Seed phrase security: back up, test and pass on your recovery phrase

What a recovery phrase is

When you set up a self-custody wallet, it usually shows you a list of 12 or 24 ordinary words in a set order. That list is your recovery phrase, often called a seed phrase. It is a human-readable form of the master secret your wallet uses to generate all of its private keys and addresses.

The practical meaning is simple: the phrase is the wallet. If your phone breaks or your hardware device is lost, you can type the phrase into a compatible wallet and every address and balance comes back. If someone else gets the phrase, they can do exactly the same thing from anywhere in the world, without your device or your PIN.

Because of that, the phrase deserves more care than any password you own. A password protects access to an account that a company can reset. A recovery phrase is the only key, and nobody can reset it.

Backing it up properly

A good backup has three qualities: it is offline, it is durable and it exists in more than one place, without being easy for others to find.

• Offline only. Write the words by hand. Do not photograph them, screenshot them, type them into a notes app, email them to yourself or store them in a cloud drive or password manager synced online. Anything that touches an internet-connected device can be copied by malware or exposed in a breach.
• Durable. Paper fades, burns and floods. Many people copy the words onto a metal plate or stamp kit designed for this purpose so the backup survives fire and water.
• More than one location. One copy at home and another in a separate secure place, such as a safe deposit box or with a trusted person in a sealed envelope, protects against a single fire or break-in.
• Discreet. Do not label it “crypto recovery phrase”. A plain envelope in a safe place draws less attention.
• Never typed into a website. The only time you should enter the phrase is when you are restoring a wallet on a device you trust, inside the wallet software itself.

There is a tension here. More copies mean less risk of loss but more risk of theft. Two or three well-chosen locations is a common balance. Some people split the risk with a multisig setup instead, which the crypto wallets guide explains.

The optional passphrase

Many wallets let you add a passphrase, sometimes called a “25th word”. It is an extra word or sentence that you choose, combined with the recovery phrase to produce a completely different set of keys.

The benefit: if someone finds your written recovery phrase, it is not enough on its own. They also need the passphrase. The cost: if you forget the passphrase, the funds behind it are gone, even though you still have the 24 words. There is no hint, no reset and no way to guess it at scale.

If you use one, store the passphrase separately from the recovery phrase, and make sure the instructions you leave for your family mention that it exists. A passphrase is a strong tool for people who are organized about records. It is a trap for people who are not.

Testing a restore with a small amount

A backup you have never tested is a hope, not a plan. The safest way to test is with a small amount before you move anything significant.

If the restore fails, you have learned that cheaply. Fix the backup, start again with a fresh wallet if needed, and test once more.

Inheritance planning in plain terms

If something happened to you, could the people you care about reach your crypto? With self-custody, the honest answer is often no, unless you planned for it. Funds without an accessible backup are permanently out of reach.

A workable plan does not have to be complicated:

• Keep a simple inventory: which wallets and platform accounts exist, roughly what is in each and what type of wallet software is needed to restore them. Do not put the recovery phrase itself in this document.
• Decide where the backups live and make sure your executor or a trusted person knows how to reach them when the time comes, for example through a lawyer or a sealed letter stored with your will.
• Write plain instructions that a non-technical person could follow, including whether a passphrase exists and where it is kept.
• For platform accounts, note the platform name and that it holds funds, so your estate can contact it.
• Review the plan when you add a wallet or change a backup location.

Anyone asking for your seed phrase is a scammer

This rule has no exceptions. No legitimate wallet maker, platform, support agent, developer, regulator, police officer or tax authority will ever need your recovery phrase. A request for it, however official it looks, is an attempt to take your funds.

Common forms include fake “wallet validation” pages, pop-ups claiming your wallet is out of sync, social-media accounts offering support after you post a question, and messages saying you must “verify” your phrase to receive an airdrop or refund.

If you have already shared it, assume the wallet is compromised. Using a new wallet with a new phrase on a clean device, move any remaining funds there as quickly as you safely can. Then follow the scam response checklist and report what happened through reporting fraud in Canada.

Your checklist

• Write the recovery phrase by hand, numbered and checked against the screen.
• Make a durable copy (for example, metal) and store copies in at least two secure places.
• Delete any photo, screenshot or digital note that contains the phrase.
• Decide whether a passphrase suits you, and record where it is kept if you use one.
• Test a restore with a small amount before adding real funds.
• Leave plain instructions for your executor that point to the backups without revealing them.
• Treat every request for your phrase as a scam.

Sources and dates

• Ethereum wallets — ethereum.orgreference
  No date shown on page · checked 2026-10-31. What wallets are and how they hold keys.
• Ethereum security and scam prevention — ethereum.orgreference
  No date shown on page · checked 2026-10-31. Wallet security habits and common scams.
• Report fraud and cybercrime — Canadian Anti-Fraud Centrereference
  No date shown on page · checked 2026-10-31. How Canadians report fraud and cybercrime, including crypto scams.