Seed phrases and private keys: how they work and how to store them

A private key is a secret number that proves you are allowed to spend the crypto held at a particular address. A seed phrase (also called a recovery phrase or mnemonic) is a list of 12 or 24 ordinary words from which your wallet can rebuild every private key it will ever use. Whoever has the seed phrase has the coins, so it should be written down offline, kept somewhere safe and never typed into anything except a wallet you are restoring yourself.

Our guide to crypto wallets and custody covers the bigger choice between leaving coins with an exchange and holding them yourself. This guide goes one level deeper into the keys themselves: what the words actually are, how one phrase produces many addresses, why a wallet from one company can usually restore a phrase made by another, and the practical storage and recovery mistakes that cause most losses.

Risk warning: crypto assets are highly volatile and largely unregulated outside the scope of the EU's MiCA regulation. In self-custody there is no help desk and no compensation scheme. If your seed phrase is lost or stolen, your coins are almost certainly gone for good.

Private keys, public keys and addresses

Start with the private key, because everything else is derived from it.

On Bitcoin, Ethereum and most other major networks, a private key is a 256-bit number: a number chosen at random from a range so large that it is roughly comparable to the number of atoms in the observable universe. From the private key, the wallet calculates a public key using elliptic-curve cryptography. That calculation is easy in one direction and, with today's computers, practically impossible to reverse. From the public key, the wallet then calculates an address, usually by hashing it and encoding the result in a shorter format.

The result is a one-way chain:

• Private key (secret): signs transactions.
• Public key (can be shared): lets the network check the signature.
• Address (shared freely): where people send you coins.

When you send crypto, your wallet uses the private key to produce a digital signature for that specific transaction. Every node on the network can check that the signature matches the address the coins are leaving, without ever seeing the private key. This is why the coins are said to be "on the blockchain" rather than "in your wallet": the wallet holds only the key that can sign for them. If you want the background on how the network agrees on transactions, see blockchain explained.

Two consequences follow. First, anyone who learns your private key can sign transactions exactly as you can, and the network has no way to tell the difference. Second, if you lose the private key, the coins at that address stay there, visible to everyone and spendable by no one.

From one phrase to many keys

Early wallets generated a separate random private key for each address, and users had to back up a file of keys that grew every time they received coins. Modern wallets solve this with two widely used standards, both originally written for Bitcoin and later adopted across most of the industry.

BIP39: turning randomness into words

BIP39 defines how a wallet turns a block of random data into words. For a 12-word phrase, the wallet generates 128 random bits, adds a short checksum calculated from those bits, and splits the result into twelve 11-bit chunks. Each 11-bit chunk is a number from 0 to 2,047, which points to one word in a fixed list of 2,048 words. A 24-word phrase works the same way with 256 random bits.

Some useful details:

• The word list is standard. The English list has 2,048 words, chosen so that the first four letters of each word are unique. Some wallets let you type only the first four letters when restoring.
• The order matters. The same twelve words in a different order are a different number and, almost always, an invalid phrase.
• The last word carries the checksum. In a 12-word phrase, 4 of the 132 bits are checksum; in a 24-word phrase, 8 of the 264 bits are. If you mistype a word, the wallet will usually reject the phrase as invalid rather than open an empty wallet.
• The words are not a password you choose. A phrase you invent yourself, or words chosen because they mean something to you, are far weaker than words generated by the wallet, because people are bad at randomness.

BIP32 and derivation paths: a tree of keys

The phrase is then converted into a single master seed, and from that seed BIP32 defines how to derive a whole tree of child keys in a predictable order. Each branch is identified by a derivation path, a string of numbers that says which coin, which account and which address index is meant. A related standard, BIP44 and its successors, gives common paths for common coins.

The practical upshot is that one phrase can generate an effectively unlimited number of addresses across several networks, and that any wallet following the same standards, given the same phrase and the same derivation path, will regenerate exactly the same keys. That is why you can usually restore a phrase created on one hardware wallet into a different brand of software wallet.

Why a restored wallet sometimes looks empty

It is common to restore a valid phrase into a new app and see a zero balance. The coins have not vanished. The new wallet is probably looking at a different derivation path, a different address type (Bitcoin has several, such as legacy, SegWit and Taproot addresses), or a different network. Before panicking, check:

1. Is this the same network and coin the funds were on?
2. Does the wallet let you choose the address type or derivation path?
3. Did the original wallet use an extra passphrase (see below)?
4. Are you sure every word is correct and in order? A wrong word that happens to pass the checksum produces a valid but different, empty wallet.

Never paste your phrase into a website that promises to "scan" it for missing funds. That is one of the most common theft techniques.

Why nobody can guess your seed phrase

Beginners often worry that someone could simply try word combinations until they hit theirs. The numbers say otherwise.

