Seed Phrase Security: How to Store a Recovery Phrase Safely

Seed phrase security in plain numbers: how a recovery phrase works, where to store it, how many copies to keep, and the habits that stop theft and loss.

What does a seed phrase actually protect?

A seed phrase, also called a recovery phrase, is the human-readable backup of the secret that generates every key in your wallet. Type the same 12 or 24 words into any compatible wallet and it rebuilds the same accounts with the same funds. That is what makes it a lifesaver when a phone or hardware wallet dies, and what makes it the single most valuable thing you own in crypto.

It also means the phrase outranks every other protection. A PIN, a password or two-factor codes guard one device or one app. The phrase skips all of them, and because many wallets derive accounts on several networks from the same words, one exposed phrase can empty all of those accounts at once. The SEC’s investor bulletin on crypto custody puts it simply: store your seed phrase in a secure place and do not share it with anyone.

Warning: Never share your recovery phrase, and never type it into a website, app, form, email or chat. No real wallet maker, exchange or support agent needs it. The only time you enter it is when restoring a wallet on the wallet device itself.

Why guessing isn’t the threat

Under the BIP-39 standard, a 12-word phrase encodes 128 bits of randomness plus a 4-bit checksum, and each word from the 2,048-word list carries 11 bits (12 × 11 = 132). That gives 2^128, about 3.4 × 10^38, possible phrases. Even at a trillion guesses per second, trying them all would take roughly 1.08 × 10^19 years. A 24-word phrase uses 256 bits of randomness, which is more again.

So nobody guesses a phrase. People lose phrases, or someone else sees one. Every habit below targets one of those two failures.

The checksum helps with one practical problem. If you misread a single word, a 12-word phrase’s 4-bit checksum rejects the error about 15 times out of 16 (only about 1 in 16, or 6.25%, of random changes pass). The flip side: a wrong but valid phrase opens a different, empty wallet, so write clearly. In the English list, the first four letters identify every word, which is handy when stamping a metal plate.

Where should you store a recovery phrase?

Microsoft’s threat researchers, who track malware built to steal wallet data, advise never storing seed phrases digitally. That rules out the most convenient options.

A hardware wallet keeps your keys offline while you use them, but the device is replaceable and the phrase is not. Our comparison of hot and cold wallets covers where the device fits in.

How many copies should you keep?

More copies protect against loss but create more places for a thief to look. You can put numbers on that trade-off.

Example: Suppose each storage location has a 2% chance per year of being destroyed (fire, flood, a move gone wrong) and a 1% chance per year of someone else finding what is there. These rates are hypothetical.

• One copy: you lose everything with a 2% yearly chance, and the phrase is exposed with a 1% chance.
• Two copies in separate places: losing both takes two disasters, 0.02 × 0.02 = 0.04%. Exposure becomes 1 − 0.99^2 = 1.99%.
• Three copies: loss falls to 0.0008%, while exposure climbs to 2.97%.

The second copy cuts yearly loss risk by 1.96 percentage points for about 0.99 points of extra exposure. The third cuts loss by only 0.0392 points for another 0.98 points of exposure. That pattern gives a decision rule: two well-protected copies in separate places usually hit the balance, unless your storage locations are unusually risky. Two copies in the same house protect you from a spilled drink, not a house fire.

A storage routine that works

1. Write it by hand at setup. Number the words, stay offline, and never photograph or print the phrase.
2. Check every word. Compare each word with the device’s screen, then read the list back once more.
3. Make a second copy on durable material. Metal survives heat and water far better than paper.
4. Store the copies apart. Use two secure places you control, and don’t label either one as a crypto backup.
5. Test the backup. Restore it on the wallet device or a spare of the same kind and confirm the same addresses appear. Never test it on a website.
6. Review once a year. Check that each copy is readable and still where you left it.

The one-question test before you type the words

Before you enter your phrase anywhere, ask yourself one question: did I just choose “Restore” or “Recover wallet” on my own wallet device, on my own initiative? If the answer is anything but a clear yes, stop.

That single test filters out almost every phrase-stealing trick. Pop-ups saying your wallet needs to be “synchronized”, “validated” or “upgraded” fail it. So do support agents who message you first, reward claim pages and browser windows that open after you connect a wallet. No legitimate process needs your words anywhere except the device you are restoring.

Common mistakes that expose a recovery phrase

• Typing it into a site to “validate”, “sync” or claim something. This is the classic trap behind fake airdrop and claim sites.
• Reading it to “support”. A support agent who asks for your phrase is a scammer, a red flag covered in our guide to spotting a crypto scam.
• Taking a photo “just for now”. Many phones sync photos to the cloud automatically, so a temporary photo can end up stored online for good.
• Keeping the only copy with the device. A burglar who takes the hardware wallet box takes the backup too.
• Storing a passphrase next to the phrase. An optional passphrase only adds protection if it is kept apart, as explained in the 25th-word passphrase guide.

If you think your phrase has been seen, act as if it has. Create a new wallet with a new phrase on a trusted device, move your funds, and follow what to do if your wallet is compromised. For the rest of your setup, work through the crypto wallet security checklist.

The bottom line

Your recovery phrase can’t realistically be guessed, so protect it against the two things that do happen: someone seeing it and you losing it. Keep it offline, never share it or type it into a website, and hold two well-protected copies in separate places. Test the backup on the device, and replace the whole wallet if the phrase is ever exposed.

This content is for education only and is not financial, investment, tax or legal advice. Crypto assets are volatile and you can lose money. Examples use hypothetical numbers. See our disclaimer and editorial policy.