Orca Crypto
Safety

Seed phrase security

The highest stakes twenty minutes in crypto. Get it right once and it protects you for years.

Updated 2026-08-308 min readEssential
The short answer

A seed phrase is twelve or twenty four words that regenerate every private key in your wallet. Store it handwritten on paper or stamped in steel, in at least two separate physical locations, and never photograph it, type it into any website, or store it in a notes app, password manager or cloud drive.

What those words actually control

The seed phrase is not a password to one account. It is the master secret from which your wallet derives every key, on every chain, including accounts you have not created yet.

Anyone with those words has everything, instantly and irreversibly. That is why the storage question is the whole security question.

Storage, ranked

MethodSurvives fireSurvives theftVerdict
Stamped steel plateYesOnly if well hiddenBest for meaningful amounts. Inexpensive relative to what it protects
Handwritten paper, two locationsOnly one copy at a timeOnly if hiddenThe sensible default for most people
Bank safe deposit boxYesYesGood for one copy. Access can be restricted during probate
Password managerYesDepends entirely on that accountNot recommended. One breach takes everything
Photo on your phoneNoNoNever. It syncs to the cloud automatically
Notes app or a text fileNoNoNever. Malware scans for exactly this
Only in your memoryNoYesNever. Memory is not a backup

Doing it properly

  1. Write it by hand, numbered

    Block capitals, numbered one through twelve or twenty four. Order is part of the secret, and handwriting beats printing because printers keep records.

  2. Make a second copy

    Two copies, two locations, far enough apart that one event cannot destroy both. A relative house, a safe deposit box, a second property.

  3. Do not label it obviously

    A sheet titled Bitcoin Seed Phrase is an instruction to whoever finds it. Store it without explanation.

  4. Test the restore

    With an empty or nearly empty wallet, wipe and restore from your written copy. This is the only proof your backup works.

  5. Consider steel for larger amounts

    Steel plates survive house fires. Paper does not. If you hold enough that a fire would be a disaster, this is a cheap fix.

  6. Write down where it is

    Not the phrase itself. A sealed instruction telling a trusted person where to look. See recovery planning.

Loss beats theft, statistically
The most common failure is not theft, it is loss. Fires, moves, a spouse tidying up, a hard drive dying. Two copies in two places solves nearly all of it.

The optional passphrase

Most hardware wallets support an extra passphrase, sometimes called a twenty fifth word. It combines with the seed to produce a completely separate set of accounts.

The upside is that finding your written seed is not enough. The downside is severe: the passphrase is stored nowhere, so forgetting it loses those funds permanently with no recovery path at all.

Take care
Only use a passphrase if you have a clear plan for remembering it and backing it up separately. For most people it adds more risk than it removes.

Splitting the phrase

Some people split a phrase across locations, four words in three places. Done naively this is dangerous: losing one part loses everything, and holding eight of twelve words meaningfully reduces the search space for an attacker.

If you want redundancy with splitting, look at Shamir backup, which is designed for this and lets any two of three shares reconstruct the secret. Trezor supports it natively.

Common questions

Can I store my seed phrase in a password manager?

We do not recommend it. Your password manager is only as strong as its master password and its own security, and a single breach would take everything at once. Paper and steel do not have remote attack surfaces.

What if I lose one word?

Recovery is sometimes possible, because BIP-39 includes a checksum and tools can test candidates. Use open source tools only, run them fully offline, and expect failure if more than one word is missing.

Is 24 words meaningfully safer than 12?

Not in practice. Twelve words give 128 bits of security, which is already far past any brute force attack. The threat is exposure, not guessing.

Someone claiming to be support asked for my phrase. Is that ever legitimate?

Never. Not once, not under any circumstances, not for any reason. There is no legitimate process anywhere in crypto that requires you to reveal it.

Where to go next

Get a second pair of eyes on your setup

A security session reviews what you hold, where it sits, what approvals are open and what would happen if your laptop were compromised tomorrow. Most people find at least one thing worth fixing.