a second
Search time on one consumer GPU, log scale

An unknown position increases the search to 24,576 candidates for 12 words or 49,152 for 24 words.

Estimates use btcrecover's published speeds on one laptop CPU and one consumer GPU. Treat them as order-of-magnitude guidance.

Cutting the words into pieces is not the same as using Shamir shares. Finding two of three pieces of a 12-word backup leaves only four words to search. That takes about four years on the benchmark GPU, less with many GPUs. Trezor considers 128-bit, 12-word backups sufficient for private key security. Twenty-four words add margin when words leak or become scrambled, without making weak storage safe.

How attackers steal recovery phrases

Chainalysis's December 2025 report counted 158,000 personal wallet compromises and $713 million stolen in 2025, as lower-bound estimates. The FBI's April 2026 report recorded 181,565 crypto complaints and $11.37 billion in losses for 2025. These are not counts of phrase theft alone. Attackers more often trick people or steal copies than break the math.

  1. August 2022

    Phrases sent to a server

    The Slope wallet app sent users' seed phrases to a logging server. Nearly 8,000 Solana wallets were hit, with estimated losses of $4 million to $5 million.

  2. November 2022

    Weak entropy in wallet creation

    Wallets created in the Trust Wallet browser extension between 14 and 23 November 2022 had only 32 bits of entropy. Attackers drained about $170,000 in December 2022 and March 2023. Trust Wallet pledged to reimburse all losses.

  3. July and August 2023

    Milk Sad exposed predictable backups

    On 12 July 2023, attackers swept over $850,000 in bitcoin from wallets made with Libbitcoin Explorer's weak generator. The Milk Sad flaw, disclosed on 8 August 2023, limited entropy to 32 bits.

  4. February 2025

    Photo galleries searched by malware

    Kaspersky found SparkCat reading recovery phrases from photos in Google Play and App Store apps. The infected Google Play apps exceeded 242,000 downloads. Kaspersky reported a new variant in both stores in April 2026.

  5. March 2025

    Attackers supplied ready-made wallet backups

    Phishing emails titled "Migrate to Coinbase Wallet" supplied a recovery phrase already controlled by attackers. This seed poisoning scheme used a ready-made backup instead of asking victims to disclose their own.

  6. December 2025

    A malicious browser extension update

    Trust Wallet extension 2.68 reached the Chrome Web Store on 24 December 2025 and, per SlowMist, sent decrypted phrases to an attacker's server. Trust Wallet counted 2,520 affected addresses and about $8.5 million. It pledged to reimburse users.

  7. 10 January 2026

    An attacker impersonated Trezor support

    An attacker posing as Trezor support persuaded a holder to share their wallet backup. The holder lost over $282 million in bitcoin and litecoin.

  8. April 2026

    A fake Ledger Live app

    A fake Ledger Live app for macOS in Apple's App Store asked for the 24-word recovery phrase. More than 50 victims lost about $9.5 million between 7 and 13 April 2026.

How to store a seed phrase

Storage choices range from handwritten backups to opt-in recovery services. Compare what each one protects against, what it can expose and what recovery requires. No storage method removes every risk.

Paper in order

Write the seed phrase down in its correct order, then check the record. Paper can burn or soak, so physical damage remains a risk.

Metal backup plates

A metal backup resists more damage than paper. Jameson Lopp has stress-tested 75 devices with about 2,000°F heat, acid and a 20-ton press. Their durability varies widely.

No digital copies

Trezor and MetaMask warn against digital copies, including photos and cloud storage. Coinbase Wallet differs by offering an encrypted Google Drive or iCloud backup of the recovery phrase.

Enter it only when prompted

Enter the words only where the hardware wallet itself prompts for them. Trezor says, "Never enter your wallet backup anywhere unless prompted by your Trezor device." Ledger warns against restoring them in software wallets.

Shamir shares

SLIP-39 splits a secret into shares, such as 3 of 5. Each share is 20 words for a 128-bit secret or 33 for 256 bits. Fewer than the threshold reveal nothing.

Opt-in recovery services

Ledger Recover uses three companies and two online identity checks. Ledger Recovery Key adds a PIN-protected card alongside paper. MetaMask social login's encrypted backup depends on password security.

Wallets without a seed phrase

Some wallets remove the need to write down words, while others hide an existing backup. These models have different signing and recovery arrangements. A smart account does not necessarily replace the original keys.

SetupHow you signWhere a phrase or secret remains
Passkey smart walletHow you signCoinbase's passkey smart wallet signs through a device or cloud keychain passkey.Where a phrase or secret remainsAn optional recovery phrase can become an additional signer on-chain.
MPC walletHow you signZengo uses key shares on the phone and its server to sign.Where a phrase or secret remainsThere is no phrase, but recovery needs a 3D face scan and cloud-synced key.
Social login walletHow you signMetaMask supports signing in through Google, Apple or Telegram.Where a phrase or secret remainsThe phrase exists in the background, with an encrypted backup protected by a password.
EIP-7702 smart accountHow you signMetaMask signs with existing account keys while EIP-7702 adds smart account features.Where a phrase or secret remainsThe original phrase still governs accounts after Pectra's 7 May 2025 upgrade.
Multisig walletHow you signSafe's multisig wallet requires approvals from separate wallets to meet its signing threshold.Where a phrase or secret remainsEach signer retains its own phrase or hardware device.

