What is a seed phrase? How to keep it safe
A seed phrase is a list of 12 or 24 words that backs up your crypto wallet. Whoever has the words controls everything in the wallet, from any device, with no password and no way to undo it. This page explains what a seed phrase is, how it differs from a password or a private key, how to store it, and what to do if you think someone else has seen it.
What a seed phrase is
When you create a self-custody wallet (MetaMask, Trust Wallet, a hardware wallet and others), it generates one secret from which all your private keys and addresses are derived. The wallet shows that secret as a list of words, so that it is easier to write down than a long string of random characters. This is also called a recovery phrase, secret recovery phrase, backup phrase or mnemonic phrase. These are different names for the same thing.
The phrase is usually 12 or 24 words. The words come from a fixed public list of 2,048 words (the BIP39 standard), so the words themselves are not secret. The order and the combination are.
Seed phrase, private key and password are not the same
| What it does | If someone gets it | |
|---|---|---|
| Seed phrase | Backs up the whole wallet and every address in it | They control all of it, on every chain |
| Private key | Controls one address | They control that address |
| Wallet password or PIN | Unlocks the wallet app on one device | Not enough on its own: they also need your device |
An exchange account is a different case. There the exchange holds the keys and you log in with a password. A seed phrase belongs to wallets where you hold the keys yourself.
Who is allowed to ask for it: nobody
No wallet maker, exchange, support agent, airdrop, "wallet validation" page or recovery service needs your seed phrase. If anything asks you to type it into a website, a form, a chat or an app that is not your own wallet's restore screen, it is a scam. Typical forms:
- A fake support agent in a chat or direct message who needs to "verify" or "sync" your wallet.
- A site that says your wallet must be "validated", "migrated" or "unlocked" to claim something. See fake airdrops and spam NFTs.
- A cloned wallet app or a sponsored search ad that leads to a copy of a wallet website. See the Google ad drainer case.
- A message that claims to come from your hardware wallet's maker and asks you to enter the words on a computer. A hardware wallet only ever asks for the words on its own screen when you restore from a backup. See Ledger CryptoBilis: what we know.
How to store it
- Write it by hand on paper or stamp it into metal, in the correct order, as soon as the wallet shows it.
- Do not keep a digital copy: no screenshot, photo, note app, email, cloud drive or chat. Malware and account breaches look for exactly these.
- Keep it somewhere safe and private, such as a safe. A second copy in a different place protects against fire and loss.
- Check that the backup works before you put real money in, by restoring a test wallet from it.
- Do not give it to family or friends in a message. Plan how a trusted person could find it if you are not available.
- Consider an optional passphrase (sometimes called the 25th word) if your wallet supports it. It creates a separate wallet from the same words, but if you forget it, the funds are gone for good.
If you lose it
As long as the wallet still works on your device, move the funds to a new wallet and back up the new phrase properly. If the wallet is gone and the phrase is lost, nobody can recover the funds: not the wallet maker, not an exchange, not a recovery service. Be careful with anyone who says otherwise. See crypto scam recovery: what works.
If you think someone has seen it
- Create a new wallet on a clean device, with a new seed phrase.
- Move your funds to it at once, starting with the most valuable assets. Some thieves run bots that watch an exposed wallet and sweep new deposits, so expect that you may not win the race.
- Stop using the old wallet. Do not put more money into it.
- Check what the old wallet has approved. See unlimited token approvals.
Where Hopchain fits
Hopchain never asks for, and cannot use, a seed phrase or a private key. It only reads public blockchain data. After a theft you can paste your address (or the thief's) on the home page to see where funds went and which addresses were involved, which helps when you report it. It cannot prevent a theft, undo one or tell you whether your phrase has been exposed. This is general information, not financial or security advice.
Frequently asked questions
What is a seed phrase?
A list of usually 12 or 24 words that backs up a self-custody crypto wallet. Anyone who has the words can control all the funds in the wallet.
Is a seed phrase the same as a recovery phrase or mnemonic phrase?
Yes. Seed phrase, recovery phrase, secret recovery phrase, backup phrase and mnemonic phrase are different names for the same thing.
What is the difference between a seed phrase and a private key?
A private key controls one address. A seed phrase backs up the whole wallet, so it generates all the private keys and addresses in it.
Should I ever enter my seed phrase on a website?
No. No legitimate site, app, airdrop or support agent needs it. The only place to type it is your own wallet's restore screen when you restore from a backup.
Can I recover a lost seed phrase?
No. If the phrase is lost and the wallet no longer works on any device, nobody can recover the funds.
What should I do if my seed phrase leaked?
Create a new wallet with a new phrase on a clean device and move your funds there right away, then stop using the old wallet.
Keep reading
- Fake airdrops and spam NFTs: what to do
- Unlimited token approvals: what they are and how to revoke them
- Hot wallet vs cold wallet vs hardware wallet
- Crypto scam recovery: what works and what is a scam
- Case file: a Google ad that drained wallets on BNB Chain