The 25th word

What the 25th word actually is

A BIP39 passphrase is an optional extra secret you can add on top of your recovery words. It is nicknamed the 25th word, which is the source of most of the confusion, because it is not a word and it is not appended to the phrase.

Your recovery words and the passphrase go through a key derivation function. The words act as the password and the passphrase becomes part of the salt. Change one character of the passphrase and the function produces a completely unrelated 64 byte seed, and therefore a completely unrelated and equally valid set of wallets.

There is no wrong passphrase, and that is the danger

Your recovery words have a checksum. Type them wrong and the wallet tells you, because the standard includes a check the software can run.

The passphrase has no checksum. It enters the derivation as a salt, and a salt can be any string at all. There is no validity condition to test, so there is nothing for the wallet to warn you about. Every passphrase produces a valid wallet. The wrong one produces a valid wallet with nothing in it.

One wallet's documentation makes a point worth repeating: nothing is created when you enter a passphrase. Every possible passphrase corresponds to a wallet that was always part of your seed. You are not making a new wallet, you are opening one of an effectively infinite number of them, and you have to be able to find the same door again.

What it protects against, and what it does not

Enter it on the hardware device's own screen rather than on the computer where possible. A passphrase typed into a keyboard is a passphrase a keylogger has.

Plausible deniability, honestly assessed

The standard names this as a feature. Keep a small real balance at the no passphrase wallet as a decoy, hold the rest behind the passphrase, and if you are forced to open your wallet you can open the decoy.

The cryptography works. The behavioral assumption is the weak part, and the people who study coercion attacks are blunt about it. Casa's chief security officer Jameson Lopp, who maintains the standard dataset of physical attacks on crypto holders, has written that "the effectiveness of a decoy wallet is questionable at best. There is no way to know how a criminal will respond." He notes attackers often arrive knowing more about you than you know about them, that handing over funds does not reliably end an attack, and cites a case where the victim gave up a significant amount and was beaten for hours anyway.

How the wallets handle it

Two specific behaviors are worth knowing because they actively hide mistakes. Coldcard shows an eight character fingerprint for the resulting wallet and tells you to write it down, which is the single best defense against silent typos. Sparrow carries your existing address labels across to the new addresses when the passphrase changes, because it has no way of knowing it changed, so a wrong passphrase can look reassuringly familiar.

How people actually lose money with this

The wallet vendors publish these, which tells you how routine they are:

Case. "Correct Horse Battery" and "correct Horse Battery" open different wallets. Spaces. A trailing space is a character. Keyboard layout. Character maps differ between devices, so a symbol typed on one keyboard may not be the symbol you get on another. Unicode. Accented characters can be represented more than one way; one wallet developer raised exactly this as a possible cause in an unresolved case. Memory. A passphrase you only memorized is a passphrase you can lose by having a bad year.

And the one that defeats the whole exercise: storing the passphrase with the seed words. If both are found together it has protected nothing.

If you use one, do it like this

1. Generate it randomly, do not invent it

   People are poor at being unpredictable, and a memorable phrase is weak in a way that is hard to estimate. Roll dice against a word list. Published analysis suggests a minimum of six words from the BIP39 list or four from the EFF long list. This matters more than it sounds, because the key derivation here uses only 2048 iterations, which is cheap for an attacker who already has your seed.

2. Back it up physically, and never beside the seed

   Durable media, at a different location from the recovery words. If both live in the same box you have added a way to lose funds and no security at all.

3. Record the wallet fingerprint next to the backup

   It is not secret and it is the only cheap way to confirm you entered the passphrase correctly without spending anything.

4. Test the full recovery before you fund it

   Wipe the device, restore from words plus passphrase, and confirm you reach the same wallet. Every failure mode above is silent at entry and only shows up in a real recovery. Do this with a trivial amount first.

5. Write down which wallets can restore it

   Your heirs or your future self will need to know the wallet type and derivation, not just the words.

Should a beginner use one at all?

Our answer is no, and it is worth explaining rather than asserting.

The credible security sources lean the same way. Unchained tells clients it does not recommend passphrases, calling them "a single point of failure" and noting they break inheritance entirely, since heirs without the passphrase cannot be helped even by the company. Michael Flaxman, author of a well known security guide, says he does not recommend them "except for expert users".

The reason is asymmetry. A passphrase converts a recoverable risk into an unrecoverable one. If someone finds your seed words, that is bad and you may still be able to move your funds first. If you mistype or forget your passphrase, the money is gone permanently, silently, with no error message and nobody to appeal to.

Learn what it is, because you will meet the option in every hardware wallet setup and you should know what you are declining. Then decline it until you have a specific reason, a tested recovery and a backup plan for the day you are not around to remember it.

Common questions

Where to go next