A practical, low-tech guide to backing up a crypto recovery phrase so it survives theft, fire, and your own future forgetfulness.
Selin AydinSecurity Editor · Crypto security, custody, exploits and smart-contract risk
A seed phrase backup has to survive fire, water, time and discovery. Never store it digitally — no photos, notes, password managers or cloud. Write or stamp it, keep copies in at least two physically separate places, and test the restore before you rely on it. Splitting a phrase in half is not a security scheme; use a designed method such as Shamir shares if you need one.
Every seed phrase story worth telling ends one of two ways: someone loses everything because they never wrote it down properly, or someone loses everything because they wrote it down somewhere a stranger — or a search algorithm — eventually found it. There is no third option where carelessness works out fine, which is exactly why seed phrase security deserves more attention than most newcomers give it.
A seed phrase — usually twelve or twenty-four words drawn from a standard list — is a human-readable version of the master private key that controls every address your wallet generates. Anyone who has it can restore your entire wallet on any device, anywhere, without needing your phone, your password, or your permission. That's precisely what makes it powerful for recovery and dangerous the moment it's copied by the wrong person. It is, functionally, the single most valuable string of text you will ever own.
It's worth being precise about what the phrase does and doesn't protect against. It protects you from losing access if your phone breaks or your hardware wallet is destroyed — you simply restore from the phrase on a new device. It does nothing to protect you if someone else obtains a copy of it, because possession of the phrase is possession of the funds, with no password, PIN, or second factor standing in between.
The single most important habit in this guide is refusing to let your seed phrase touch an internet-connected device in text form. No photo in your camera roll, no note in a cloud-synced app, no email to yourself "just for now," no password manager unless you fully understand and accept the tradeoffs. Photos get backed up to the cloud automatically, often without the user noticing. Notes apps sync across devices you may not even remember are logged in. Email gets breached, sometimes years after the fact through an unrelated leak. Each of these turns a physical-world theft problem into a remote one, and remote attackers can operate at a scale no burglar can match, scanning breached data dumps for anything that looks like a recovery phrase.
This extends to screenshots taken "temporarily" during setup and forgotten about, and to typing the phrase into any website, even one that claims to be verifying your wallet. No legitimate recovery, staking, or airdrop process ever requires you to type your seed phrase into a browser.
Pen and paper, written clearly, is the honest baseline — better than nothing, but paper burns, floods, and fades, and ink can smudge into illegibility over years of storage. A meaningfully better option is a metal seed-phrase backup: a steel plate or set of tiles you stamp or engrave with the words, sold by several reputable hardware wallet makers and increasingly by independent manufacturers. Metal survives house fires and flooding that would destroy paper outright, and it's cheap insurance against the two most common causes of seed loss that have nothing to do with hacking: accidents and disasters.
Whatever medium you use, write the words in order and double-check each one against the wallet's confirmation screen before you consider the backup complete — a single transposed word, or a word copied from the wrong part of the wordlist, can make the phrase useless, and you often won't discover the mistake until the day you actually need to recover funds, at which point it's too late to fix.
Don't store the only copy at home if you can help it, and don't store all copies in one place. A common, sensible approach: one copy in a home safe or similarly secure fixed location, and a second copy somewhere geographically separate — a bank safe deposit box, a trusted family member's safe, or a second property. This protects against the single-point failure of a house fire, flood, or burglary wiping out your only backup in one event.
Resist the urge to label anything "seed phrase," "crypto," or "bitcoin." A backup that announces what it is turns an opportunistic thief into a targeted one. Store it plainly, inside something unremarkable, and keep the knowledge of its existence to as few people as possible — including, in most cases, extended family who don't need to know the details to be provided for later through a will or estate plan.
Some holders split their seed phrase across two or three locations — say, the first eight words in one safe and the remaining sixteen in another — so no single location holds a complete, usable phrase. This raises the bar for a thief but also raises the bar for you: lose track of the split logic, or lose one portion, and you can lock yourself out permanently, with no support line able to help. If you go this route, document the split method itself somewhere separate from either portion, and test the full recovery process once while you still have low stakes to lose, ideally on a fresh, empty wallet before you ever fund the real one.
An alternative some more advanced users reach for is a passphrase — an additional word or phrase added on top of the standard seed words, sometimes called a "25th word." Done correctly, it means a found seed phrase alone isn't enough to access funds. Done carelessly — forgotten, or written down next to the seed phrase itself — it adds a new way to lose everything rather than a genuine layer of security. It's a tool for someone who fully understands the mechanism, not a default recommendation.
No legitimate wallet provider, exchange, or support agent will ever ask for your seed phrase — not by email, not by chat, not over the phone. Every request for it is a scam, without exception. This applies just as firmly to "wallet verification" pop-ups, fake customer support numbers found through a search engine, and DMs from accounts impersonating a project's official team, particularly around times of visible stress like a wallet update or a network outage, when panic makes people more likely to skip their usual caution.
The worst time to discover your backup is wrong is during an actual recovery, with real money on the line. Before you fund a wallet with anything meaningful, do a dry run: wipe the wallet app or reset the hardware device, then restore it from your written backup alone. If it restores cleanly and shows the addresses you expect, you know the words and the order are correct. If it doesn't, you've just found the mistake while the stakes were still zero, which is the entire point of testing early rather than assuming.
Seed phrase security isn't glamorous, and there's no clever trick that replaces the boring version: write it down accurately, store it offline in more than one secure place, tell no one, and verify it works before you trust it with real value. Follow that and the phrase does its job quietly for as long as you hold crypto, which is exactly how it should feel.
One scenario people rarely think through until it's uncomfortable to ignore: what happens to the crypto if you're incapacitated or die unexpectedly, and nobody else knows the backup exists or how to use it. Unlike a bank account, there's no next-of-kin process that grants automatic access — the funds are simply gone if the phrase dies with you. A basic estate plan for crypto doesn't mean telling anyone the words themselves; it can be as simple as leaving sealed instructions with a solicitor or executor pointing to where the backup is stored and how to use it, opened only under the specific conditions you set. It's an uncomfortable thing to plan for, and precisely the kind of thing that's better handled once, calmly, than left to a grieving family member trying to guess a password.
Moving funds off an exchange and into cold storage for the first time is simpler than it looks — provided you follow the sequence in the right order and don't skip the verification steps.
A myth-busting look at the difference between letting an exchange hold your keys and holding them yourself, with the real-world collapses that made the distinction matter.
Cross-chain bridges move billions between blockchains every week — and have lost billions more to exploits. Here's how the plumbing actually works and how to size up the risk before you use one.