Wallets and Security · 2026-07-16 · By Marcus Cole, Wallets and Security Editor · 11 min read
What Is a Seed Phrase?
A seed phrase is a sequence of 12 or 24 ordinary English words that acts as the master key to your entire crypto wallet. Anyone who has your seed phrase has complete, permanent control of every asset in that wallet. Keeping it safe is the single most important security action a crypto holder can take.
The Plain-English Explanation
When you set up a crypto wallet, whether software or hardware, the wallet generates a seed phrase and displays it once. This phrase is the origin point for all of your private keys: the cryptographic secrets that prove you own the addresses holding your crypto. Think of it as the master key that unlocks a hotel safe containing every room key in the building. Lose the master key and you can never get back in. Give it to someone else and they walk out with everything.
The phrase looks like this: a list of everyday words, such as "correct horse battery staple river cloud orbit fence marble pivot anchor dawn." Each word is drawn from a standardized list of 2,048 words defined by a protocol called BIP-39 (Bitcoin Improvement Proposal 39), which is used by nearly all modern wallets.
How a Seed Phrase Works
The math behind a seed phrase is easier to understand than it sounds. Here is what happens when your wallet generates one:
- Random number generation: Your wallet creates a large random number using your device's secure random number generator.
- Word conversion: That random number is converted into 12 or 24 words from the BIP-39 list. The words encode the number in a human-readable format.
- Key derivation: Your wallet uses the phrase to mathematically derive every private key it will ever use. The same phrase always produces the same keys, on any wallet, in any country, on any device. This is how recovery works.
Because the process is deterministic (same input always gives the same output), entering your seed phrase into a new wallet restores all of your accounts and balances exactly as they were. The crypto never moves: it stays on the blockchain. What the seed phrase recovers is your ability to control it.
12 Words vs 24 Words: Does It Matter?
Both 12-word and 24-word seed phrases are widely used and considered secure by cryptographic standards. A 12-word phrase represents 128 bits of entropy; a 24-word phrase represents 256 bits. For practical purposes, both are effectively impossible to guess through brute force. The difference is relevant to academic cryptographers, not to most holders.
Ledger wallets generate 24-word phrases by default. Trezor and most Ethereum-focused software wallets default to 12 words. Both are fine. Read our Ledger vs Trezor comparison if you are choosing between hardware wallets.
How to Store Your Seed Phrase Safely
This section matters more than the technical explanation above. Most seed phrase losses happen not because of cryptographic failure but because of bad storage habits.
What to Do
- Write it on paper using a pen, the moment your wallet displays it. Write clearly and check each word twice.
- Store it offline in a physically secure location: a locked safe, a fireproof box, or a location only you know about. Some users make two copies stored in separate locations.
- Consider a metal backup. Paper burns and floods. Steel plates or capsules designed for seed phrase storage survive most physical disasters. Several products are sold for this purpose, available at hardware and outdoor stores.
- Verify it immediately. Most wallets ask you to confirm your seed phrase after displaying it. Take this seriously: it is your only test that the backup is correct before you fund the wallet.
What Never to Do
- Never photograph it or take a screenshot. Cloud photo services sync automatically, exposing your phrase to any device logged into that account.
- Never type it into any website, app, or form unless you are deliberately restoring a wallet on a verified, official app. Any other use is a scam.
- Never email or message it to yourself. Email accounts are regularly breached. A seed phrase in your inbox is a seed phrase waiting to be stolen.
- Never store it in a password manager as your only backup. Password managers are encrypted cloud software: a strong tool for passwords, but not the right tool for the one secret that controls your entire crypto portfolio.
- Never share it with anyone, including customer support. No legitimate wallet company, exchange, or support agent will ever ask for your seed phrase. If anyone asks, it is a scam, guaranteed.
What Scammers Do with Seed Phrases
The seed phrase is the primary target of nearly every sophisticated crypto attack. Here is how attackers go after it:
Fake Wallet Apps
A scammer creates a fake version of a popular wallet app and submits it to app stores or promotes it via search ads. When you "set up" the wallet, the app sends your generated seed phrase to the attacker's server. Your wallet looks functional until the attacker empties it.
Rule: only download wallet software directly from the official project website. For MetaMask: metamask.io. For Trezor Suite: trezor.io/trezor-suite. For Ledger Live: ledger.com/ledger-live. Never search for wallet apps in app stores and download the first result.
Support Scams
You post in a Reddit thread or Discord server about a wallet problem. Within minutes, a "support agent" with an official-looking profile offers to help via direct message. They ask for your seed phrase to "restore" or "verify" your wallet. They drain it within seconds of receiving the words.
