Metal Seed Backups vs Paper: What Actually Survives

The quick version. Paper backups rarely fail dramatically. They fail quietly, through damp, fading ink, fire, and the person who tidies the drawer. Metal removes those physical failures and nothing else, so it only counts once you have confirmed the plate restores your wallet.

The quiet ways a paper backup dies

A recovery phrase on paper is a perfectly valid backup on the day you write it. Everything that goes wrong happens afterwards, and it is never exciting.

Water is the most common ending. A burst pipe, a slow leak behind a cupboard: the paper swells, the ink spreads, and a legible word becomes a guess. A guessed word is not a backup. Fire is the failure people picture, and paper goes long before anything else in the room. Then the boring ones: thermal paper fades on its own, sunlight bleaches, insects chew, pencil smudges.

The most common ending has nothing to do with the elements: somebody tidies up. A partner, a housemate, a relative clearing a house sees a scrap of odd words and bins it. It went out with the takeaway menus.

What metal solves, and what it deliberately does not

A metal backup addresses one category of risk: physical destruction. Letters stamped or engraved into solid metal are indifferent to damp, mould, insects and most of what a house fire does to a drawer. Destruction is the one failure you cannot argue your way out of: no support desk, no reset.

It solves nothing else. Metal does not stop somebody reading the words or a thief taking the plate. It does not help if you wrote the wrong words down, and it does nothing for a backup you never checked.

If you have not yet made a careful offline copy, start with how to back up a seed phrase, then read protecting your seed phrase. Metal upgrades a sound process; it does not replace one.

The categories of metal backup

Think in categories rather than products; there are broadly three.

Stamped blanks. A flat plate and letter punches, struck with a hammer. Deep, permanent and very legible, but unforgiving: a mis-struck letter cannot be un-struck.
Engraved or scribed plates. Marks cut with a carbide scribe or rotary tool. Easier to control than stamping, though shallow marks can be harder to read and can be worn away by abrasion.
Tile, washer and letter-card systems. Pre-made tiles or stamped washers assembled in order onto a rod or into a housing. Fast and impossible to mis-strike, but small parts get dropped or reordered, and an assembly error is silent.

Material matters more than format. Stainless steel and titanium are the usual choices because they resist corrosion and hold shape under heat; softer or plated metals deform, and coatings flake and take legibility with them. We do not physically test hardware, so we make no survival claims about individual products — our reviews are research-based and say so.

Where people actually go wrong

Most metal-backup failures are process failures, not material failures.

Photographing the plate while making it. It feels harmless: a progress shot, a check that the letters line up. The photo syncs to a cloud account within seconds, and the phrase now lives on somebody else’s server. The same goes for a webcam facing the table.

Storing the plate with the device. A burglar who takes one drawer should not get both the wallet and the words that recover it. Separating them costs nothing.

Mis-stamping a word. An N struck upside down reads as a Z; a crowded plate turns rn into m. One convenience helps: the English BIP-39 wordlist is built so the first four letters identify each word uniquely, so four characters per word are enough to record and check. That property is English-only.

Recording only part of what you need. A standard 12 or 24-word phrase restores a standard wallet on its own. If you added an optional passphrase, the words alone restore an empty wallet instead.

Safety: Never type your recovery words into a phone, computer, password manager or website to “check” them. The only place they should ever be entered is directly on a hardware wallet, during a recovery you started yourself. No exchange, support desk or wallet-checker page ever needs them, and anyone who asks is stealing from you.

Verify it restores before you rely on it

People skip this step, and it decides whether the plate is a backup or a souvenir.

The lightest check is built into many hardware wallets: a recovery-check function that compares words you enter against the seed already stored inside. It catches transcription errors without moving funds, and should be run against the plate, with the original put away.

The fuller test is a real restore. Wipe the device, or use a second one, and recover from the plate alone. Matching receiving addresses are the proof; a wallet that opens with unfamiliar addresses means something differs, usually the account type or a passphrase. Do this while the stakes are low. If the device is new to you, our setup walkthrough goes slowly.

Storing it, and making sure someone knows it matters

A verified plate carries two opposing risks: it can be destroyed, and it can be found. Every storage decision trades one against the other.

Redundancy answers destruction: a second copy in another building removes the single fire or burglary that takes everything. A bank box is hard to burgle but bound by access rules; a relative’s spare room is convenient but depends on a stable relationship. Discretion answers discovery, so do not label the plate with a coin name.

Balance that against the tidy-up problem, which discretion makes worse. Somebody you trust should know the object matters and must never be binned, even without knowing what it says. A sealed letter of instructions, stored separately, handles inheritance without exposing the words.

If one plate concentrates more risk than you are comfortable with, the answer is not to cut the phrase in half. Naive splitting weakens security and raises the chance of permanent loss at the same time. The structural answer is multisig, which spreads the requirement across independent keys by design.

Key takeaways

Paper fails through damp, fading, fire and accidental disposal. Metal fixes the physical failures, none of the human ones.
Stamped, engraved and tile systems all work; corrosion-resistant metal and careful assembly matter more than the format.
Never photograph the plate, and never store it with the device it protects.
English BIP-39 words are uniquely identified by their first four letters, which makes stamping and checking easier.
A backup you have never restored from is an assumption. Verify it early, while the amount at stake is small.

Frequently asked questions

Is a metal backup overkill if I only hold a small amount?

Possibly, and that is yours to judge. The useful question is not how much you hold today but how much it would hurt to lose access permanently. Paper in a sealed bag, inside a fire-resistant box and away from damp, is a reasonable interim step. A photo of the phrase never is.

Should I split my phrase across two plates in different places?

Usually not. Splitting a phrase in half does not halve the work for an attacker as neatly as people expect, and it doubles the number of places where one loss makes recovery impossible. If the goal is removing a single point of failure, multisig does it far more predictably.

Can I just laminate paper instead?

Lamination helps against damp and handling, which is a real improvement on a loose sheet. It does nothing against heat, and an imperfect seal can trap moisture against the paper. Treat it as making paper last longer, not as an alternative to metal, and keep the same rules on separation and verification.

Should the passphrase go on the plate too?

Storing the words and the passphrase on one object removes most of the benefit, because whoever finds the plate has everything. The usual approach is to keep them separate, so finding one is not enough. Whatever you choose, record clearly for your future self that a passphrase exists, or a correct-looking restore will show an empty wallet.