An illustrative calculation. A 12-word BIP39 phrase holds 128 bits of randomness, which means 2 to the power of 128 possible phrases, about 340 undecillion, or 3.4 followed by 38 zeros. Suppose an attacker could test a trillion phrases a second, far beyond what is realistic once each phrase must be turned into keys and checked against a blockchain. At that rate, working through just one-billionth of the possibilities would take around 10 billion years.

Twenty-four words (256 bits) is vastly larger again, though most specialists regard 128 bits as already far beyond brute force. The choice between 12 and 24 words matters much less than how you look after whichever you have.

The same maths explains why partial loss is sometimes recoverable and full loss never is.

Worked example: one missing word

These are illustrative numbers. You have eleven of your twelve words and you know which position is missing. There are 2,048 candidate words for that slot. Because the checksum rejects roughly 15 in 16 candidates, only about 128 of them form a valid phrase, and your own wallet software, offline, could test each one and check whether the resulting addresses have ever been used. That is a small search.

If you have eleven words but do not know which position is missing, there are 12 possible positions times 2,048 words, or 24,576 candidates, of which roughly one in sixteen pass the checksum. Still feasible.

If two words are missing at known positions, there are 2,048 times 2,048, about 4.2 million combinations. Feasible with care, on an offline machine, with open-source tools you trust.

Lose all twelve and you are back at 2 to the power of 128. Nobody, at any price, can recover that. The lesson is that the backup is worth more than the device: a broken hardware wallet costs you the price of a new one, but a lost phrase costs you everything.

A warning goes with this example. People who have lost words are prime targets for "recovery services" that ask for the words you still have. Handing over eleven words is very nearly handing over the wallet. Our guide to crypto scams and regulation covers recovery fraud.

The optional passphrase

Many wallets support a BIP39 passphrase, sometimes called a 25th word, though it can be any text. The passphrase is combined with the words when the master seed is created. Each different passphrase produces a completely different wallet, and a blank passphrase is itself one of those wallets.

What it adds:

• Protection if the words are found. A thief with your twelve words but not the passphrase opens only the blank-passphrase wallet.
• A decoy option. Some people keep a small balance in the blank-passphrase wallet and the main balance behind the passphrase.

What it costs:

• A second single point of failure. There is no checksum on the passphrase. A typo or a forgotten capital letter silently opens a different, empty wallet, and there is no way to reset it.
• More complexity for heirs. Someone who finds your words but not your passphrase sees an empty wallet and may conclude there was nothing there.

If you use a passphrase, store it separately from the words, but just as carefully, and test that you can restore with both before putting meaningful sums behind it.

How to store a seed phrase

The goal is a backup that survives fire, flood, house moves and the passage of years, and that a thief, a nosy visitor or malware cannot reach.

Write it, do not photograph it

Write the words by hand, clearly, numbered 1 to 12 or 1 to 24, on the card that came with the wallet or on good paper. Do not photograph it, scan it, email it, store it in a notes app, a password manager synced to the cloud, a messaging app or a document on your computer. Anything that touches an internet-connected device can be copied by malware or exposed in a data breach without your knowledge.

Consider metal for long-term storage

Paper burns, fades and gets wet. Stamped or engraved steel plates, and kits that slot letter tiles into a metal frame, are made for this purpose. Because the first four letters of each English BIP39 word are unique, many metal backups record only four letters per word, which saves space.

Think about location and copies

One copy at home is vulnerable to a single fire or burglary. Two copies in separate secure places, for example a home safe and a safe deposit box, protect against that, but every extra copy is another place a thief could find it. Most people settle on two. Avoid labelling the backup "crypto seed phrase" in large letters.

Splitting the phrase: usually a bad idea

A common idea is to store words 1 to 6 in one place and 7 to 12 in another. This weakens security more than people expect, because anyone who finds half the phrase has removed half of the randomness, and it still leaves you with two places that must both survive. If you want a backup that needs several pieces, use a scheme designed for it: a multisignature wallet, which requires two or more independent keys to sign, or a wallet that supports Shamir backup (the SLIP-39 standard), which splits the secret into shares so that, say, any two of three can rebuild it while one alone reveals nothing useful. Both add complexity, and complexity causes its own mistakes.

Test the backup

A backup you have never tested is a hope, not a backup. With a small amount in the wallet, wipe or reset the device (or use a second device) and restore from your written words. Confirm that the same receiving addresses appear. Only then move larger sums. Many hardware wallets also have a check function that lets you confirm the words without fully wiping.

How a hardware wallet changes the picture

A hardware wallet is a small device that generates and keeps the private keys inside a secure chip and signs transactions without the keys ever leaving it. Your computer or phone prepares the transaction, the device displays it on its own screen, you confirm with a button, and only the signature goes back.

