Seed Phrase Passphrase: The 25th Word Guide

Most Bitcoin users know their 12 or 24-word seed phrase is the master key to their funds. Fewer realize there is a standardized mechanism built into BIP39 that lets you add an extra word — a passphrase — that fundamentally changes the wallet derived from that seed. This passphrase is often called the “25th word,” though it can be any string of characters, not just a single dictionary word. Used well, it adds a second lock: someone who finds your words still can’t open the wallet behind the passphrase. The price is just as real. If you forget the passphrase, nobody can recover those funds: not you, not the manufacturer, not us.

This tutorial walks through the technical foundation, practical setup steps on popular hardware wallets, security best practices, and the real risks you need to understand before enabling a passphrase on your own wallet.

Prerequisites

Before you start, make sure you have the following in place:

A hardware wallet you already own and have initialized. If you haven’t purchased one yet, read the Hardware Wallet Buying Guide first.
Your seed phrase already generated and backed up securely — ideally on metal. See Seed Phrase Storage Best Practices for detailed guidance.
A small amount of bitcoin (or testnet coins) for verification testing.
A second, physically separate backup location for your passphrase.

What Is the BIP39 Passphrase?

The BIP39 specification, published in 2013, defines how mnemonic seed phrases are converted into the binary seed that generates all of your private keys. What many people miss is that the specification includes an optional passphrase field in that conversion process. When the passphrase field is left empty (the default), an empty string is used. When you supply a passphrase, it gets mixed into the derivation and produces a completely different master seed — and therefore a completely different set of addresses, keys, and balances.

The term “25th word” is a simplification. The passphrase is not restricted to a single word from the BIP39 wordlist. It can be any UTF-8 string: a single word, a full sentence, numbers, special characters, or a combination. The BIP39 wordlist is irrelevant here. Your passphrase can be “correct horse battery staple” or “Tr0ub4dor&3” or anything else you choose.

How It Works Technically

Understanding the cryptography removes the mystery and helps you make better security decisions.

The Derivation Process

When your hardware wallet converts your seed phrase into a master seed, it runs the following process:

Checksum check: The wallet turns each word back into its number and checks the checksum, which catches most typos in the words. These numbers are used only for this check.
PBKDF2-HMAC-SHA512: The mnemonic sentence (words joined by spaces) is used as the password input. The string "mnemonic" + passphrase is used as the salt. The function runs 2,048 iterations.
Output: A 512-bit (64-byte) master seed.

How a BIP39 wallet makes its seed. Your 12 or 24 words, as text joined by spaces, are the password; a checksum in the words lets a wallet catch most typos in them. The word “mnemonic”, the same for every wallet, plus your passphrase is the salt; the passphrase has no checksum, so any text is accepted. Both go into PBKDF2, 2,048 rounds of HMAC-SHA512 that are slow on purpose, and out comes the 512-bit seed from which every key and address is made. Change one character of the passphrase and the salt changes: you get a completely different seed. — **The passphrase goes into the salt.** Your words are the password; “mnemonic” plus your passphrase is the salt. The words carry a checksum that catches most typos; the passphrase has none, so a wallet accepts whatever you type.

The critical detail: changing even one character of the passphrase changes the salt, which means the PBKDF2 function produces an entirely different 512-bit output. There is no mathematical relationship between the wallet derived with passphrase “alpha” and the wallet derived with passphrase “alpha1”. They are as unrelated as two wallets generated from different seed phrases entirely.

This is also why there is no “wrong passphrase” error. Every passphrase — including an empty one — produces a valid wallet. Your hardware wallet cannot tell you that you typed the passphrase incorrectly, because from its perspective, every input is correct. It simply derives whatever wallet corresponds to whatever you typed. This property is both a feature and a risk, as we will discuss later.

At setup you note that the passphrase “alpha” gives the master fingerprint 8aaa4f4b. Later, the same words with “alpha” give fingerprint 8aaa4f4b: your wallet. With “Alpha”, one capital letter, they give 7c724ae3; with “alpha1”, one extra character, 3ff87a3f; with “alpha” plus a space at the end, f29a9dab; with nothing typed, 73c5da0a, the wallet the words open alone. The first three are other valid wallets, empty, and no wallet can tell you “wrong passphrase”: comparing the fingerprint with the one you noted is how you notice. The fingerprints are computed for the public BIP39 test words “abandon … about”, which must never hold real funds. — **One character opens a different wallet, and nothing warns you.** The master fingerprint is a short ID of the wallet. Write it down when you set up the passphrase, and compare it, or the first receiving address, every time you open the wallet.

