Seed phrase security and hardware wallets: the complete guide

10 min read · Updated Sep 19, 2026

How seed phrases work, where to store them, which hardware wallet to buy, how to use a passphrase, and how to test your recovery before you need it.

Self-custody removes exchange risk and replaces it with one responsibility: protecting 12 or 24 words. Whoever has those words has your coins, forever, with no password reset. This guide covers how to hold that responsibility well.

What a seed phrase actually is

The seed phrase (BIP39 mnemonic) encodes a random number from which every private key in your wallet is derived. It is not a password to an account; it is the account. Consequences:

Anyone with the phrase can recreate your wallet on any device and spend everything.
No company can restore it for you.
It never needs to be typed into a computer except when restoring a wallet, and with a hardware wallet, not even then.

Where to store it

Do:

Stamp or engrave it on stainless steel (fire and flood proof), or write it on paper stored in a sealed envelope.
Keep two copies in two locations (home safe and a trusted relative’s safe or a bank deposit box).
Consider a passphrase (see below) so a single discovered copy is useless.

Never:

Photograph it, screenshot it, or type it into notes, email, cloud drives or chat apps. Cloud accounts are breached constantly and malware searches for 12/24-word patterns.
Split the phrase in halves across locations. Half a phrase dramatically reduces the brute-force space. Use a proper scheme (Shamir backup on Trezor, or multisig) if you want redundancy without a single point of failure.
Enter it into any website. No legitimate service, airdrop or “wallet sync” needs it.

Why a hardware wallet

A hardware wallet keeps the private keys on a chip that never exposes them to your computer. Malware on your PC can show you a fake screen, but it cannot sign without the device, and the device shows the real destination and amount. That is why the Bybit hack hurt so much: the signers used a compromised web interface and did not verify on-device.

Buy directly from the manufacturer. Tampered devices sold through marketplaces have shipped with pre-filled seed cards (“your recovery phrase is inside”) that route funds to the attacker. A genuine device always generates the seed on-screen during setup.

Set-up checklist

Initialise the device yourself; write the phrase it generates. Never accept a pre-written one.
Set a PIN that is not your phone PIN.
Optionally enable a BIP39 passphrase. Store it on a separate medium from the seed. Test that both the decoy (no passphrase) and real wallet open as expected.
Test recovery: send a small amount, wipe the device (or use a second device), restore from your written phrase, confirm the balance appears. Do this before depositing anything meaningful.
Enable firmware update notifications and update only through the official app.
Record the derivation paths and which chains you used, so heirs or your future self can find the funds.

Operational habits

Use the hardware wallet as a vault. Keep a separate software hot wallet with pocket money for minting, new dApps and airdrops.
Verify on the device screen every time: address, amount, network, and for contract interactions the function being called. If the device cannot decode the transaction, reject it and investigate.
For amounts you could not afford to lose, consider multisig (Safe, Sparrow, Nunchuk): two or three devices in different locations must sign.

Inheritance

Your coins should not die with you. Leave sealed instructions with a lawyer or in your will describing where the seed and passphrase are and how to restore the wallet. Do not put the words themselves in the will; probate documents can become public.

Questions

Can I store my seed phrase in a password manager?

It is far better than a screenshot, but it turns your crypto security into your password manager's security, plus the security of every device that syncs it. For meaningful amounts, keep the phrase offline on metal or paper and use the password manager only for the wallet's PIN or passphrase hint.

Ledger or Trezor or something else?

Any established hardware wallet bought directly from the manufacturer is a massive upgrade over a browser wallet. Choose based on the chains you use, whether you want open-source firmware (Trezor, Keystone, BitBox) and whether a secure element matters to you (Ledger, Keystone, BitBox02). Avoid second-hand devices.

What is a BIP39 passphrase?

An optional extra word or sentence added to your seed phrase that creates a completely different set of wallets. Someone who finds your 24 words without the passphrase sees an empty or decoy wallet. Lose the passphrase and the funds are gone, so store it separately from the seed.