The Passphrase (25th Word): Real Protection, Real Risk

The quick version. A BIP-39 passphrase, often called the 25th word, is an extra secret added to your recovery phrase. It does not lock your existing wallet; it derives an entirely different one that exists only while that exact passphrase is supplied. That makes it genuinely powerful against someone who finds your written backup, and genuinely dangerous, because a forgotten or mistyped passphrase means those funds are unreachable forever. There is no reset and no support line.

What a passphrase actually does

To understand the risk you must understand the mechanism. Your recovery words are a human-friendly encoding of a random number. To turn them into the master key your wallet uses, the standard runs them through a key-stretching function together with a salt. That salt is the string “mnemonic” with your passphrase appended. Supply none and the salt is just “mnemonic”. Supply one and the output changes completely.

Here is the part people miss. Change one character and you get a different master key, different addresses and a different, empty wallet. There is no error message, because nothing has gone wrong from the software’s point of view. Every passphrase is valid and produces a real wallet.

So the mental model is not “a password on my wallet”. It is a dial with unlimited settings, each opening a different, unrelated safe. Your seed phrase plus passphrase A is one wallet; the same phrase plus passphrase B is another; the phrase alone is a third.

The threat it genuinely defends against

The problem it solves is specific: someone gets your written recovery phrase, but not the thing in your head.

Think about how backups are really stored. A card in a drawer, a sheet in a safe a family member can open, a copy left with a relative. A burglar, a housemate, a removals firm or a relative under pressure all represent the same failure: the words are read by someone who should not have them.

With a passphrase, reading the words is not enough. The intruder holds a valid recovery phrase that opens a wallet you deliberately left nearly empty, with no indication another exists behind it. If your main worry is physical discovery rather than online attack, that is a real upgrade.

The decoy wallet idea, honestly

The mechanism makes plausible deniability possible. You keep a modest balance on the wallet with no passphrase and the real balance behind one, so that under pressure you can hand over the recovery words and let someone find something rather than nothing. The limits are worth stating plainly.

Anyone who knows this feature exists will ask whether you are using it, because it is a documented standard rather than a secret trick. Deniability only works if the decoy is convincing, meaning a plausible balance and a history consistent with real use. An untouched wallet holding a token amount proves nothing except that you set up a decoy.

There is a nastier failure too. Someone who cannot verify whether more exists has no reason to stop. Coercion is a scenario where technical measures do very little, which is why multisig arrangements are usually the more serious answer. The passphrase’s dependable value is against discovery, not against confrontation.

The failure mode: no recovery path

This deserves the bluntest language in the article. If you forget your passphrase, or record it inaccurately, the funds in that wallet are permanently unreachable. The manufacturer cannot help, the network cannot help, and there is no reset flow anywhere.

The ways people lose one are mundane. A trailing space a phone keyboard added. Autocapitalise turning the first letter into a capital. A curly apostrophe from a word processor instead of a straight one. A phrase remembered as “MyDog2Bikes” that was written “Mydog2bikes”. None of these announce themselves; they just open an empty wallet.

Safety: Before moving any meaningful amount into a passphrase-protected wallet, wipe the device and restore it from the recovery phrase plus the passphrase exactly as you recorded it, and confirm the same addresses reappear. Test with a trivial amount first. Without that round trip you do not know your backup works.

If you use one, record it like a second seed

A passphrase is key material and deserves the same care as the words themselves.

Write it down. Memory alone is not a backup. Record the exact characters, including capitalisation and spaces, and note the length so a missing character is detectable.
Store it apart from the recovery phrase. The benefit disappears if both sit in the same box. Different room, different building, different custodian.
Keep it offline and durable. The reasoning behind metal seed backups applies here too, since paper in a damp cupboard fails quietly.
Leave instructions. An heir who finds the words but never learns a passphrase exists will conclude the wallet was empty.

Keep it simple to transcribe and hard to guess. Long and unusual beats short and clever, and avoid characters that are ambiguous in handwriting. Our guidance on backing up a seed phrase covers storage principles that apply to both halves.

Who this is actually for

A passphrase suits someone who already has the basics right and a specific reason to add one: the recovery phrase is backed up and verified, they understand they are creating a separate wallet, and physical discovery of the backup is a plausible worry.

It is a poor fit for a first wallet, for someone still learning how hot and cold storage differ, or for anyone who has never practised a restore. Adding a second irreplaceable secret to a setup you are not confident in multiplies the chance of losing everything. Get the ordinary backup genuinely right first, along the lines of protecting your seed phrase.

The trade-off is not close to neutral. You accept a higher chance of self-inflicted permanent loss in exchange for a lower chance of theft by discovery. The deciding factor is not how good you are with computers, but whether your record-keeping is genuinely reliable.

Key takeaways

A passphrase changes the salt used to derive your master key, creating a separate wallet rather than locking your existing one.
Every passphrase is valid, so a typo silently opens an empty wallet instead of showing an error.
Its strength is against someone finding your written backup; its weakness is that forgetting it means permanent loss.
Decoy wallets offer limited deniability, because the feature is publicly documented and an unconvincing decoy proves nothing.
Store it offline, apart from the recovery words, and prove the combination works with a full restore before funding it.

Frequently asked questions

Is a passphrase the same as my device PIN?

No, and confusing the two causes real losses. A PIN protects one physical device and can be reset by wiping and restoring from your recovery phrase. A passphrase is part of the key derivation itself, so in most designs it is not stored on the device and cannot be reset by anyone. Lose the PIN and you restore; lose the passphrase and the wallet it derived is gone permanently.

Can I use several passphrases with one recovery phrase?

Yes, and each produces an independent wallet with its own addresses and balances. Some people use this to separate long-term savings from spending funds while keeping a single set of recovery words. The cost is that every additional passphrase is another irreplaceable secret to record accurately and pass on, so complexity grows faster than the benefit for most households.

How long should a passphrase be?

Long enough that guessing is hopeless and simple enough that you transcribe it without error. Several unrelated words usually beat a short string of symbols, because they are easier to write legibly and read back correctly. Avoid anything personal or guessable, such as names, dates or phrases that appear elsewhere in your life, since an attacker holding your recovery words will try those first.

Does a passphrase protect me from phishing?

Not really. It defends against someone who has your written words, not against you being persuaded to hand over secrets or approve a harmful transaction. If a fake support page convinces you to enter the phrase and the passphrase together, the passphrase adds nothing at all. It is one layer against one threat, and everyday habits still do the heavy lifting.