TL;DR (concentrated takeaways)
A crypto wallet passphrase is an optional feature that can be used in addition to your seed phrase to restrict access to your crypto wallet. The BIP-39 standard defines both the passphrase and the seed phrase.
Passphrases offer extra security in the event that your seed phrase is exposed, or if someone else gains access to your hardware wallet.
Passphrases also allow you to create multiple crypto wallets from a single seed phrase – in this way, you could even create a dummy wallet that would provide “plausible deniability” of your true holdings.
If you lose your passphrase, you will likely lose access to your crypto!
Because of the added risk of passphrase loss, passphrases are recommended only for experienced users.
Any and all passphrases must be carefully included in your crypto backup plan!
Vault12’s distributed, encrypted backup technology makes it safe for you to store both seed phrases and passphrases in your Digital Vault.
A wallet passphrase is one more layer of security for your crypto wallet
Crypto wallet passphrases can be added during your wallet configuration as an extra layer of security. Passphrases are different from seed phrases, and different from wallet app PINs. Its mechanism is defined by the Bitcoin Improvement Proposal (BIP) BIP39 standard.
To recap where passphrases fit in: you already know that when you have a self-custody crypto wallet, your wallet seed phrase (also sometimes called a mnemonic code, recovery phrase, or mnemonic sentence) is a secret that can be used to reconstruct your crypto wallet, and to perform transactions. A well-chosen seed phrase offers excellent wallet protection, since it is not able to be guessed … but If someone is able to use some other clever method to steal your seed phrase, then they could reconstruct your wallet, and take all of the crypto out. Unless, that is, your wallet is protected with a passphrase.
Unlike a seed phrase, if you set a passphrase, you need to enter that passphrase every time you run your wallet app in order to see your crypto. In this way, having a passphrase is very much like having 2-factor authentication for your wallet (although it leverages “two things that you know,” rather than “something that you have/are” plus “something you know”).
Note that your crypto wallet should not store passphrases – so even if there were a known or unknown vulnerability in your wallet, your passphrase could not possibly be extracted. Trezor highlights this fact on their security page.
If you’d like to refresh your memory about the basics of how crypto wallet seed phrases and passphrases work, consider reviewing the Vault12 article about the BIP39 standard.
Be aware that some wallets use words other than the term “passphrase” that comes from the original BIP39 standard. You may see passphrases called a “seed extension,” “extension word,” “extension phrase,” “13th word,” or “25th word.” For the sake of clarity, we will stick with the term “passphrase” here.
Passphrases increase both your protection and your risk too
Passphrases increase the complexity of your crypto wallet and your backups, because if you lose your passphrase, you will probably lose your crypto. Setting a passphrase burdens you with the risk that you could fail to properly back it up, or that your backup could fail. Your passphrase must be backed up just as carefully as your seed phrase.
Also, depending on how you have chosen to back up your seed phrase, it may be advisable to back up your passphrase in a different place or way than your seed phrase. Consider that if both the seed phrase and the passphrase are sitting together in your physical safe, and your safe is broken into, the thief will have both secrets, and the passphrase wouldn’t offer any added protection.
If you were to back your seed phrase up in one place and your passphrase in another place, it would be critical for both of those storage locations to be reliable (so not just a magnetic disk in your closet, or your memory). Additionally, each of your separate chosen storage mechanisms would likely have a unique set of passwords, PINs, or other identifiers to access them … making the complexity of storing your seed phrase and your passphrase separately very high.
The core reason that it is safe to store both your seed phrase and your passphrase together in the Vault12 Digital Vault is because Digital Vault contents are stored in a distributed way as encrypted shards of data – no individual besides you can access a copy. This gives you both redundancy and personal control at the same time as the convenience of a single easy-to-use interface.
Because the concept of passphrases is tricky, and because some people would not carefully back it up, many crypto wallet vendors do not expose the passphrase feature by default … it may need to be enabled in wallet Settings. Some wallets don’t support passphrases at all. Like a sharp knife, a wallet passphrase is an excellent tool in careful hands – but experts recommend that users do not set a passphrase unless they have spent the time to fully understand the risks and responsibilities that go along with setting one and backing it up. No matter how careful you are with your crypto, your passphrase is a single point of failure (SPOF) if lost. There is a lot at stake!
