How to Use a Passphrase on a Hardware Wallet

How to use the optional 25th-word passphrase on Ledger / Trezor for plausible deniability and additional security.

What you'll need (prerequisites)

• Self-custodial wallet
• A second device for verification
• Block explorer (Etherscan, Solscan, etc.) familiarity

Step-by-step

1. Step 1: What a passphrase (25th word) is

   A passphrase is an extra secret you add on top of your recovery phrase that derives a completely separate, hidden wallet. Each different passphrase produces a different set of accounts, so your standard 24 words alone reveal nothing about the hidden funds. This enables plausible deniability: a coerced user can surrender the base wallet while the passphrase-protected wallet stays invisible.

2. Step 2: How it differs from your PIN

   The PIN only unlocks the physical device and can be reset by wiping and restoring from the seed; it never changes which accounts exist. The passphrase is part of key derivation — it literally computes a different wallet — and is not stored on the device at all. Lose the PIN and you can restore; lose the passphrase and the hidden wallet is gone.

3. Step 3: Enable it on Ledger or Trezor

   On Ledger, open Settings then Security and turn on Passphrase; you can enter it per session or choose "Attach to PIN" so a second PIN opens the hidden wallet. On Trezor, connect in Trezor Suite, open Settings then Device then Security and toggle Passphrase on, then pick "Passphrase wallet" and type it each time you connect. The passphrase is entered fresh and never saved.

4. Step 4: Choose a strong, memorable passphrase

   Pick something with real entropy that you can reproduce exactly, since it is case-sensitive and every character counts (Trezor allows up to 50). Avoid a single dictionary word an attacker could guess, and avoid characters you might mistype. A short passphrase adds little protection; a random multi-word string you can reliably recall is ideal.

5. Step 5: Understand a forgotten passphrase is unrecoverable

   There is no reset, hint, or support path: the passphrase is never stored anywhere, so if you forget it the hidden wallet and its funds are permanently lost. Even one wrong character silently opens a different, usually empty wallet instead of warning you. This is the single biggest risk of using the feature.

6. Step 6: Back it up separately and test with a small amount

   Record the passphrase and store it in a different secure location from your seed phrase, so no single found backup exposes the hidden wallet. Before moving significant funds, send a small test amount, disconnect, then reconnect using the passphrase to confirm the same wallet reappears exactly. Only then fund it fully.

Common errors and fixes

• Approval can't be revoked due to insufficient gas. Revoke transactions cost the same gas as a normal token transfer. Top up the wallet with a small amount of native gas token before revoking.
• Funds already drained. On-chain theft is generally irreversible. Document everything, file police / IC3 / Chainalysis Reactor reports, and contact the protocol team if a known exploit. CEX-side funds may be recoverable if the attacker on-ramped to a regulated exchange.
• Suspected key leak but no losses yet. Move all funds immediately to a freshly created wallet. Burn the old seed. Audit every device the seed touched (browser extensions, cloud backups, email).
• Cannot identify the malicious contract. Use Etherscan's "advanced filter" to filter by token approvals and unusual contract calls. Run the suspicious tx through Tenderly to decode the call.
• Phishing email looks real. Always verify by typing the URL manually. Real exchanges and protocols never email asking for seed phrase, password, or 2FA codes — full stop.

FAQ