Seed Phrase Security Checklist: How to Store Crypto Safely (2026)

November 14, 2026 Mbatia Muitungu

Last updated: November 10, 2026.

Not financial advice: This checklist is general security education based on wallet makers’ official guidance, the BIP-39 standard and FBI reporting. Follow your own wallet’s current instructions where they differ. Crypto is volatile and you can lose all of it.

Affiliate disclosure: This page mentions companies that run affiliate or referral programs. If we ever link to them through an affiliate link and you sign up or buy, Digital Currency Pulse may earn a commission at no extra cost to you. It never changes what we recommend. Read our full affiliate disclosure.

Anyone who sees your seed phrase can take every coin in that wallet, from anywhere, without your device or PIN. Almost every rule for storing crypto safely comes down to one thing: keep those words offline, private and recoverable, and treat any request for them as an attack.

Use the checklist below whether you hold crypto in a hardware wallet, a phone wallet or both. It works the same in any country.

Key takeaways

A seed phrase (also called a recovery phrase or wallet backup) is usually 12 or 24 words. It can rebuild your wallet on any compatible device.
Write it on paper or metal. Never type it into a website, app, email, chat, cloud note or photo.
No real company, support agent or “recovery service” will ever need your seed phrase. Ledger says plainly that anyone asking for it is a scammer.
Check your backup works before you put serious money in the wallet, and store it where fire, water and curious visitors can’t reach it.
In its 2025 report, the FBI’s Internet Crime Complaint Center logged $11.366 billion in US losses on complaints involving crypto, up 22% from 2024.

What a seed phrase is, and why it matters

Most wallets follow a standard called BIP-39. Your wallet generates random data, adds a checksum and turns the result into words from a fixed list of 2,048. Under the standard, 12 words encode 128 bits of randomness and 24 words encode 256 bits. Those words produce the private keys for every account in the wallet.

That’s why the phrase is more important than the device. If a hardware wallet breaks or is lost, you can restore everything on a new one from the words. If someone else gets the words, they can do the same, and blockchain transactions can’t be reversed.

The seed phrase security checklist

1. Create it safely

Let the wallet generate the words. Don’t make up your own phrase. BIP-39 says the method is meant for computer-generated randomness, not sentences people choose.
Use a genuine device. Buy a hardware wallet from the maker or an authorized reseller, never second-hand. A device that arrives with words already filled in is a scam.
Write the words down in private, with no cameras or other people around, in the exact order shown.

2. Store it offline

Paper or metal only. No photos, screenshots, cloud drives, email drafts, notes apps or password managers. Ledger tells customers never to enter the phrase on a computer, phone, app or website.
Consider a metal backup if fire or flooding is a risk where you live. Ledger publishes guidance on protecting your phrase from natural disasters.
Keep it away from the device. If a thief finds your hardware wallet and your phrase in the same drawer, the PIN won’t protect you.
Don’t split the words into homemade halves. A missing part can lock you out. If you want a split backup, use a method your wallet supports, such as Trezor’s multi-share backups.

3. Test it

Run your wallet’s backup check before sending real money. Trezor devices include a built-in check that confirms the words you wrote match the wallet.
Send a small test amount first, then confirm you can see it in the wallet app.
Check legibility once a year. Faded ink or a damaged plate is easier to fix while you still have working access.

4. Never share it

No support team will ask for it. Not Ledger, Trezor, Coinbase, Kraken, MetaMask or any other company.
Ignore “wallet validation” or “sync” pages, pop-ups claiming your wallet is compromised, and messages asking you to “verify” your phrase.
Be wary of recovery offers. The FBI’s 2025 report warns about fake law firms and fake recovery services that target people who already lost crypto to a scam, and about scammers impersonating the IC3 itself.
Don’t enter it to “fix” a problem someone found for you on social media or in a direct message.

