A seed phrase backup fails in one of two ways. It can be lost: burned, soaked or simply nowhere to be found. Or it can leak: seen by someone, photographed, or dug out of a cloud account. Every storage method leans towards guarding against one of the two, and the tighter it guards one, the looser it tends to be on the other. So before choosing, work out which of the two worries you more.

Is writing the seed phrase on paper enough?

A sheet of paper, a pen, the words copied down in order and sealed in an envelope. This is the plainest way to do it.

Its strength is that it depends on no technology at all. As long as the paper survives and the writing is legible, the wallet can be restored, with no firmware needed and no company that has to still be in business.

There are two kinds of trouble it cannot guard against:

  • Physical destruction. Fire, water, mold, insects, or being thrown out as scrap paper during a move. The coins are still on the chain, but nobody can read the words any more.
  • Being seen. Anyone who gets hold of the paper can read it. People you live with, or anyone who has been inside your home, might see it.

The answer to the first is to make two copies and keep them in two different places. The answer to the second is not to leave it anywhere easy to stumble on, and not to write on the envelope what it is. While the amount is modest, paper plus a second location is enough.

Metal seed phrase plates: fireproof and waterproof, but no help against copying errors

A metal backup solves the first weakness of paper: fire, water and time. These products come in roughly two designs. One has you slide letter tiles into a metal tube or slot; the other has you punch dots or stamp letters into a steel plate. Take Trezor Keep Metal as an example: the official page describes AISI 304 stainless steel that is fireproof, waterproof and impact-resistant, records each word by punching dots into the plate, and lists the 20-word version at $99 (checked October 2026). That page gives no figure for things like the exact temperature it withstands. Whichever product you buy, go by what its own product page says.

What a metal backup cannot guard against is a mistake made while preparing it that you do not know about. A tile one slot out of place, a dot punched one position off, abandon misread as abundant: errors like these only come to light when you try to restore the wallet, and by then it is too late. So once it is made, it has to be verified, as described in the section below.

It gives no protection against being seen, either: anyone who gets hold of the plate can read the words. Whether a metal backup is worth buying depends on whether you could afford to lose the money. Once you could not, a steel plate costing tens of dollars up to a hundred or so is not expensive.

Can you photograph a seed phrase or keep it in your camera roll or cloud drive?

No. Photographing it, screenshotting it, saving it to a photo library or cloud drive, sending it to another of your own devices: none of these is acceptable. There are three reasons.

A photo does not stay on the one phone. If cloud photo sync is on, the picture is queued for upload once it is taken, and you may not notice. Once it is in the cloud, its safety depends on your cloud account, and a cloud account is usually protected by just a password and one form of two-step verification. Whoever gets into the account, or gets hold of an old device still signed in to it, can find the photo.

The text in a photo can be searched. Most phone photo apps now recognize text inside pictures so that you can search for it later. That means a photo of a seed phrase sits in the library as a piece of searchable text.

A leak cannot be revoked. A leaked password can be changed. With a leaked seed phrase, all you can do is move the coins before someone else does.

What about encrypting it in an archive before uploading?

It looks like a compromise, but there are two problems. First, the archive is only as strong as the password you set. Once the file is in someone else's hands they can keep guessing offline at their leisure, and short passwords or ones built from birthdays and common words will not hold. Second, you will have to decompress it at some point to look at it. If that happens on a device connected to the internet, the plaintext seed phrase ends up in that device's clipboard and temporary files, and you are back where you started.

What about taking a quick photo and deleting it right after?

Warning

Delete it right after cannot be relied on. A deleted photo normally goes to Recently Deleted first and stays there for a while. With sync on, it may already have uploaded before you delete it. A backup app other than the photo library may already have collected it too. Suppose you once signed in to the same cloud account on another device and that device later changed hands without being signed out: whoever has it can find the photo in the photo library or the cloud drive.

If a seed phrase really has to be moved from one place to another, copy it by hand: copy from the original onto another sheet, check it is correct, then destroy the sheet you no longer need.

Split backup (SLIP-39): one backup divided into several shares

SLIP-39 is a standard published by SatoshiLabs; its full name is Shamir's Secret-Sharing for Mnemonic Codes. It splits one backup into N shares, and M of them are needed to recover; no combination of fewer than M can reconstruct anything. You set M and N yourself, and the standard allows between 1 and 16 shares.

Take 3-of-5 as an example: five shares kept in five places. If any one or two are lost, the rest are still enough to recover. If any one falls into someone else's hands, they cannot use it, because they are still two short.

It resolves the dilemma of an ordinary backup: keep a single copy and everything is gone if that copy is destroyed; keep several and each one can leak. With shares, losing one is not fatal and neither is leaking one.

Three things to know before using it:

  • It is not interchangeable with BIP-39. The standard states that the two are incompatible, and SLIP-39 shares cannot be converted back into a BIP-39 seed phrase. So it cannot be imported into a wallet that only understands BIP-39. According to Trezor's guide, the hardware wallets that support this kind of backup, besides Trezor's own, are OneKey and Keystone, and the software wallets are Rabby, Electrum, Sparrow, BlueWallet, Wasabi and NuFi. For specific models, see the Split backup row of the hardware wallet comparison table.
  • There is more to look after. Under the standard each share is 20 or 33 words, and every share has to be kept as carefully as a seed phrase.
  • Whoever holds a share needs clear instructions. They should know it is something to keep safe, not to photograph, and useless on its own, and they should know whom to hand it to when the day comes.

