The 25th word: a BIP-39 passphrase turns the numbers into nothing

The ciphers hide your seed words; they don't lock them (why). The lock is a BIP-39 passphrase, often called the 25th word. With one in place, someone who decodes your numbers gets a wallet with nothing in it.

How it works

BIP-39 turns your words into a wallet seed with a function called PBKDF2. The words go in as the password. The salt is the text mnemonic followed by your passphrase. With no passphrase, the salt is just mnemonic, and that's the wallet most people use.

Change one character of the passphrase and PBKDF2 produces an unrelated seed: a different wallet with different addresses. BIP-39 says so directly: every passphrase generates a valid wallet, and only the correct one makes the desired wallet available.

This works for you against a thief. Your twelve words plus a wrong passphrase open an empty wallet, and someone who decoded your numbers can't tell whether you used a passphrase at all. Nothing in the words records it.

It works against you too, because you can't tell either. Type your passphrase with a capital letter where it had none, or a trailing space, and an empty wallet opens without complaint. There is no "wrong password" message, because there is no wrong passphrase, only other wallets. The test at the end of this page is there to catch that.

Choose one

The passphrase protects you only if someone who has your words can't guess it. Assume they can try a very large number of guesses: each guess costs them one PBKDF2 run and a few address derivations. On one core of our test server a PBKDF2 run took under a millisecond. Rented graphics cards go far faster. Plan for a billion guesses a second.

Random words from the BIP-39 list give a clean way to count. Each word adds 11 bits.

Random words	Possibilities	Time to try them all at a billion a second
3	8.6 billion	about 9 seconds
4	17.6 trillion	about 5 hours
5	36 thousand trillion	about 14 months
6	74 billion trillion	about 2,300 years

1. Use six or more random words, or something with at least as much randomness. Pick the words with dice or coins, not from your head. A name, a date, a pet, a quote or a keyboard pattern is the first thing an attacker tries.
2. Keep it to plain ASCII: lower-case letters, digits and spaces between words. BIP-39 normalises Unicode, but your next signer may not offer the character you used. COLDCARD accepts ASCII only, up to 100 characters.
3. Leave out leading, trailing and double spaces. Wallets take the passphrase exactly as typed.
4. Don't reuse your email password or another wallet's passphrase.

Store it

Store the passphrase apart from the numbers, so that a person who finds one doesn't find the other.

• Write it down at least once, on paper or steel, in a different place from your numbers. A passphrase that only lives in your head dies with you, and your heirs inherit an empty wallet.
• Note the fingerprint of the passphrase wallet (eight hex characters, explained below) with the passphrase, not with the numbers. COLDCARD's own guide says it's fine to keep the fingerprint with the passphrase.
• If you also keep it in memory, rehearse it. Numbers in your head covers techniques.

Check the fingerprint

A wallet's fingerprint is a short identifier derived from its master key. It changes with the passphrase. Your signer can show it, and it is the only way to confirm you typed the passphrase you meant. Write it down the first time and compare it every time after.

Step by step on SeedSigner

SeedSigner keeps nothing between sessions, so you enter the seed and the passphrase each time.

1. Check the setting: Settings, then the advanced options, BIP-39 passphrase. It must be Enabled (the default) or Required. On Disabled the passphrase button doesn't appear.
2. Load your seed: scan your SeedQR or type the words.
3. The Finalize Seed screen shows the fingerprint of the seed without a passphrase. Note it, then choose BIP-39 Passphrase.
4. Type the passphrase on the on-screen keyboard and confirm.
5. The Verify Passphrase screen shows changes fingerprint with two values: the fingerprint without the passphrase, then with it. Read the passphrase on screen character by character. If it's wrong, choose Edit passphrase. If it's right, write down the second fingerprint and choose Done.
6. Export the wallet (the xpub) to your coordinator software from this passphrase seed, not the bare one.

Step by step on COLDCARD

COLDCARD keeps the seed behind your PIN. The passphrase isn't stored unless you save it to a MicroSD card, so you enter it each time you unlock.

1. Unlock with your PIN and choose Passphrase. Read the warning and press ✔.
2. Build the passphrase with Edit Phrase, Add Word (picks from the BIP-39 list) and Add Numbers. On a Q, type it on the keyboard.
3. On a Mk4 or Mk5 choose APPLY. The confirmation screen shows the new wallet's extended fingerprint (XFP). Scroll down and check the passphrase in plain text.
4. Write down the XFP. Press ✔ to use the wallet. COLDCARD also offers 1 to save the passphrase, encrypted, to the MicroSD card in the slot; that card then becomes something else to guard.
5. Later, check which wallet is active under Advanced/Tools, View Identity.

Test before you fund

Do this once, before any coins arrive:

1. Set up the passphrase wallet and record its fingerprint.
2. Power the signer off. Wait a day if you can.
3. Start again from your written backups only: decode your numbers with your cipher, enter the words, enter the passphrase.
4. Compare the fingerprint. It must match exactly.
5. Receive a small amount. Recover once more from backups and spend it back to yourself.

Only then send the real amount. A typo found now costs you nothing. A typo found in five years costs you everything in that wallet.

A decoy, if you want one

The wallet with no passphrase still exists. Some people leave a small, believable amount there. Under threat, they hand over the twelve words. BIP-39 calls this plausible deniability. It only works if the decoy looks like the real thing, and it's no help against an attacker who already knows you use a passphrase.

We will never ask for a seed word or a passphrase. Never type one into this site or any tool it links to.