Removing visible words does not remove every recovery dependency. Risk moves to a device, cloud account, password or provider. Understanding which one controls recovery matters more than whether the interface calls the setup seedless.

Designing wallet backup and recovery

Backup design starts with how people regain access, not just how they sign. In PixelPlex's crypto wallet development work, we define which backup to offer, where keys live and how recovery works after a device is lost. Our MPC wallet development work includes threshold recovery, signer rotation and secure device binding. Each approach needs clear recovery instructions.

PixelPlex case icon

PixelPlex has built wallets of both kinds. Qtum Wallet offers a 12-word seed phrase backup, Shamir's Secret encryption, and iOS Secure Enclave and Android KeyStore support. Console Wallet, built for the Canton Network in 2025, has no seed phrase. Its private keys stay on the user's device, protected through passkey-based approvals. By August 2026, it had more than 250,000 users.

  1. Key generation and entropy

    Define how the wallet generates its initial randomness. Check that the implementation supplies the intended entropy before it encodes any backup words.

  2. Backup format and checksum

    Specify the supported word format, checksum and derivation paths. Make format differences explicit rather than treating every mnemonic as interchangeable.

  3. Recovery flows

    Document the secrets, devices or providers needed for restoration. Separate forgotten passphrases from missing words, because they require different recovery assumptions.

  4. Phishing defenses

    Explain where backup entry belongs and where it does not. Web3 Antivirus illustrates phishing-site detection, a separate safeguard from protecting the backup itself.

  5. Audits and test vectors

    Test with public BIP-39 vectors, never funded backups. For smart account logic, include smart contract audits alongside checks of backup and recovery behavior.

Plan backup and recovery around your users

We can discuss your wallet's signing model, recovery dependencies and the trade-offs each design introduces.

Discuss wallet recovery

Seed phrase FAQ

Is a seed phrase a private key?

No. A seed phrase encodes the starting entropy, and the wallet derives many private keys from it along derivation paths. One exposed private key exposes one account, while an exposed seed phrase exposes every account derived from it. BIP-32 creates the master key using HMAC-SHA512 with "Bitcoin seed" as its key, then derives a tree of key pairs.

Can someone guess a seed phrase?

A properly generated 12-word seed phrase has about 3.4 x 10^38 valid possibilities, compared with about 1.2 x 10^77 for 24 words. Milk Sad, disclosed in August 2023, and Trust Wallet's November 2022 extension flaw reduced entropy to 32 bits, about 4.3 billion phrases. Such weak generators defeat the protection of a large theoretical search space. Theft of copies remains the real risk.

What happens if one word is missing?

Recovery can be possible when the other words remain available in their correct order. One missing word at an unknown position leaves 24,576 candidates for a 12-word phrase. At btcrecover's published benchmark speeds, that search takes under a second. The checksum alone cannot identify the right candidate, so the tool also needs a known address, the master public key or an address database.

Are 24 words safer than 12 words?

Twelve words provide 128 bits of entropy, which Trezor considers sufficient for private key security. Twenty-four words carry 256 bits. Their checksum catches more accidental changes. Only one in 256 random combinations passes, compared with one in 16 for 12 words. The longer format helps most when some words leak or get scrambled, adding margin against searches for the missing information.

Can password managers or cloud storage protect a seed phrase?

Vendor advice on keeping a seed phrase in a password manager or cloud account differs in October 2026. MetaMask and Trezor advise against digital or cloud copies. Their warnings cover password managers, screenshots and photographs. Coinbase Wallet offers an encrypted Google Drive or iCloud backup. Microsoft's 2026 reporting also describes clipboard malware, active since February 2026, that detects 12-word or 24-word backups in copied text.

What is a seed phrase passphrase or 25th word?

It is an optional, case-sensitive addition, often called the 25th word, that changes the wallet derived from the backup words. In October 2026, Ledger allows up to 100 characters. Every passphrase opens a valid wallet, so no checksum catches a typo. A forgotten passphrase cannot be searched exhaustively, because BIP-39 sets no wordlist and no length limit for it.

Can I restore a seed phrase in another wallet?

Restoration works only if the receiving wallet supports the backup format, derivation path and any required passphrase. MetaMask supports only the default BIP-44 derivation path in October 2026. A familiar-looking list of words is therefore not enough to establish that two wallets will restore the same accounts. Electrum seeds, SLIP-39 backups and Cardano's Icarus scheme do not restore as standard BIP-39 phrases.

Related terms

All definitions
Sources (46)

Get updates about blockchain, technologies and our company

We will process the personal data you provide in accordance with our Privacy policy. You can unsubscribe or change your preferences at any time by clicking the link in any email.

Follow us on social networks and don't miss the latest tech news

  • facebook
  • X
  • linkedin
  • instagram
Stay tuned and add value to your feed