What Is a Seed Phrase? How to Back Up a Crypto Wallet

A seed phrase is a list of 12 to 24 words that encodes the random number behind every key in a crypto wallet. A 12-word phrase holds 128 bits of randomness, and anyone who reads the words can rebuild the wallet and empty it. You back it up offline, in pencil on paper or stamped into metal.

For anyone who moves coins off an exchange into their own wallet, those words are the wallet, and they look the same at any strength. In late July 2026, Coinkite said some Coldcard Mk2 and Mk3 hardware wallets had made seeds with about 40 bits of randomness against an intended 128. Attackers rebuilt them offline without touching a device.

What Is a Seed Phrase?

The SEC's investor bulletin calls a seed phrase "a random sequence of words that allows you to restore your crypto wallet" if the device or the key is lost. The same bulletin makes a point beginners often miss, that a wallet holds private keys and never the coins themselves.

So a crypto seed phrase is the master copy of everything a crypto wallet controls. Lose the phone or the hardware device and the coins stay on the blockchain, where new wallet software can find them again once you type the words back in.

Wallets call the same words a recovery phrase, a backup phrase or a mnemonic phrase. The Bitcoin Wiki dislikes "mnemonic" because it suggests the words should live in your memory. It also notes that a seed phrase restores funds on the blockchain only, so Lightning channels need a backup of their own.

How Does a Seed Phrase Work?

The most common standard for seed phrases is BIP-39, a Bitcoin specification that turns raw randomness into words.

The wallet draws 128 to 256 random bits and adds a short checksum taken from the SHA-256 hash of those bits. It then cuts the result into 11-bit groups, and each group is a number from 0 to 2,047 that picks one word from a fixed list of 2,048.

Method: a 12-word phrase is 12 x 11 = 132 bits, of which 128 are random and 4 are checksum. So only 1 in 16 random lists of 12 words passes the check, and only 128 of the 2,048 words can end any given set of eleven. A 24-word phrase leaves 8 possible last words.

That checksum is a typo guard. BIP-39 says software must "issue a warning" when the checksum fails, and the list's designers picked words whose first four letters identify each one.

BIP-39 also lets you add an optional passphrase, which some wallets call a 13th or 25th word.

The words and the passphrase go through 2,048 rounds of a hashing function to produce a 512-bit seed. Because "every passphrase generates a valid seed," a typo in the passphrase opens a different and empty wallet with no error message.

That seed then feeds BIP-32, which describes "deriving a tree of keypairs from a single seed" for the whole wallet. Every address the wallet hands out grows from that one tree, so deterministic wallets "do not require such frequent backups" and one sheet of paper can restore them all.

Can a Seed Phrase Be Guessed?

A properly generated seed phrase can't be guessed in any practical sense. A 12-word phrase has 2^128 possible versions, a number 39 digits long. A 24-word phrase raises that to 2^256, about 1.16 x 10^77.

The catch is that twelve words look the same at 40 bits of randomness as they do at 128. Coinkite's write-up on the Coldcard entropy bug puts seeds made on Mk2 and Mk3 firmware 4.0.1 to 4.1.9 at about 40 bits, a preliminary estimate.

Mk4 and Mk5 devices and the Q mixed in extra randomness from their secure chips and reached about 72 bits. Coinkite says the devices themselves "were not hacked" or remotely accessed. Attackers regenerated the weak seeds offline and rebuilt the matching private keys, then took the funds.

Method: 40 bits gives 2^40 possible seeds, about 1.1 trillion. A full 128 bits gives about 3.1 x 10^26 times as many (2^88), and both figures rest on Coinkite's preliminary 40.

A brute-force attack on a seed phrase succeeds when its randomness is weak or part of it leaks.

Coinkite calls the smaller search space "a direct security risk" for affected wallets, and it exempts seeds whose owners added at least 50 private dice rolls. It says a strong, unique passphrase lowers the exposure without repairing the seed.

The words never show how they were made, so a seed phrase should come from a generator you trust and never from your own head.

Phemex's report on how a developer warned Coinkite about the Coldcard flaw more than a year early covers how long the bug stayed in shipping devices.

Seed Phrase vs Private Key

A private key signs for one address, and the seed phrase is the source every private key in the wallet comes from. Hand someone a single private key and you give away one address. Hand over the seed phrase and you give away every address the wallet has made or will make.