For how one seed becomes a whole tree of keys, see the derivation section of our 24-word recovery phrase guide.

What a Passphrase Did in the July 2026 Coldcard Flaw

In July 2026 a Coldcard firmware flaw produced seeds far weaker than their word count suggested, and attackers emptied wallets made with them. Coinkite’s advisory spells out who was at risk: funds were exposed when the seed was made without at least 50 independent, private dice rolls and the wallet was not protected by a strong, unique BIP-39 passphrase. A strong passphrase was a second lock the attackers did not have.

Two lessons follow. First, the number of words doesn’t protect you if the generator behind them fails. Second, a passphrase is a barrier, not a repair: Coldcard’s passphrase documentation says it “does not repair a seed generated on affected firmware”, so owners of weak seeds should still move to a new one. Our Coldcard advisory and our security advisories have the details.

Dice and a passphrase are both options, each with a cost:

Dice rolls add your own randomness when the seed is created. Each roll of a fair die is worth about 2.58 bits, so 99 rolls carry about 256. The cost: some wallets, or a “dice only” mode, build the seed from your rolls alone, and there a loaded die, too few rolls or rolls someone else saw make a weaker seed. Our dice entropy tool shows how many rolls you need.
A passphrase protects an existing seed without new hardware. The cost: forget it, or one character of it, and the funds behind it are gone.

Plausible Deniability: Decoy Wallets

The most discussed benefit of the passphrase feature is plausible deniability. Here is how it works in practice:

Suppose an attacker gains physical access to your seed phrase backup. Without a passphrase, they have everything needed to steal your funds. With a passphrase enabled, the seed phrase alone opens a wallet — but it is not the wallet where you keep your main holdings. You can intentionally deposit a small amount of bitcoin into the “no passphrase” wallet (or a decoy passphrase wallet) so that an attacker sees a plausible balance and may assume they have found everything.

Your real funds sit in the wallet derived from seed phrase + your actual passphrase, which you keep in your memory and in a written backup stored apart from the words.

Four cases. A thief who finds your words but not your passphrase can open only the decoy wallet, the one the words open alone; your savings stay safe, as long as the passphrase is too strong to guess. A thief who finds only your passphrase can open nothing. A thief who finds both, because you kept them in one place, can open everything, and your savings are theirs. If you forget the passphrase, you hold the same pieces as the first thief: you can open only the decoy, and your savings are gone for good. The lock that stops a thief stops you too, so back the passphrase up, apart from the words. — **The lock that stops a thief also stops you.** Words without the passphrase open only the decoy, whoever holds them, as long as the passphrase is too strong to guess. Keep it in a different place from the words, and back it up just as carefully.

This works because:

There is no way to determine whether a passphrase is in use just by examining the seed phrase.
There is no limit to the number of passphrases (and therefore wallets) that can be derived from a single seed phrase.
Each derived wallet is cryptographically independent.

Plausible deniability is not bulletproof. A sophisticated attacker who knows you use Bitcoin and finds only a trivial balance may suspect a hidden wallet. But it raises the cost of attack significantly, especially in opportunistic theft scenarios. For a broader look at layered security strategies, read Bitcoin Security: Cold vs Hot Wallet Setup.

Step-by-Step: Enabling the Passphrase on Your Hardware Wallet

The exact menu path differs by device, but the process follows the same logic on every wallet. Below are general instructions for three popular brands.

Trezor (Trezor Suite on desktop)

First, run Check backup on your Standard wallet (Settings, Wallet backup). Trezor’s own passphrase guide asks you to do this before adding a passphrase on top.
Connect and unlock your Trezor and open Trezor Suite.
Go to Settings > Device. Under Passphrase, turn on Use Passphrase wallets.
Open the wallet switcher at the top left, select + Passphrase wallet, then New passphrase.
Choose Enter passphrase on Trezor and type it on the device. Trezor recommends this whenever you can, because anything typed on a computer or phone can be captured if that device is compromised. The Trezor Model One has no on-device entry, so on that model you type the passphrase in Trezor Suite.
Check the passphrase on the Trezor screen character by character, confirm it, and enter it a second time when Suite asks.
Write down the first receiving address of the passphrase wallet.
Eject the wallet, open the passphrase wallet again with the passphrase from your written backup, and confirm that the first receiving address matches.
Only then send a small test amount, and confirm it arrives.