It protects the keys from malware on your computer. It does not protect you from:

• Signing something malicious. If you approve a harmful transaction on the device, it will dutifully sign it. Our guide to crypto phishing and wallet drainers explains how this happens.
• Disclosing the phrase. The device keeps the keys safe only until you type the words somewhere else.
• Tampered devices. Buy directly from the manufacturer or an authorised reseller. A device that arrives with a pre-printed seed phrase card, or that asks you to enter an existing phrase on first use, has been tampered with or is fake. A genuine device generates a new phrase and shows it to you on its own screen.

Common mistakes

Almost no one loses crypto because cryptography failed. They lose it in one of these ways.

• Storing the phrase digitally. Photos sync to cloud accounts, notes apps get backed up, laptops get stolen. This is the single most common avoidable mistake.
• Typing the phrase into a website. No legitimate exchange, wallet, airdrop or support team needs your seed phrase. Pages asking you to "validate", "synchronise" or "unlock" a wallet by entering it are theft pages.
• Giving it to "support". Scammers watch social media for people asking for help and reply posing as wallet support. Real support never asks for the phrase.
• Using a phrase someone else generated. Pre-filled cards, phrases from a "setup service", or a phrase supplied by a seller mean someone else may already have the keys.
• Making up your own words. Human-chosen phrases, song lyrics and famous quotes are guessable in ways that random words are not.
• Never testing the backup. Smudged handwriting, a skipped word or two swapped words are discovered only when the original device fails.
• Forgetting the passphrase. Without a checksum, a forgotten or mistyped passphrase looks exactly like an empty wallet.
• No plan for heirs. Coins nobody knows about, or that nobody can reach, are lost when the owner dies or becomes incapacitated.
• Confusing an exchange login with a seed phrase. An exchange account has a password and two-factor authentication; you do not have the private keys, and the exchange's solvency is the main risk. See how crypto exchanges work.

Planning for someone else to inherit

The awkward truth is that the better you protect your coins from thieves, the harder you may make it for your family. Some principles that work for many people:

• Keep a letter, stored with your will or your solicitor, that says what you hold, which wallets and devices you use, and where the backup is kept, without containing the seed phrase itself.
• Make sure the person who would need to act knows the letter exists.
• If you use a passphrase or multisignature setup, the instructions must explain how the pieces fit together, in plain language a non-specialist can follow.
• Review it when you change wallets or move coins.

A lawyer who deals with digital assets can advise on the rules in your country. The aim is that the right person can follow the trail, while no single document in someone else's drawer is enough to steal the coins.

Do you need any of this if you trade crypto CFDs?

No. If you trade crypto through CFDs, you never hold coins or keys. You have an account with a broker, protected by a password and ideally two-factor authentication, and your exposure is a price contract. Your risks are different: leverage (capped at 2:1 for retail clients in the EU under ESMA-based rules), overnight financing, weekend gaps and the broker's own soundness. Our guide to crypto CFDs vs buying crypto compares the two routes, and the crypto position size calculator helps size CFD trades so that a single move cannot take too much of your account. Most retail CFD accounts lose money; brokers are required to publish the percentage.

Check any broker's authorisation on the official registers linked from our regulator registers page before you open an account.

Frequently asked questions

What is the difference between a seed phrase and a private key?

A private key controls one address. A seed phrase is a master backup from which a wallet can regenerate all of its private keys, for every address and, often, several networks. Losing a single private key loses one address; losing the seed phrase loses the whole wallet.

Is a 24-word seed phrase safer than a 12-word one?

A 24-word phrase has more randomness, 256 bits against 128, but 128 bits is already far beyond any realistic guessing attack. In practice the length matters far less than how the phrase is stored. A 24-word phrase in a cloud photo album is much less safe than a 12-word phrase stamped in steel in a safe.

Can I store my seed phrase in a password manager?

Many security-minded users avoid it, because a password manager is an online service on internet-connected devices, and a breach or compromised device could expose everything at once. An offline, physical backup removes that whole category of risk. If you do use one for convenience, understand that you are trading some security for it.

What should I do if I think someone has seen my seed phrase?

Treat the wallet as compromised. Set up a new wallet with a newly generated phrase, back it up properly, and move the funds across as soon as you can, starting with the largest balances. Do not reuse the old phrase for anything.

Can a wallet company recover my seed phrase if I lose it?

No. In a genuine self-custody wallet the phrase is generated on your device and the company never has it. Anyone who claims they can recover it for you is either mistaken or running a scam.

Does a hardware wallet need its own seed phrase backup?

Yes. The device holds the keys, but devices break, get lost or are stolen. The seed phrase is what lets you restore the same wallet on a replacement device. Without it, the hardware wallet is the only copy of your keys.