How to Store a Seed Phrase Safely: Paper, Metal, Passphrase and Multisig

Storing a seed phrase safely takes about 30 to 60 minutes and costs almost nothing for pen and paper, or a moderate amount for a stamped steel backup. You will write a 12- or 24-word phrase on a durable physical medium, keep it offline, and test that you can restore it before you fund the wallet. You need a wallet, a pen and acid-free paper or a metal stamping kit, and two separate hiding places.

What is a seed phrase, and why does storing it matter?

A seed phrase, also called a recovery phrase or mnemonic, is a list of words your wallet uses to derive every private key it controls. Anyone who has those words can move the funds, while losing them usually means losing the wallet permanently. Storage matters because the phrase, not the hardware wallet, is the real backup.

Most wallets use the BIP39 standard, which draws words from a fixed list of 2,048 words and supports 12, 15, 18, 21 or 24-word phrases. A 12-word phrase encodes 128 bits of entropy plus a 4-bit checksum; a 24-word phrase encodes 256 bits plus an 8-bit checksum. The spec describes the phrase as a human-friendly way to write down or even read out the backup, and it warns against using words you invent yourself. A hardware wallet such as a Ledger or Trezor generates the words on the device itself, so they are created offline and shown only to you. For background on what those keys secure, see our Bitcoin explainer.

One status detail matters if you already own hardware. The original Ledger Nano S was retired in 2022 and, as announced in June 2025, its software support is winding down because the device has only 320 KB of memory. Basic Bitcoin and Ethereum sending still works, but Ledger advises moving to newer hardware, and its 24-word phrase can be restored on any BIP39-compatible wallet. See our Ledger Nano S guide for the full upgrade path.

How should you store a seed phrase on paper or metal?

Write the words by hand, in order, on acid-free paper or stamp them into steel, then keep the backup somewhere fire, water and casual thieves cannot reach. Paper is a fine first step, but steel survives fire and flood far better. Keep at least two copies in separate locations and never photograph or type the words.

Follow these steps for a basic, secure backup:

1. Generate the phrase on the wallet itself. A hardware wallet creates the words offline and shows them on its own screen; a software wallet should be set up on a device you trust. Never let a website or app generate the phrase for you and display it to anyone else.
2. Write the words down by hand on paper with a pen. Write the full phrase in the exact order shown, and number the words. Do not print it, and do not copy it into a note app.
3. If you want fire and water resistance, stamp or engrave the words onto a steel plate or capsule. Products such as Cryptosteel, Billfodl, Cryptotag Zeus, Blockplate and Seedplate exist for this purpose, and steel backups are designed to survive a typical house fire.
4. Store at least two copies in different physical places, such as a home safe and a location away from home. Keep them out of sight and out of shared or rented spaces.
5. Test the restore before you send funds. Install the wallet fresh or use a second device, enter the words, and confirm it produces the same receiving address. Only fund the wallet after this test passes.
6. Never photograph the words, never store them in the cloud, and never type them into a website or form.

Metal is worth the effort because it removes the two big failure modes of paper: fire and water. Gnosis notes that steel plates resist heat far above what a paper backup can, and one documented case involved a plate surviving a house fire. Paper is still acceptable as a first copy, but treat it as temporary rather than your only line of defence.

What is a BIP39 passphrase, the extra 25th word?

A passphrase is an optional extra word or phrase you add to a BIP39 seed, so the same 24 words open a completely different wallet depending on the passphrase. It protects you if someone finds your written words, but if you forget it the funds are gone. Treat it as a second secret and back it up separately.

Under BIP39, the passphrase is not stored anywhere in the phrase. The spec uses the mnemonic as a password and salts it with the string ‘mnemonic’ plus your passphrase, then runs PBKDF2 with HMAC-SHA512 over 2,048 iterations to produce the actual 64-byte seed. Because every passphrase, including an empty one or a typo, produces a valid wallet, there is no error message to warn you the passphrase is wrong. That is why the passphrase must be written down just as carefully as the words themselves, and never stored in the same place as the phrase.

A passphrase also enables plausible deniability: a smaller amount can live in the wallet with no passphrase, while a larger amount sits in the passphrase-protected wallet. This is an advanced technique. The main risk is not theft but forgetting a passphrase you only kept in memory, which the standard does not protect you from.

How does an Electrum seed phrase differ from BIP39?

Electrum does not generate BIP39 seeds. It uses 12 words from the same 2,048-word list but embeds a version number that tells software which key-derivation scheme to use. The care required is identical, but an Electrum phrase is not freely interchangeable with every other BIP39 wallet.

Electrum’s documentation explains that keys and addresses are derived from a hash of the normalised phrase, so the phrase carries its own version prefix rather than relying on a fixed wordlist for its checksum. A standard Electrum seed provides about 135 bits of effective entropy. In practice this means you should back up an Electrum phrase exactly as you would any other, but restore it using Electrum itself or compatible software. See our Electrum setup and phishing guide for download and verification steps.