Passphrases should be hard to guess
As you would expect, any passphrase that you set should be strong. A passphrase acts like an extra-long password, and contains multiple words. Because they can contain multiple words, and even space characters, passphrases can be both long and more rememberable than a regular password.
A simple passphrase could be brute-force guessed within a few hours, days, or weeks. Many experts point out that the practical defensive benefit of a passphrase is to buy you extra time to move your crypto funds if you discover the theft of your seed phrase or hardware wallet. The longer and more-complex your passphrase, the more time you have to move your funds before the bad actor does.
For more guidance, you could review this article about password management that includes a specific section about how to choose a good multi-word passphrase. You should also keep in mind that different wallet vendors allow different length limitations (e.g., Trezor: 50 characters; Coldcard: 100 characters; Ledger: 100 characters). These differences in allowed passphrase length become important if you think that you may want to change hardware wallets in the future to one with a shorter maximum passphrase length. A 50-character passphrase, assuming that it contains sufficient unpredictability, offers very strong protection.
By default, wallets use a blank passphrase
If you do not set any passphrase when you configure your wallet, a blank passphrase is used by the wallet to determine where your crypto is stored on the blockchain network. If you do set a passphrase, your wallet stores your crypto at a different place on the blockchain.
What this suggests is that if you set a passphrase when you configure your wallet, and then you put some crypto into your wallet – all is well; you see your crypto! But then if you decide to install a second wallet, using just your seed phrase and no passphrase, the wallet with no passphrase would show you a zero balance! This behavior can lead some beginners to think that they have lost all of their crypto, when actually, they just did not configure their second wallet with the same passphrase that they used when they set up their first wallet. All they would need to do to correct this situation is to re-open the second wallet and provide the correct passphrase.
Wallet passphrases can be used for multiple purposes
Now that we’ve reviewed the basics, now let’s consider the main ways that wallet passphrases can protect your crypto.
- A passphrase adds an extra authentication step: If you set up a crypto wallet with a seed phrase and a passphrase, you have extra protection if your seed phrase is exposed, or if your hardware wallet is exposed or lost, since both the seed phrase and the passphrase are needed to access the wallet.
- A passphrase-protected wallet can act as a “hidden” wallet: If you set up a crypto wallet with a seed phrase and a passphrase, you really have two wallets: one uses a passphrase, and one does not. You could switch between them by exiting and re-opening the same wallet application, based on whether you entered the passphrase or not. Or you might choose to use only the passphrase-protected wallet and not use the passphrase-free wallet at all.
- Multiple passphrases could be used to create multiple wallets: If you configure a more complex setup with one seed phrase and multiple passphrases, you create multiple wallets. As described above, you have the ability to choose which of the wallets is shown when you enter the passphrase to open your wallet application. In this way, you could choose to have several wallets, each with a different mix of crypto funds.
Read on to explore more detail about these uses.
It is easy for beginners to become confused when creating multiple wallets from a single seed phrase. Do not attempt this advanced functionality unless you thoroughly understand the concepts!
BIP-39 Passphrases help if your seed phrase or hardware wallet are stolen
Whether you plan to use multiple crypto wallets or not, setting a passphrase is sensible protection if you are not able to keep your seed phrase or hardware wallet perfectly secure (for example, maybe you can not fully control who may come or go from your home, hotel, office, or room due to shared accommodations or staff access). Because of the chance that your seed phrase or hardware wallet could be stolen or examined by an unauthorized person, it can be very helpful to add a passphrase in order to reduce this risk of illegitimate access.
Would you know whether your wallet or seed phrase were compromised? Maybe … your physical safe might show signs of forced opening, or you may realize that you absentmindedly left your seed phrase lying around unprotected. Maybe your hardware wallet is missing from where you normally keep it. If you are not sure whether your seed phrase was leaked or taken, but you think that it could have been, it is best to assume that it was compromised, and quickly take action!
If your wallet may be compromised … sweep it!