No real support agent ever needs your seed phrase. Ever.
Romance and Investment Scams
A more sophisticated variant is the tinder crypto scam (pig butchering), where a stranger builds an emotional relationship before steering you toward a fake investment platform. While pig butchering typically involves moving funds willingly rather than surrendering a seed phrase, some variants do directly request access to your "wallet" under the pretense of a technical setup. The result is the same.
What to Do If Your Seed Phrase Is Compromised
If you have any reason to believe someone else has your seed phrase, act immediately:
- Create a new wallet on a clean device and generate a new seed phrase you have never exposed.
- Move all assets from the compromised wallet to the new wallet addresses as fast as possible. Do not transfer everything in one transaction if gas fees make small amounts not worth moving.
- Do not reuse the compromised wallet. Once a seed phrase is exposed, assume that wallet is permanently owned by whoever has the phrase.
- Report the theft to the FTC at reportfraud.ftc.gov and the FBI IC3 at ic3.gov. Include any wallet addresses you can identify.
Seed Phrase vs Private Key vs Password: What Is the Difference?
| Term | What It Is | Can You Change It? |
|---|---|---|
| Seed phrase | 12 or 24 words that derive all of your wallet's private keys | No. A new seed phrase means a new wallet at new addresses. |
| Private key | The cryptographic secret for one specific address | No. It is derived from the seed phrase and is fixed. |
| Wallet password / PIN | A PIN or password that locks the wallet app or device | Yes. This is a convenience lock, not a backup. Losing it alone does not lose your funds. |
| Exchange password | Login credential for a centralized exchange account | Yes. Exchange accounts are custodial: the exchange holds the keys, not you. |
Where to Store Crypto If You Are Not Ready for a Hardware Wallet
If you use a software wallet like MetaMask, Trust Wallet, or Coinbase Wallet, the same seed phrase rules apply. Your phrase is just as sensitive with a software wallet as with a hardware wallet: the difference is that a software wallet stores the keys on an internet-connected device, which increases risk. For any holding you care about protecting, a hardware wallet moves the keys to an air-gapped device.
If you prefer to hold crypto on an exchange while you learn the basics, understand the trade-off: on a centralized exchange, you do not control the keys, the exchange does. Read our guide to centralized vs decentralized exchanges to understand what that means for your control and risk profile.
Frequently Asked Questions
What happens if I lose my seed phrase?
If you lose your seed phrase and your device is damaged, stolen, or reset, you permanently lose access to your crypto. There is no account recovery, no customer support line, and no password reset. This is by design: the security model requires that you, and only you, control the backup. Write it down, store it securely, and verify it when your wallet first asks.
Is it safe to store my seed phrase in a password manager?
No, not as your primary backup. Password managers are cloud-synced software. A breach of your password manager account would expose your seed phrase. A physical, offline backup (paper or metal) that never touches any network is the standard recommendation.
Can someone guess my seed phrase?
Not in any practical sense. A 12-word seed phrase has 2^128 possible combinations: that is a number with 38 digits. The fastest computers on earth would take longer than the age of the universe to try even a tiny fraction of the possibilities. Guessing is not a viable attack vector. The real risks are theft, social engineering, and poor storage habits.
What is a passphrase and how is it different from a seed phrase?
A passphrase (sometimes called the "25th word") is an optional, user-chosen addition to your seed phrase supported by many hardware wallets. Together, the seed phrase plus the passphrase derive a completely separate wallet. It adds a layer of protection: even if someone finds your written seed phrase, they cannot access the wallet without also knowing the passphrase. The downside: if you forget the passphrase, you lose access to that wallet permanently, even with the correct seed phrase.
Do all wallets use the same seed phrase format?
Nearly all modern wallets use BIP-39 (the standard word list) and BIP-44 (the standard path derivation). This means a seed phrase from MetaMask will typically restore the same Ethereum addresses in Trezor Suite or Ledger Live. However, some older wallets and some Bitcoin-only wallets use slightly different derivation paths, which can cause confusion when migrating. Always verify compatibility before assuming a phrase will restore the same addresses in a different wallet app.
Should I share my seed phrase with a crypto exchange if asked?
Never. No legitimate exchange, support agent, or service ever needs your seed phrase. If anyone asks for it, they are attempting to steal your funds. This applies to requests that arrive via email, Discord, Telegram, Reddit, phone, or any other channel.
Last reviewed July 2026. Best practices in wallet security evolve. Check official documentation for your specific wallet before acting on any guidance in this article.
Marcus Cole, Wallets and Security Editor
Author