What is Shamir backup, also called SLIP-39, on Trezor?

Shamir backup, built on the SLIP-39 standard, splits a Trezor wallet into 20-word shares and needs only a chosen threshold of them, such as any 2 of 3, to recover. It removes the single point of failure of one 24-word phrase, but you have more shares to keep safe and setup is more work.

Trezor’s documentation calls Shamir Backup an older name for the SLIP-39 standard, which splits a backup into 20-word shares and needs a chosen threshold of them, such as any 2 of 3, to recover. Trezor separates this multi-share option from a single-share backup, which is one 20-word share kept by itself. As of November 2026, a 20-word single-share SLIP-39 backup is the default on the Trezor Safe 3, Safe 5 and Safe 7, with SLIP-39 becoming the default on the Safe 3 and Model T in June 2024. Older Safe 3 devices set up before June 2024 default to a 12-word BIP39 phrase instead, and multi-share Shamir remains an optional upgrade. Trezor warns against making digital copies of shares, and notes that if too many shares are lost to meet the threshold, the wallet cannot be recovered. A passphrase can be combined with Shamir backup but must be backed up offline too, never left to memory.

Shamir suits people who want to split control, for example one share at home, one with family and one in a bank box, while still needing only two to recover. The trade-off is that each share must be protected with the same care as a full phrase. For help choosing between hardware wallets, see our Ledger vs Trezor vs Coldcard comparison.

Is multisig a safer way to store a seed phrase?

Multisig requires several independent keys, often on separate devices or held by different people, to sign a transaction, so one stolen seed is not enough to spend the funds. It is powerful for high-value or shared custody, but it is harder to set up, and you must back up every key plus the wallet descriptor.

With multisig, compromising or losing a single phrase does not by itself let an attacker spend, or lock you out, as long as the other keys survive. Electrum has supported multisig since early versions, including standard multisig addresses, so a multisig wallet can be created in software or across hardware devices. The extra moving parts are the cost: a multisig setup usually needs a way to record which keys and derivation paths make up the wallet, not just the individual phrases. If that descriptor is lost, the funds can become unrecoverable even though every phrase is intact. Multisig is worth considering for large amounts or shared control, but most single-holder users are better served by steel plus a passphrase or Shamir shares.

Which seed phrase storage method should you choose?

Paper is the cheapest and fine for small amounts, while stamped steel is the standard upgrade for fire and flood resistance. A passphrase, Shamir shares or multisig each add protection against theft or a single point of failure. Most people are well served by steel in two locations, adding the advanced options only for larger holdings.

There is no single correct answer. If you hold a small amount, a written paper copy and one metal copy in two places is already strong. If the amount is large, steel plus a passphrase, or Shamir shares, reduces both theft and loss risk at the cost of extra care. Whatever you choose, the restore test in the step list above is the part most people skip, and it is the part that proves the backup actually works.

What are the common seed phrase mistakes, and how do you avoid them?

The costliest mistakes are storing the phrase digitally, photographing it, typing it into a website or app, sharing it with ‘support’, or keeping only one copy. Avoid them by writing on paper or metal, keeping two offline copies in separate places, and treating anyone who asks for the words as a scammer.

• Photographing or screenshotting the phrase. The image syncs to a cloud account and can be taken by malware. Write it down instead, and never store a photo of it.
• Typing the phrase into a website or form. BitPay calls requests to enter a recovery phrase the classic red flag of a phishing attempt. No legitimate wallet or exchange asks you to type your seed anywhere.
• Sharing it with ‘support’. Fake support agents on social media and forums ask for the phrase to ‘help’. Real support teams never need your seed. Trezor’s own guidance warns against uploading or digitising your shares for the same reason.
• Keeping it in a password manager or cloud note. A cloud breach can expose everything you store there. Keep the phrase on paper or metal, offline.
• One copy only. A single fire, flood or theft then destroys the wallet. Keep two copies in separate locations.
• Relying on memory. A forgotten phrase, or a forgotten passphrase, cannot be recovered by anyone.
• Never testing the restore. A phrase with a wrong word or order only shows itself as a problem the day you need it. Test recovery before funding.
• No inheritance plan. If only you know where the backup is, the funds die with you. Leave instructions for a trusted person without putting the full phrase in an email.

Fake support and ‘verify your wallet’ scams are widespread, and they often start with a message claiming your wallet has been viewed or needs a firmware update. The defence is simple and absolute: never enter your seed phrase anywhere, and treat any request for it as fraudulent. For more on the kinds of free-crypto and giveaway lures that lead people into these traps, see our guide to free Bitcoin offers and scams. If you are moving funds off an exchange for the first time, our exchange-to-wallet walkthrough covers the safe sequence.

Crypto assets are volatile, and this guide is not financial advice. It is about protecting keys and backups, not about choosing what to hold.