Twelve or twenty-four plain English words. That’s all that stands between your crypto and total loss — no bank to call, no password reset, no fraud department. Billions of dollars have vanished through seed phrases that were photographed, cloud-synced, phished, burned in house fires, or never written down at all. This guide is the complete, no-shortcuts version of how to store yours — including the parts most guides skip: passphrases, inheritance, and what to do if you think it’s been exposed.

What those words actually are

Your seed phrase (also called a recovery phrase or mnemonic) is a human-readable encoding of a very large random number, standardized by an improvement proposal called BIP-39. The 2,048-word dictionary and the math behind it mean that 24 words encode 256 bits of entropy — guessing them by brute force is not a computing problem, it’s a physics problem. From this one phrase, your wallet derives every private key and address you’ll ever use (the HD wallet standard). Two consequences that matter more than any other:

  • Anyone with the phrase owns the wallet — from any device, anywhere, instantly, irreversibly.
  • Losing the phrase means losing the wallet — if your phone dies and the phrase is gone, the coins are frozen on the blockchain forever. Blockchain-analysis firms estimate that millions of bitcoins are already stranded exactly this way.

The three ways people actually lose everything

Real losses cluster into three patterns. Know them and the rules below make sense:

  • Digital theft. The phrase existed as a photo, screenshot, cloud note, email or text file. Phones sync to clouds; clouds get breached; malware hunts image galleries and documents for exactly this pattern. This is how most hot-wallet fortunes disappear.
  • Physical loss. One piece of paper, one location — then a move, a fire, a flood, a decluttering partner. No copy, no coins.
  • Social theft. The phrase was typed into a “validation” site, read out to “support,” or entered to “claim an airdrop.” All fake, all theft — see the scam red flags. Every single request for your seed phrase, from anyone, for any reason, is an attempt to rob you. This rule has no exceptions.

Where never to keep it (the complete list)

  • Photos and screenshots — including “hidden” albums and recently-deleted folders, which sync too.
  • Cloud notes (Apple Notes, Google Keep, Evernote, Notion), cloud drives, email drafts, messaging apps.
  • Password managers — encrypted, yes, but still internet-reachable attack surface for your single most important secret.
  • Any website, app or chat window — especially ones that ask first.
  • A printer connected to Wi-Fi (print queues persist), or a photo of the paper “just for backup.”

The pattern: your seed phrase should exist only in physical form, in the physical world. If it has ever touched an internet-connected device, treat it as compromised (see the last section).

The right way: paper, steel, and two locations

The setup security professionals actually use costs little:

  • Write it by hand on paper — twice. Legibly, in order, numbered. Verify each copy word by word against the wallet’s recovery check.
  • Upgrade at least one copy to steel. Paper burns at house-fire temperatures and dissolves in floods; stamped or engraved steel plates (sold by every hardware-wallet maker) survive both. For any serious amount, steel is not paranoia, it’s the baseline.
  • Store the copies in two separate, genuinely secure locations — e.g., a home safe and a bank deposit box or a trusted relative’s safe. Two copies in the same house is one point of failure with extra steps.
  • Tell no one the locations or contents. The phrase is not a secret you share to prove trust.

One more layer most people skip: do a recovery drill. Before moving meaningful funds in, wipe a spare device or a fresh wallet app and restore from your written phrase. If the words restore your wallet, your backup works; if not, you found out for $0 instead of everything.

Advanced: passphrases and multisig (know they exist)

  • The passphrase (“25th word”). Most wallets accept an optional extra word you invent, which creates an entirely separate hidden wallet. Steal the 24 words, get nothing without the passphrase. Powerful — but lose the passphrase and the same door closes on you. Worth it for large holdings; document the existence of the passphrase (not its content) in your backup plan.
  • Multisig. A wallet requiring, say, 2 of 3 keys to move funds — keys stored in different places. Removes the single-phrase point of failure entirely and is the standard for serious treasury storage, at the cost of real complexity. A graduation topic, not a day-one setup.

The question nobody asks: what happens if you die?

Self-custody has no next-of-kin process — families have watched seven-figure wallets sit on the blockchain, perfectly visible and permanently untouchable. Solve it while you’re healthy: your heirs need (1) to know the crypto exists, (2) instructions to find the backups, and (3) enough guidance to recover without being scammed while trying. A sealed letter with your estate documents pointing to the storage locations — not containing the phrase itself — plus a trusted, technically competent executor covers most situations. Uncomfortable topic; cheaper than the alternative.

If you think the phrase has been exposed

Maybe you photographed it years ago, entered it somewhere dubious, or a storage location was burgled. Act immediately, in this order: create a brand-new wallet with a fresh seed phrase (never reuse the old one), then move every asset to the new wallet’s addresses, test transaction first, everything after. Assume a bot is watching the old phrase — because if it leaked online, one is. Speed is the whole game.

Where to go next

Seed storage is one layer of a full setup — read how to set up a crypto wallet safely and the nine scam red flags that never change. New to all this? Start at what a blockchain is or browse the Learn hub.

This guide is educational only and is not financial or security advice tailored to your situation. Read our full disclaimer.