5. Add layers if you need them

Optional passphrase. Trezor devices, like many other hardware wallets, support an extra passphrase (sometimes called the 25th word) that opens a separate wallet. Trezor warns that a passphrase cannot be changed or recovered: lose it and you lose those funds. Use one only if you understand the trade-off and write it down too.
Device PIN. Set a PIN that isn’t your birthday or 1234. The PIN protects the device; the phrase protects the wallet.
Separate your money. Keep long-term savings in a hardware wallet, and only spending money in a phone wallet or on an exchange.

6. Lock down your exchange accounts too

If you keep some crypto on an exchange, there is no seed phrase to protect; your login is the key.

Use a unique, long password for each exchange.
Turn on two-factor authentication with an authenticator app or hardware security key rather than text messages.
Turn on withdrawal address allowlisting or similar settings if your exchange offers them.
Watch for fake login pages. Type the exchange’s address yourself or use a bookmark.

7. Plan for your family

Make sure someone you trust can find the backup if something happens to you, without being able to use it today. A sealed letter with an estate lawyer, or instructions kept apart from the phrase, are common approaches.
Write down what you hold and where: which wallets and exchanges, and which coins. Leave out the words and passwords.

Why scams focus on the seed phrase

The numbers show how big the problem is. The FBI’s Internet Crime Complaint Center (IC3) received 181,565 complaints involving cryptocurrency in 2025, with $11.366 billion in reported losses. The average loss was $62,604, and 18,589 people reported losing more than $100,000. Crypto ATMs and kiosks alone accounted for 13,460 complaints and $389 million in losses.

Not all of those cases involved a stolen phrase. Many were investment scams in which victims sent the money themselves. But a phrase handed to a scammer gives them access with no way to reverse it, which is why this one rule matters more than any other.

If you’re in the US and think you were scammed, report it at ic3.gov. Move any remaining funds to a brand-new wallet with a new phrase from a device you trust. Outside the US, report to your national police or fraud agency.

Common mistakes

Mistake	Why it’s dangerous	Do this instead
Photo of the words on your phone	Cloud backups and malware can expose photos	Paper or metal, stored offline
Typing the phrase into a “wallet checker” site	Sends the words straight to whoever runs the site	Use the backup check on your own device
One copy, kept next to the device	One fire or one burglary takes both	Store the backup apart from the device; consider metal
Buying a used or “pre-configured” device	The seller may know the phrase	Buy new from the maker or an authorized reseller
Forgetting an optional passphrase	The passphrase wallet can’t be recovered	Only use one if you’ve written it down and tested it

Frequently asked questions

Should my seed phrase be 12 or 24 words?

Both are standard under BIP-39. Use what your wallet generates. A 24-word phrase encodes more randomness (256 bits against 128), but either one is only as safe as the way you store it.

Can I store my seed phrase in a password manager?

Wallet makers such as Ledger advise against entering it on any computer, phone or app. Keeping it offline removes the risk of that account or device being hacked.

What if someone saw my seed phrase?

Treat the wallet as compromised. Set up a new wallet with a new phrase and move your funds to it as soon as possible.

Does an exchange account have a seed phrase?

No. On a custodial exchange the company holds the keys, and your password and two-factor settings protect the account.

Is a hardware wallet enough on its own?

No. The device protects your keys day to day, but your backup words are what let you, or a thief, recover the wallet. See our step-by-step hardware wallet setup guide.

Sources

Primary sources used for this article (links checked November 10, 2026):

Bitcoin BIPs: BIP-39: Mnemonic code for generating deterministic keys
FBI IC3: 2025 Internet Crime Report (cryptocurrency section)
FBI: Cryptocurrency and AI scams bilk Americans of billions
Ledger: How to keep your 24-word Secret Recovery Phrase and PIN safe
Ledger: How to protect your Secret Recovery Phrase from natural disasters
Ledger: Ledger authorized resellers
Trezor: What is a passphrase?
Trezor: Check your wallet backup on Trezor

Not financial advice. Crypto is volatile and you can lose all of it. Follow your wallet maker’s current official instructions if they differ from this checklist.