If you have a passphrase-protected wallet and you suspect that your hardware wallet or your seed phrase backup was compromised, your passphrase will hopefully protect your crypto until you move your crypto to a different wallet. As long as you move your crypto before the potential thief cracks your passphrase, you get to keep your crypto. To move your crypto into a new wallet, create a new wallet with a different seed phrase, and then send all of the crypto stored in your old wallet to the Receive address of your new wallet.
Moving crypto funds to a different blockchain address that you generated with a new seed phrase is called “sweeping,” or key rotation.
Beware of the $5 Wrench Attack!
The following image humorously demonstrates what has come to be called a “$5 wrench attack.” It shows that a bad actor could just threaten you with a cheap wrench to physically force you to open your wallet for them.
This kind of attack serves as a reminder of why you should be very careful who you allow to know that you own any crypto – it can make you an appealing target for all kinds of thieves. This is one of the major reasons that privacy is so important for crypto owners.
Inspired by original https://xkcd.com/538/
Protecting against the Wrench Attack with passphrases
To protect against the $5 wrench attack, you could establish a “dummy wallet” by using an “extra” passphrase with your hardware wallet. The ability to show someone a “fake wallet” instead of your real crypto holdings if you are under duress is a form of “plausible deniability.”
To understand how this works, remember that when you open your crypto wallet application, you only see the assets associated with the wallet that corresponds with the passphrase that you entered.
For example, you could configure three wallets with the same seed phrase and different passphrases. If you access the wallet using no passphrase, it could show you a small amount of crypto that you might use for day-to-day spending. If you access the wallet using passphrase “My$trongW0rd,” it could show you a moderate balance that you might choose to sacrifice to a physical attacker. But if you access the wallet using passphrase “My$trongW0rd_real,” it could show you the majority of your crypto holdings. In this example, as shown in the image below, if you were subject to physical attack, you could allow the attacker to have one or two small wallets, but not let them know that you have the larger wallet hidden with a different passphrase.
This example shows how one could use pass phrases to generate a dummy wallet that one could show an attacker instead of the actual wallet. Everyone should devise their own personal strategy.
Multiple passphrases can be helpful in more than one way
Generating multiple wallets from the same seed phrase might come in handy in a few scenarios:
- Defense against a physical attack (as described above): You can have a “dummy wallet” that you plan to offer if you are forced against your will to open your wallet.
- Categorization: You might want to set up several crypto wallets as multiple “buckets” that you use for different purposes (maybe based on whether you intend to save it or spend it, whether you have held it for long enough to qualify for capital gains taxation, whether it is shared with your family, etc.)
- Privacy: You might not want to keep a significant amount of crypto value in any one wallet address for privacy purposes.
Passphrases and your crypto backup strategy
Your backup strategy needs to include all passphrases that you use, and, if you have multiple seed phrases, it needs to indicate which passphrase goes with which seed phrase.
It is becoming more common for people to maintain multiple separate crypto wallets for various reasons. Some of these reasons are described above. You might have decided to keep multiple hardware wallets in order to perform multisig transactions. Or you might be trying out a new wallet or service … there are many reasons that you could find yourself juggling multiple wallets. However you may have ended up with multiple wallets, it is critical that your backup strategy keeps track of which passphrases should be combined with which seed phrases!
When deciding how to organize your crypto backup strategy, think about each wallet backup “bundle” as if you were starting with zero knowledge and zero trusted devices (like your smartphone). What would you need to know to access each wallet? Accessing any individual wallet might require someone to know how to access your seed phrase backup (which might include a safe vault or decryption code), passphrase(s), and possibly 2FA backup codes. The exact information to be stored depends on what forms and methods you chose to protect your secrets.
Think your unique situation through carefully.
The Vault12 Digital Vault securely stores your passphrases
Fortunately, you can keep all of your backup codes in one place if you store them in your Vault12 Digital Vault. Vault12 offers a uniquely safe way to store these sensitive pieces of data together because of how it distributes encrypted shards of your digital vault in multiple places. You have the flexibility to organize and describe your backup strategy in your choice of formats, whether in a simple way (with a single seed phrase), or in a complex way where you describe multiple wallets with unique seed phrases, passphrases, and other codes. Once your backup is safely stored away, you have the peace of mind of knowing that you or your choice of beneficiary will be able to access your vault and your crypto when needed.