The Bitcoin Passphrase (25th Word) Explained

A Bitcoin passphrase is a password you choose yourself and add to your seed phrase, often called the "25th word". Seed phrase and passphrase together open a separate, invisible wallet. Anyone who finds only your words sees an empty or small wallet. The price: if you forget the passphrase, your bitcoin are lost, even with the seed.

The problem: whoever finds your words has your bitcoin

A seed phrase of 12 or 24 words is full access to your wallet. Device, PIN and manufacturer don't matter. Anyone who copies the words can send your bitcoin away from any device in the world.

That is why you hide it well. But hiding places get found: by a burglar, a tradesperson, a curious visitor, someone putting pressure on you. A single find is enough.

The passphrase solves exactly this problem. It is a second, independent half of the key that you keep in a different place. How seed phrase, hardware wallet and backups fit together overall is explained in the complete custody guide. This article is only about this second layer.

What the Bitcoin passphrase does technically

Your wallet calculates a secret starting value from the words, and all keys and addresses follow from it. The passphrase goes into this calculation. Change a single character and you get a completely different starting value, and so a completely different wallet.

Without a passphrase, the wallet calculates with an empty passphrase. That is the wallet you see when you enter only the seed. With a passphrase, a second wallet appears that cannot be recognised as such from the outside. Nobody can check whether it exists.

Why "25th word" is not quite right

The name comes from the passphrase being added to the 24 words. But it is misleading:

• The passphrase does not have to be a word from the list of 2’048 seed words. It can be a sentence, a number or any string of characters.
• It is not part of the seed phrase. Your wallet doesn't generate it; you choose it yourself.
• It is case-sensitive, and every space counts. "Moon garden" and "moon garden" are two different wallets.

Manufacturers call it different things: passphrase, hidden wallet, in Electrum "seed extension". It always means the same thing.

Passphrase, PIN and password: the difference

Three things are often confused. Only one of them protects your bitcoin if the seed is found.

The PIN stops someone from using your stolen device. The passphrase stops someone from doing anything with your words. You need both, for different dangers.

When a passphrase is worth it and when it isn't

A passphrase trades one risk for another. It makes a found seed worthless. In return, there are now two things you must not lose.

It is worth it if

• your holdings are large enough that a found seed would really hurt you,
• you have to keep the seed in a place other people can enter, such as at home or in a bank safe deposit box,
• you want protection against extortion at home,
• you can keep up the care for a second backup over years.

Leave it out if

• you are just setting up your first wallet. Basics first, extras later. The guide Setting up a Bitcoin wallet shows how.
• you are not sure your family would find both in an emergency.
• you already use a multisig wallet. There the distribution of keys protects you; a passphrase per key only makes the setup harder.

The decoy wallet: protection under pressure

Because the seed alone opens a wallet of its own, you can use it on purpose. You put a small, believable amount there. Your real savings sit in the passphrase wallet.

If someone forces you to hand over your device, PIN or words, they see only the small wallet. Nobody can prove that a second one exists.

To be honest: the decoy wallet is not perfect protection. If an attacker knows from a data leak how much you bought on an exchange, they may not believe the small wallet. It works best combined with discretion. How to keep your home, mail and data inconspicuous is shown in the article Discretion and physical security.

You can work out what your own holdings would be worth today and at the floor here:

Choosing a strong passphrase

If someone finds your seed, the passphrase is the only lock. They will then try passphrases one after another, at their leisure and without a lockout after three failed attempts. What they try first: names, birthdays, pets, song lyrics, quotes, known passwords from data leaks.

The simplest strong passphrase consists of random words that you draw from a word list with dice (Diceware). Four words are the minimum, five to six are good.

The billion attempts per second is a deliberately generous assumption for a huge computing farm, not a measurement. It shows the ratio: every additional random word makes the search about 7’776 times longer.

Three practical rules for entering it:

• Only lowercase letters and spaces. On many hardware wallets you type character by character on a small screen. Capital letters and special characters make that tedious and error-prone.
• No umlauts and no ß. Not every device has them, and different programs can encode them differently. Write "ae", "oe", "ue", "ss".
• No spaces at the beginning or end. They count and are invisible on paper.

Setting up a passphrase in six steps

This is how you set up the passphrase wallet and test it before real money sits in it:

1. Seed backup is in place. The seed phrase is complete, numbered and ideally already backed up on metal. The article Storing your seed phrase safely shows how.
2. Roll the passphrase with dice and write it down. Offline, alone, with no camera in the room. Exactly as you will type it, with lowercase and spaces clearly visible.
3. Enable the passphrase on the device and enter it. Depending on the manufacturer, the option is called "passphrase" or "hidden wallet". Read it on the device again, character by character.
4. Note the fingerprint. Many devices and programs such as Sparrow show the master fingerprint, eight characters like "7c3a91e4". It is different for every passphrase and reveals nothing about your keys. Note it next to the passphrase.
5. Test the recovery. Send a small amount to the passphrase wallet. Then enter the passphrase again, ideally after a reset with the seed. If fingerprint and amount match, the backup is correct.
6. Only then transfer the rest. And fill the decoy wallet with a small amount, if you want one.

Backing up the passphrase: never next to the seed

The passphrase only protects you if seed and passphrase are never found together. If they sit in the same envelope, all you have is a longer backup.

The passphrase doesn't need to go on metal. It is short enough to keep on paper in several places where, on its own, it gives nothing away. Don't write anything next to it that identifies it as a bitcoin password.

Passphrase and inheritance

When you are gone, the passphrase in your head is gone too. Your heirs need three things: the seed phrase, the passphrase and instructions saying that both exist. Without that note, they see only the decoy wallet and take it for everything.

So put in your emergency letter where seed and passphrase are kept, not the words themselves. How to keep will, emergency letter and keys cleanly separate is shown in the article Inheriting bitcoin.

Passphrase or multisig?

Both spread the risk across several places, but differently. With a passphrase you have to keep both parts. With a "2 of 3" multisig you can lose one of the three keys.

For many holders, the passphrase is the inexpensive intermediate step between a simple hardware wallet and multisig. When switching is worth it is explained in the article Multisig wallet: more security with several keys. Which devices support a passphrase well is shown in the hardware wallet comparison. You practise seed, passphrase and backups step by step in the Academy, stage 2: Understand and secure.