The SEC compares a private key to a password and a public key to an email address. Phemex's guide to how Bitcoin public and private keys work covers that pairing in more depth.

A raw private key is a long string of characters where one wrong letter can make it useless. Seed words are more forgiving, because a word with one or two unreadable letters can usually still be worked out from the list.

How to Back Up a Seed Phrase

A Bitcoin seed phrase backup has two jobs. It has to outlast fire and water, and it has to stay where no one else can read it.

1. Write the words down by hand when the wallet first shows them, in order, in pencil on acid-free paper. The Bitcoin Wiki rates pencil well above pen for paper that has to last.

2. Write the wallet software's name beside the words, since the Wiki notes that a phrase generally works only with the software that made it.

3. Stamp or engrave a second copy into metal, which the Wiki recommends wherever fire or water is a risk.

4. Keep the paper and the metal copy in two separate places you control, so one fire or one burglary can't take both.

5. If you use a passphrase, record it on its own and store it away from the words, since Coinkite warns that losing it means losing the wallet.

6. Verify the backup before you fund the wallet and send a small test amount before the rest, the same order Coinkite gives for replacing an affected seed.

Risks of a Seed Phrase and Common Mistakes

• Typing it into a website. The Bitcoin Wiki says the phrase "must not be typed into any website," and anyone who asks for it wants the funds. A genuine recovery never needs your words on someone else's screen.

• A photo, a cloud note or a password manager. Each one makes the phrase a file on a connected device. The Wiki lists computer files and online copies among the storage methods it does not recommend.

• Splitting it six and six. Whoever finds one half of a split 12-word phrase has about 62 bits left to search, against 128 for the whole phrase. Six words carry 66 bits, and the 4-bit checksum takes that down to 62. The Wiki calls a split "far easier to brute-force" and points to multi-signature wallets for spreading control.

• Choosing your own words. A favourite lyric carries a fraction of the randomness a wallet generates, and most hand-picked lists fail the checksum anyway. The Bitcoin Wiki puts it bluntly, saying humans are bad at generating randomness.

• Forgetting the passphrase. The BIP-39 passphrase is a separate secret from the password that encrypts a wallet file on your computer, and losing it loses the wallet. The Wiki warns against overestimating how well you'll remember a passphrase you rarely type.

How to Stay Safe on Phemex

A Phemex account has no seed phrase. It runs on a password and two-factor authentication, while Phemex holds the keys to the wallets behind it. Its page on how Phemex protects your crypto assets describes offline cold storage for most customer assets and multi-signature approval for transfers.

Phemex's Safety Hub roundup of four checks that protect your account states that Phemex staff will never ask for a seed phrase or a private key. The same rule covers a password and a 2FA code.

A second trap skips the phrase entirely. The roundup warns that a malicious site "does not need to ask for a seed phrase" if it can get you to approve a harmful contract. Read every wallet approval before you sign it.

Once you withdraw coins to a wallet of your own, its seed phrase becomes your only way back to them if the device fails. Futures trading on Phemex stays inside the account and never touches a seed phrase. Futures use leverage, and a leveraged position is closed automatically if losses reach its margin.

Frequently Asked Questions

Is a seed phrase the same as a private key?

No, a private key controls one address, while a seed phrase is the master record that every private key in the wallet comes from. Sharing the phrase exposes every address at once.

Can a seed phrase be changed?

No, a seed phrase can't be edited once a wallet has made it. You create a new wallet with a fresh phrase and move the funds across. Coinkite gives that advice for affected Coldcard seeds, since a firmware update doesn't repair an old one.

How many words are in a seed phrase?

BIP-39 allows any length from 12 to 24 words in steps of three. Each step adds 32 bits of randomness, from 128 bits at 12 words to 256 bits at 24.

Can the words in a seed phrase repeat?

Yes, because each word comes from its own 11 bits and nothing in BIP-39 forbids a repeat. About 3.2% of randomly generated 12-word phrases contain at least one repeated word, and about 12.7% of 24-word phrases do.

Bottom Line

A seed phrase gets all of its strength in the instant a wallet generates it, and nothing on the paper afterward shows how well that instant went. So keep two habits. Back the words up offline, where no camera or cloud account has seen them. When a wallet maker discloses a randomness flaw, treat the old phrase as finished and move the funds to a new one.

Disclaimer: This article is for informational purposes only and is not financial advice. Cryptocurrency trading involves substantial risk. Always do your own research before making investment decisions.