How to Secure Your Seed Phrase
Best practices for storing your seed phrase: paper, metal backups, geographic separation, multisig, and what NOT to do.
What you'll need (prerequisites)
- Self-custodial wallet
- A second device for verification
- Block explorer (Etherscan, Solscan, etc.) familiarity
Recommended for this tutorial
Tools and accounts referenced in the steps below:
Step-by-step
-
Step 1: What your seed phrase actually is
A seed phrase (recovery phrase) is the human-readable form of the master key to your wallet. Anyone who reads those 12 or 24 words can regenerate every private key and move every asset — no password or device required. It cannot be reset like a login, so treat it as the single most sensitive secret you own.
-
Step 2: Record it offline on paper or metal
Write the words by hand on paper, or stamp them into a steel backup plate for fire and water resistance. Never photograph them, type them into notes, or save them to email, cloud, a password manager, or any synced file. Anything connected to the internet can eventually be breached or scraped.
-
Step 3: Never enter it into any website or app
No legitimate wallet, exchange, support agent, migration tool, or airdrop claim page will ever ask you to type your seed phrase. Entering it anywhere online hands over full control instantly. The only place a phrase is ever re-entered is directly on a wallet device you are deliberately restoring.
-
Step 4: Store redundant copies in separate locations
Keep at least two backups in different physical places, such as a home safe and a bank deposit box, so a single fire, flood, or burglary cannot erase your access. Do not label them "crypto," and do not store a backup right next to the hardware wallet. Geographic separation is what protects against localized disasters.
-
Step 5: For larger holdings, add a passphrase, Shamir, or multisig
A BIP39 passphrase (25th word) creates a hidden wallet that is useless to a thief who finds only your 24 words. Shamir Backup (SLIP39) splits the secret into multiple shares, requiring a threshold of them to recover. Multisig requires several independent keys to sign, removing any single point of failure for large balances.
-
Step 6: Verify the backup and keep phishing hygiene
Before funding the wallet, confirm your written words actually restore it — one wrong or mis-ordered word makes the backup worthless. Double-check spelling against the BIP39 wordlist. Stay alert to phishing afterward: no genuine service ever requests your phrase, and "sync your wallet" or urgent-action prompts are red flags.
Common errors and fixes
- Approval can't be revoked due to insufficient gas. Revoke transactions cost the same gas as a normal token transfer. Top up the wallet with a small amount of native gas token before revoking.
- Funds already drained. On-chain theft is generally irreversible. Document everything, file police / IC3 / Chainalysis Reactor reports, and contact the protocol team if a known exploit. CEX-side funds may be recoverable if the attacker on-ramped to a regulated exchange.
- Suspected key leak but no losses yet. Move all funds immediately to a freshly created wallet. Burn the old seed. Audit every device the seed touched (browser extensions, cloud backups, email).
- Cannot identify the malicious contract. Use Etherscan's "advanced filter" to filter by token approvals and unusual contract calls. Run the suspicious tx through Tenderly to decode the call.
- Phishing email looks real. Always verify by typing the URL manually. Real exchanges and protocols never email asking for seed phrase, password, or 2FA codes — full stop.
FAQ
Is a 12-word phrase less secure than a 24-word phrase?
Both are generated from strong entropy — 12 words gives about 128 bits of security and 24 words about 256 bits, and both are far beyond any brute-force attack today. The real risk is always how you store the words, not how many there are. Use whatever your wallet generates and back it up carefully.
Should I split my seed phrase in half to store it?
No. Naively splitting a phrase — words 1-12 in one place, 13-24 in another — actually weakens it, because finding one half drastically shrinks the guessing space for the rest. Use a purpose-built scheme like Shamir Backup (SLIP39) or multisig, which are designed to split a secret safely.
Can I store my seed phrase in a password manager?
It is strongly discouraged. A password manager is an online, syncable target; if the vault is breached or your master password is phished, the phrase goes with it. Keep the phrase strictly offline on paper or metal.
What should I do if someone may have seen my seed phrase?
Assume the funds are at risk and act immediately. Generate a brand-new wallet from a fresh seed on a clean device, move everything to it, then retire the exposed phrase. Anyone who has the words keeps full access forever, and on-chain transfers cannot be reversed.
Is a metal backup really necessary?
Paper records the words fine but is destroyed by fire and water. A stamped or engraved steel plate survives house fires and floods, so it is a worthwhile upgrade for any balance you intend to hold long term.