Coldcard (MK4 / Q)

Unlock the Coldcard with your PIN.
Navigate to Passphrase from the main menu.
Choose how to enter the passphrase: you can type it directly using the numeric keypad (MK4) or the QWERTY keyboard (Q model).
Enter your passphrase and press OK.
The Coldcard will display the master fingerprint of the resulting wallet. Write this fingerprint down. It is the fastest way to verify you entered the passphrase correctly in the future.
Apply the passphrase. The Coldcard now operates as if this is a different wallet entirely.
Export the wallet file (via microSD or NFC) to your coordinator software (Sparrow, Electrum, etc.).
Send a small test amount and confirm receipt.
Power cycle the Coldcard, re-enter the passphrase, and verify the fingerprint matches what you recorded.

Ledger (Nano S Plus / Nano X / Flex)

On the Ledger device itself, open the passphrase menu. On a Nano S Plus or Nano X, go to Settings > Security > Passphrase. On a Flex, go to Settings > Advanced > Set passphrase.
Choose “Attach to PIN” or “Set temporary” (on a Flex: “Set passphrase and attach it to a new pin” or “Set temporary passphrase”). “Attach to PIN” lets you create a secondary PIN code that loads the passphrase wallet, so you do not need to type the passphrase each time. A temporary passphrase stays active only until the device is switched off. Ledger also advises never entering your passphrase on a computer, smartphone or other internet-connected device.
Enter your passphrase on the device.
If you chose “Attach to PIN,” set a secondary PIN (different from your primary PIN).
Confirm and save. The device will now derive the passphrase wallet.
Open Ledger Live. You will need to add accounts again, because the addresses are different.
Send a small test amount and verify.
Power cycle the device and unlock it with your normal PIN. Open the passphrase menu from step 1, choose “Set temporary” (on a Flex, “Set temporary passphrase”) and type the passphrase from your written backup. In Ledger Live, open Receive for the passphrase account and verify the address on the device. If Ledger Live warns that the device is not set up with the passphrase for that account, your written backup does not match. A new address is normal: Ledger Live shows a fresh one after each payment. Unlocking with a secondary PIN only proves the device kept its saved copy, not that your backup is right.

Security Best Practices

Passphrase Strength Guidelines

Your passphrase protects against an attacker who already has your seed phrase. That means it must withstand offline brute-force attacks. A weak passphrase — a single common word, a birthday, a pet’s name — can be cracked quickly.

Use six or more random words (Diceware-style). Four words from a 7,776-word list give about 52 bits of entropy; six give about 78. Diceware’s author recommends at least six words for encryption, and seven to nine for high-value uses such as Bitcoin.
Avoid personally meaningful phrases. Song lyrics, quotes, family names — all of these are in attacker dictionaries.
Case sensitivity matters. “Alpha” and “alpha” produce different wallets. Decide on a capitalization convention and stick with it.
Spaces matter. “correct horse” and “correcthorse” are different passphrases.
Special characters and numbers add strength but also add memorization difficulty and transcription error risk. If you use them, document them precisely in your backup.

How many passphrases an attacker who already has your words may need to try. One word from the 2,048-word BIP39 list, a literal “25th word”: 2,048 guesses, 11 bits. A date of birth, any day in 100 years: about 36,500 guesses, about 15 bits. Four random Diceware words chosen with dice from a list of 7,776: 3,656,158,440,062,976 guesses, about 52 bits, below Diceware's minimum. Six random Diceware words, Diceware's minimum for encryption: 221,073,919,720,733,357,899,776 guesses, about 78 bits. Bar length counts bits, and each extra bit doubles the guesses. Each random word multiplies the guesses by 7,776. Diceware's author advises six words or more for encryption, and seven to nine for high-value uses such as Bitcoin. — **Random words beat clever ones.** Someone who has your words can test passphrases on their own computers, with no limit on tries. A single word or a date gives them only thousands of guesses; every random Diceware word multiplies the count by 7,776.

Backup Your Passphrase Separately

The entire point of the passphrase is that it is stored separately from the seed phrase. If you write both on the same piece of paper and store them in the same safe, you have gained nothing.

Store the passphrase in a different physical location from the seed phrase.
Consider stamping the passphrase on a metal plate, just as you would a seed phrase.
Keep it out of password managers, notes apps and email. Trezor’s reason: anything you type on a computer or phone can be captured if that device is compromised. Ledger advises never entering a passphrase on a computer, smartphone or other internet-connected device.
Think about inheritance. If something happens to you, can your heirs reconstruct both the seed phrase and the passphrase? See Seed Phrase Inheritance: Dead Man’s Switch Options for detailed guidance.