A split backup suits a large amount, held by someone who has several reliable storage places or people to entrust shares to, and who is willing to stay with SLIP-39 devices for the long term.

Should you add a passphrase (the 25th word)?

The passphrase is often called the 25th word, but it does not cut the seed phrase in two, and it is not a share. According to the BIP-39 text, the passphrase is part of the salt when the seed is computed from the seed phrase. So the same seed phrase with a different passphrase gives an entirely different wallet.

What it does is add one more barrier on top of the seed phrase backup. Someone who gets hold of your seed phrase backup but has no passphrase opens only the wallet without a passphrase, which is not the one holding your money. The BIP-39 text also notes that every passphrase generates a valid wallet, so under duress you can hand over the seed phrase alone.

Using one requires buying nothing. For the hardware wallet models whose official pages state support, see the Passphrase row of the comparison table.

Warning

A passphrase cannot be recovered. Because every passphrase corresponds to a valid wallet, getting one character wrong (capitalization, spaces and punctuation all count) produces no error; the wallet simply opens empty. Forgetting it is the same as losing the seed phrase.

So the passphrase has to be written down as a backup just like the seed phrase, and stored separately from it. Once written down, it is one more secret to look after and one more place for things to go wrong.

A passphrase suits people whose seed phrase backup is already solid and who worry about the backup being found or about being coerced. If the backup itself is not yet in good shape, leave this layer for later.

Beyond a single seed phrase: multisig and social recovery

The methods so far are all ways of looking after one seed phrase well. This group takes a different approach: no single key gets to decide everything.

Multisig means a transaction needs signatures from several keys out of a set, for example two out of three. Each of the three keys has its own seed phrase and is kept separately. Lose one and you can still spend; a thief with one cannot move anything. For Bitcoin multisig, back up the multisig configuration (all the public keys, or the wallet descriptor file) alongside each key: without it, even enough keys cannot restore the wallet.

Social recovery is a design for smart contract wallets. As defined by Vitalik Buterin in Why we need wide adoption of social recovery wallets: a single signing key approves transactions day to day, and there are at least three guardians, a majority of whom can cooperate to change the account's signing key to a new one. Guardians can be your own other devices or paper backups, friends and family, or institutions that verify identity. If the key is lost, the guardians replace it and the account carries on.

The costs of these schemes are just as clear:

  • You need reliable people or places. Multisig needs several unrelated storage locations. Social recovery needs a majority of guardians you trust who are also willing to do this for you over the long run.
  • Moving money takes more effort. Multisig needs enough signatures gathered for every transaction. Social recovery means contacting guardians one by one when the key is replaced.
  • There is an extra layer of code. Social recovery, and multisig on Ethereum, are implemented with smart contracts, and whether the contract itself has a bug is one more risk you carry.

Consider this group once the amount is large enough that keeping one seed phrase on your own costs you sleep. For money that sits untouched for years, multisig is a better fit than social recovery.

How to confirm a finished backup is correct

A backup that has never been verified does not count as a backup. One miscopied word or one letter out of place is invisible in normal use and only shows up on the day the device breaks and you try to restore.

There is only one way to verify: restore the wallet once from this backup and see whether the addresses match the originals. If you have a hardware wallet, use the device's built-in backup check so that the seed phrase is entered only on the device; the official procedures for Trezor and Ledger are in how to check a seed phrase offline. During verification, do not enter the seed phrase into any web page that is online.

If you use a passphrase, verify it together with the seed phrase: the first address you see after restoring should match the address you normally receive at. If you use shares, the thing to verify is that M shares are enough to recover, and every share should have taken part in at least one verification.

Verification is not a one-off. Over time paper gets damp, storage places change and the people holding things move house. I suggest picking a fixed day each year to look at every copy: is it still there, is it still legible, and does only the right person know about it?

Suppose something happens to you. Your family needs to know three things: that these assets exist, where the backup is kept, and whom to ask for help. All three can go into a note that contains no seed phrase, kept with documents such as your will.

Choosing by how much the money matters to you

  • A small sum you could absorb losing: write it on paper, make two copies and keep them in two places.
  • Losing it would hurt: switch to a metal backup, still in two places, and verify it once it is made.
  • Losing it would affect your life: on top of the metal backup, add a passphrase or move to SLIP-39 shares. Both make safekeeping more complicated, and doing one of them properly beats doing both halfway.
  • It is the bulk of your net worth: consider multisig, with the keys spread across different devices and locations.
  • Whatever the amount: no photos, nothing in a photo library or cloud drive, and never send it to anyone, including someone claiming to be customer support. Verify it once it is made.

For what a seed phrase actually is and how it relates to a private key, see private key vs seed phrase. If you suspect a backup has already been seen by someone, go straight to the emergency steps after a private key leak.