Seed phrase security: how to protect the master key to your crypto

Your Seed phraseThe master key to your wallet. Never share it. Never type it into a website. is a list of ordinary words that can rebuild your whole wallet on any device, which means whoever has those words owns your crypto. Protect it offline, never type it into a website, and never share it with anyone, ever.

Everything else on this page is detail around that rule.

What a seed phrase actually is

When you create a self-custody WalletThe app or device that holds your keys, not your coins. , the app generates a large random number. Nobody could remember that number, so it gets translated into words. That word list is your seed phrase, also called a recovery phrase or secret recovery phrase.

Most wallets follow a standard called BIP39. Its spec maps the random number to sentences of 12, 15, 18, 21 or 24 words, picked from a fixed list of 2048 words (each word encodes a number from 0 to 2047). From that phrase, the wallet derives every Private keyThe secret that proves the coins are yours. it will ever use. One phrase, all your addresses.

ethereum.org calls the recovery phrase “the master key to your wallet.” That is not a metaphor. It is literally how the wallet is rebuilt.

Why it is more dangerous than a password

A password protects an account that a company runs. If someone steals it, you can often reset it, call support, or have a fraud team freeze things.

A seed phrase is not protecting an account. It is the ownership itself. Someone who gets it can restore your wallet on their own device and move everything, from anywhere, without you noticing until it is gone. The FTC notes that cryptocurrency payments typically are not reversible, and the CFTC warns there is no assurance of recourse if your virtual currency is stolen.

There is no reset button. That is the price of nobody being able to freeze your money.

How to store it

The goal is simple: keep the words offline, readable, and somewhere a thief or a flood will not reach.

• Write it on paper, by hand, the moment you create the wallet. Check each word against the screen. Number the words in order.
• Never photograph or screenshot it. ethereum.org warns that screenshotting seed phrases or private keys might sync them to a cloud data provider.
• Do not type it into notes apps, email drafts, chats or cloud documents. Anything online can be reached by whoever gets into that account.
• Store it somewhere private and durable. Out of sight of guests, away from water and heat. Some people use a metal backup plate to survive fire and flood.
• Consider a second copy in a separate secure location. One copy can be lost to a single bad day. Two copies means two places to protect, so pick both carefully.
• Tell someone you trust that it exists and where the instructions are. Not the words themselves, just enough that your crypto is not lost forever if something happens to you.

For larger amounts, a hardware wallet helps. ethereum.org explains that a hardware wallet provides offline storage for private keys, so they stay out of reach even if your computer is compromised. This is a form of Cold storageKeys kept on a device that never touches the internet. . It still uses a seed phrase as its backup, so the same storage rules apply.

The optional passphrase

The BIP39 standard lets you protect your words with an extra passphrase. With it, the same seed words open a different wallet. Someone who finds only your paper gets nothing useful.

The catch is real. If you forget the passphrase, your words alone will not restore that wallet. Only use this feature if you are confident you can store the passphrase separately and reliably. For most beginners, good physical storage of the words matters more.

The scams aimed at your seed phrase

Almost every seed-phrase theft is a trick, not a hack. The attacker wants you to hand the words over yourself.

Fake support. You post a question in a public chat. Seconds later, a friendly “support agent” DMs you and asks you to “verify” or “sync” your wallet by entering the phrase. ethereum.org notes that scammers watch public channels for people asking questions, and that staff will never communicate with you through private, unofficial channels.

Copycat sites. A link in an email, ad or message leads to a perfect clone of your wallet site that asks for the words. ethereum.org warns that phishing messages direct you to copycat websites asking for your seed phrase, and advises never opening links or attachments from addresses you do not recognise.

Fake apps and “wallet validation” forms. An app store listing or browser extension pretends to be your wallet. You install it, “restore” your wallet, and you have just typed your phrase into the thief’s app.

Impersonation and pressure. Messages claiming your account is frozen, compromised, or about to be closed. The FTC notes scammers pose as well-known companies or government agencies, often claiming fraud or a legal problem. Urgency is the tell.

If you think your phrase is exposed

Act as if it already has been. Set up a brand-new wallet with a new seed phrase, written down properly. Then move everything from the old wallet to the new one as soon as you can. Do not keep using the old phrase “just for small amounts”.

If you already lost funds to a scam, report it. The FTC lists the FTC, CFTC, SEC, the FBI’s IC3 and the exchange you used as places to report crypto fraud. Be wary of anyone who then contacts you offering to recover your money for a fee.

What to do next

• Pick the right kind of wallet in crypto wallets explained.
• Learn every pattern scammers use in how to spot crypto scams.
• See why self-custody matters to the bigger picture in Web3 explained.