Test Before Committing Funds

Enable the passphrase and open the new wallet.
Record the first receiving address and the master key fingerprint.
Send a trivial amount of bitcoin.
Power off the hardware wallet completely.
Power it back on and enter the passphrase again, typed from your written backup. A saved shortcut such as a Ledger secondary PIN does not test the backup.
Verify the receiving address and fingerprint match. Verify the balance is visible.
Only after this round-trip confirmation should you move larger amounts.

The Risks: What Can Go Wrong

Forgotten Passphrase = Lost Funds

This is the single biggest risk. Unlike a forgotten password on a web service, there is no reset mechanism. No customer support. No recovery option. If you forget the passphrase — even by one character — the bitcoin in that wallet is inaccessible forever. The seed phrase alone will only open the default (no-passphrase) wallet, which is a completely different set of addresses.

Typos During Setup

Because every passphrase produces a valid wallet, a typo during initial setup means you send funds to a wallet derived from the typo. When you later enter what you believe is the correct passphrase, you will see an empty wallet. This is why the test-with-small-amount step is non-negotiable.

Complexity Creep

Some users create multiple passphrase wallets (a decoy, a main, a savings tier). This multiplies the backup burden and increases the chance of confusion. Unless you have a clear operational need, one passphrase wallet plus the default decoy wallet is sufficient for most individuals.

Encoding Issues

BIP39 specifies UTF-8 NFKD normalization for passphrases. In practice, this means accented characters, emoji, and non-ASCII text can behave unpredictably across different wallet software. Stick to basic ASCII characters (letters, numbers, common punctuation) to avoid normalization-related surprises. Length limits differ too: Trezor accepts up to 50 characters on the Model One and 128 on the Model T and Safe models, while Coldcard and Ledger accept up to 100, so check that any device you might recover on will take yours.

Troubleshooting Common Issues

“I entered my passphrase and see an empty wallet.”

Most often the passphrase was entered differently from when you set it up. Check for: trailing spaces, capitalization differences, numeral vs. spelled-out numbers, or a different keyboard layout. Remember, the wallet has no way to tell you the passphrase is “wrong” — it just derives a different wallet. If the passphrase is right, the app may be looking at a different address type or derivation path: Wallets Recovery lists the paths each wallet uses. Don’t give the funds up for lost, don’t type your words into programs to experiment, and don’t answer anyone who offers to recover your wallet.

“My hardware wallet doesn’t prompt me for a passphrase.”

The passphrase feature must be explicitly enabled on most devices. It is disabled by default. Check your device settings.

“I want to change my passphrase.”

You cannot change the passphrase associated with an existing wallet. Instead, create a new passphrase wallet, send funds from the old wallet to the new one, and then retire the old passphrase. Always test the new passphrase wallet before moving significant funds.

“Should I use the passphrase with a multisig setup?”

You can, but it adds complexity. In a multisig configuration, each key in the quorum can optionally use a passphrase. This means more items to back up and more things that can go wrong. Most multisig users skip the passphrase because the multisig structure already provides the security and redundancy benefits. Read Multi-Sig Wallet Configurations for a full breakdown of multisig tradeoffs.

Three Rules for the Words Themselves

Don’t split your seed into pieces. Keeping half the words in one place and half in another means losing either half loses everything. A “two of three” split (16 of 24 words in each place) leaves whoever finds one place about 80 bits to guess instead of 256. If you want shares, use SLIP-39 or a multisig wallet. Our seed split risk tool shows the numbers.
Don’t type your words into a phone or a connected computer, not to check them and not to store them. They go into a hardware wallet, on the device. The same goes for your passphrase whenever the device lets you type it there.
If a restored wallet comes up empty, it may not be lost. A missing passphrase, a typo in it, or a different derivation path all open a different wallet. Check the passphrase first, then look up your wallet’s paths on Wallets Recovery. Don’t try it alone in software. To test your backup safely, follow our guide on how to test your seed phrase backup.

Passphrase vs. Other Security Layers

The passphrase is one tool in a broader security toolkit. It is not a substitute for proper seed phrase storage, and it does not protect against all threats. Consider how it fits alongside other measures:

Threat	Passphrase Helps?	Better/Additional Protection
Seed phrase physically stolen	Yes — attacker gets decoy wallet only	Metal backup in secure location
Hardware wallet stolen (locked)	Yes, if you type it each time; a Ledger passphrase attached to a PIN opens with that PIN alone	Device PIN, wipe after failed attempts
Weak seed from a faulty generator (as in July 2026)	Yes, if strong and unique, per Coinkite’s advisory	Dice rolls at creation; move to a new seed anyway
Supply chain attack on device	Partially — depends on attack vector	Verify firmware, buy from manufacturer
$5 wrench attack (physical coercion)	Partially — plausible deniability	Multisig with geographically distributed keys
Forgotten credentials	No — it increases this risk	Robust backup strategy, inheritance plan

Part of our free Bitcoin course: This topic is covered in depth in Seed Phrase Storage: Metal Backups, Passphrases and Best Practices from the Bitcoin Wallets & Self-Custody course.

