Is a BIP39 passphrase worth it, and what if you forget it?

A seed phrase is a complete key to a wallet. Whoever reads the words can take the coins, whether they found the paper in a drawer, photographed it during a house viewing, or were handed it by someone who was tricked. A passphrase is the standard way to make the words alone insufficient. It also introduces a failure that has emptied as many wallets as theft has: a secret its owner can no longer reproduce exactly.

What does a BIP39 passphrase actually do?

BIP39 turns the words into a seed with a key-stretching function, PBKDF2, run 2048 times with HMAC-SHA512. The salt for that function is the text mnemonic followed by the passphrase. With no passphrase, the salt is just mnemonic.

Change the passphrase by a single character and the seed changes completely, and with it every key and address. The specification states the consequence directly: every passphrase generates a valid seed. There is no stored check value, so the wallet cannot know which passphrase you meant. It simply opens the wallet that matches what you typed.

Trezor’s documentation calls each of these a hidden wallet. The wallet with no passphrase is the standard wallet; every passphrase opens its own hidden wallet; a misspelled passphrase opens a new, empty one; and the passphrase is not stored anywhere.

What does it protect against?

Threat	Seed phrase only	Seed phrase + passphrase
Someone finds or photographs the written words	Coins can be taken	Words alone open only the standard wallet
A thief steals the hardware wallet and guesses the PIN	Depends on the device	Coins behind the passphrase need the passphrase too
A person forces you to unlock a wallet	You can only open the real one	You can open the standard wallet instead; BIP39 describes this as plausible deniability
Malware on the computer you sign with	Not protected by either; this is what a hardware wallet is for	Same
You lose the passphrase	Not applicable	Coins behind it are lost
A typo in the passphrase during recovery	Not applicable	Opens an empty wallet; no error is shown

The table shows the trade. A passphrase moves risk from “someone else gets the words” to “I cannot reproduce one string exactly”. For a person whose paper backup sits in a shared home, a bank box others can reach, or a location that could be searched, that move is usually worth it. For someone who already struggles to keep one backup safe, it may double the chances of loss.

How is a passphrase different from a PIN or a password?

The three are easy to confuse because wallets ask for all of them at different moments.

	Device PIN	BIP39 passphrase	App or account password
What it protects	Physical access to one device	The derivation of the keys themselves	Access to one app or online account
Part of the backup?	No	Yes, needed on every recovery	No
Can be reset?	Yes, by wiping the device and restoring from the seed	No; it is not stored anywhere	Usually yes, through the app or service
Wrong entry	Rejected, often with a delay or a wipe after several tries	Accepted: opens a different, empty wallet	Rejected
Needed by heirs?	No, they restore on a new device	Yes	Depends on the service

The middle column is the one that surprises people. A PIN guards a device that can be replaced; a passphrase is part of the wallet, and nothing can replace it.

Can I use more than one passphrase?

Yes. Every passphrase opens its own wallet from the same seed phrase. Some people keep a small amount in the standard wallet with no passphrase, or under a simple decoy passphrase, and the savings under a stronger one. BIP39 describes this property as plausible deniability: there is no way to tell from the words alone how many wallets exist or which is the main one.

Each extra wallet is another secret to back up and test. Two or three passphrases written down and stored properly are manageable; a collection of memorised variants is how coins get stranded.

How do people lose passphrases?

The ways are mundane, which is why they happen:

• A memorised phrase that drifts. “Correct horse” becomes “correct horse” with a lowercase c, or a trailing space that was there on the first day and not later. Trezor notes that passphrases are case-sensitive and that a space counts as a character.
• A passphrase entered on a different keyboard layout. The same keys produce different characters on a different layout.
• A passphrase that only one person knows, who then dies or becomes unable to communicate. The heirs have the words and an empty wallet.
• A passphrase kept next to the seed phrase. It is not lost, but it no longer protects anything.

How should a passphrase be backed up?

Treat it as a second secret with its own backup, held separately from the first.

1. Write it down exactly, including case, spaces and punctuation. If it contains characters that are easy to confuse, note them in words beside the string.
2. Store it in a different place from the seed phrase, so that one discovery does not reveal both.
3. Test it by recovering on a hardware wallet with the written words and the written passphrase, then comparing the first receiving address with your note. The backup test guide walks through the steps.
4. Decide who can reach it. If heirs should be able to recover the coins, the passphrase must reach them by a route that does not also expose it today. See leaving bitcoin to your family.

Long random strings are the hardest to guess and the easiest to lose. A passphrase of several ordinary words, written down and stored separately, is easier to reproduce correctly and still far beyond guessing for anyone who has only the seed phrase.

What should the written record look like?

A passphrase record has one job: to let a person who has never seen it reproduce it exactly, under stress, on a small device keyboard.

• Write it in clear block capitals and lower case as appropriate, and mark which is which if your handwriting could blur the difference.
• Spell out invisible or ambiguous characters: “space between the words”, “no space at the end”, “zero, not the letter O”.
• Note the keyboard it was first typed on if it contains anything beyond plain letters and digits.
• Add a hint of where it belongs, without saying where the seed phrase is: for example, which wallet and which device it is for.
• Date it, and replace the record whenever the passphrase changes, destroying the old one.

A record like this looks fussy. It is the difference between an heir recovering the wallet on the first attempt and an heir facing an empty wallet with no error message to explain why.

Is it compatible with every wallet?

The passphrase is part of BIP39 itself, so any wallet that implements BIP39 with passphrase support derives the same seed from the same words and passphrase. What differs between wallets is practical: devices limit the length of the passphrase and the characters that can be entered on them, so check the limits in your device’s documentation before choosing one. Trezor’s documentation also notes that the same backup and passphrase derive identical addresses in compatible third-party wallets.

Shamir backups under SLIP-39 also support a passphrase, applied to the master secret before it is split. The SLIP-39 specification restricts the passphrase to printable ASCII and repeats the BIP39 warning in its own words: there is no way to verify that the correct passphrase was used. A SLIP-39 backup cannot be restored in a BIP39-only wallet, so the choice of standard must be settled before the passphrase question.

Are there alternatives?

• A multisig wallet spreads signing across several keys held in different places, so that one stolen backup is not enough and one lost backup is survivable. It removes the single point of failure rather than moving it, at the cost of more setup and a wallet configuration that must itself be backed up.
• A Shamir split (SLIP-39) means no single share reveals the secret, while a minimum number of shares rebuilds it. It protects the backup without a memorised secret, but every share must be stored and tested.
• Physical security alone: a well-hidden, well-tested seed phrase with no passphrase. Simplest to recover, weakest if the words are found.

So is it worth it?

It is worth it when the realistic risk is that someone else reads the words, and when you can store and test a written passphrase separately from the seed phrase. It is not worth it if the passphrase would exist only in one person’s memory, or would be kept next to the words. In both of those cases the passphrase adds a way to lose the coins without adding protection.

Whatever you choose, the one rule is the same as for the seed phrase: a passphrase that has not been used in a recovery test is a guess.