Frequently Asked Questions

Is the 25th word passphrase the same as my hardware wallet PIN?

No. The PIN protects physical access to the hardware wallet device. The passphrase modifies the cryptographic derivation of your wallet from the seed phrase. They operate at entirely different layers. Your PIN is device-specific — if you restore your seed on a new device, you set a new PIN. Your passphrase is tied to the seed phrase itself — it produces the same wallet on any device or software that supports BIP39 passphrases, as long as it accepts your passphrase and is set to the same derivation path.

A PIN and a passphrase compared. What it locks: the PIN locks the device, so nobody can use your hardware wallet without it; the passphrase changes the wallet itself, every key your words make. On a new device: you set a new PIN, which isn't part of your backup; the same words and passphrase open the same wallet on any device or app that accepts your passphrase and is set to the same derivation path. Wrong guesses: after too many wrong PIN tries most devices wipe themselves; there is no limit on passphrase guesses, since anyone with your words can try them offline. If you forget it: a forgotten PIN means restoring from your backup and setting a new PIN, and the funds are safe; a forgotten passphrase means the funds behind it are gone, and nobody can reset it. — **A PIN locks the device; the passphrase is part of the wallet.** Forget the PIN and you restore from your backup. Forget the passphrase and the funds behind it are gone, which is why it needs a written backup of its own.

Can I use a passphrase with a 12-word seed phrase, or does it require 24 words?

The passphrase works with any BIP39 seed phrase, regardless of length. A 12-word seed with a strong passphrase is cryptographically sound. The passphrase adds its own entropy on top of whatever entropy the seed phrase provides. That said, a 24-word seed provides 256 bits of entropy compared to 128 bits for 12 words, so some security-conscious users prefer 24 words as the base.

What happens to my passphrase wallet if the hardware wallet manufacturer goes out of business?

Nothing changes. The BIP39 passphrase is an open standard. Any wallet software or hardware that supports BIP39 passphrases can derive the same wallet from your seed phrase plus passphrase, as long as it accepts your passphrase’s length and characters and is set to the same address type and derivation path. You are not locked into any vendor. Your device can keep working with open-source software such as Sparrow or Electrum, with the words staying on the device. If it fails, restore from your words and passphrase on a hardware wallet from a different manufacturer, typing the words on that device, not into a phone or computer. This is one of the strengths of open standards in Bitcoin custody. For more on firmware and manufacturer dependency, see Hardware Wallet Firmware Updates.

Does a passphrase fix a seed made by a flawed device?

No. A strong, unique passphrase is a second lock, and in the July 2026 Coldcard flaw Coinkite said funds behind one were not at risk from the weak seed alone. But it does not make the seed itself strong. Coldcard’s documentation says a passphrase “does not repair a seed generated on affected firmware”, so move to a new seed made on fixed firmware, ideally with your own dice rolls.

Should I use a passphrase if I already use multisig?

For most users, multisig already provides the security benefits that a passphrase offers — and then some. A 2-of-3 multisig means an attacker must compromise two separate keys in two separate locations, which is arguably stronger than a single key protected by a passphrase. Adding passphrases to each key in a multisig setup multiplies the backup complexity (now you have three seed phrases and three passphrases to store and protect). The general recommendation: use passphrase for single-sig setups; for multisig, the quorum structure itself is your protection layer. Read Singlesig to Multisig Bitcoin Migration to decide which model fits your situation.

Sources

The BIP-39 standard (passphrase, PBKDF2 salt and NFKD normalization) and SLIP-39.
Coinkite, Coldcard Security Advisory (updated 1 Aug 2026); Coldcard, BIP-39 Passphrase.
Trezor, Using a passphrase wallet in Trezor Suite; Ledger Academy, Passphrase; Ledger Support, How to set up a passphrase.
Wallets Recovery, derivation paths by wallet.
Arnold Reinhold, Diceware: the 7,776-word list and how many words to use.

Last reviewed: 3 November 2026.

Filed under: Bitcoin Security