What is a seed phrase?

Picture losing your phone on a trip. Back home, you install a wallet app on a new phone, choose restore, and type 12 words from a sheet of paper. A minute later your addresses and balances are back.

Those 12 words are the seed phrase, also called a recovery phrase or mnemonic. They are the master backup of a self-held crypto wallet, and whoever holds them holds the coins.

What the words really are

Underneath, a wallet's secret is a very large random number. A number that long is easy to mistype, so the wallet shows it as words taken from a fixed list of 2,048 entries.

Many wallets follow an open standard for this, known as BIP39. Each word stands for an 11-bit slice of the number (a bit is a binary digit, 0 or 1), because 2,048 is 2 multiplied by itself 11 times.

Twelve words carry 132 bits: 128 bits of the random number plus a 4-bit checksum at the end, a small check value that lets the wallet catch most typing mistakes. Twenty-four words carry 256 bits plus an 8-bit checksum.

A few rules follow from this:

• Spelling matters. Each word must match the list exactly.
• Order matters. The same 12 words in a different order make a different wallet, or no valid wallet at all.
• Every word comes from the list. A phrase with a word that is not on it was not made by a standard wallet.
• Most wallets use 12 or 24 words. The standard also allows 15, 18 and 21.

How 12 words rebuild every key

The wallet runs the phrase through a fixed calculation that always gives the same result, a master key. From the master key it derives private key number 1, number 2, number 3 and so on, each with its own address.

Because the steps never change, any wallet using the same standard gets the same keys from the same words. That is why you can restore on a different app or device and see the same addresses.

Wallets can follow slightly different routes from the master key to the addresses, called derivation paths. If a restore shows a zero balance, check the words first.

If the words are right, the wallet may be looking on a different route or network. Checking those settings usually brings the balance back.

Why nobody can guess your phrase

Count the possibilities one word at a time. The first three counts are exact.

1. One word from a list of 2,048 gives 2,048 options.
2. Two words give 2,048 × 2,048 = 4,194,304 options.
3. Three words give 4,194,304 × 2,048 = 8,589,934,592 options, about 8.6 billion.
4. Twelve words give 2,048 multiplied by itself 12 times, a number 40 digits long. The checksum rules out 15 of every 16 of those, which leaves about 340 trillion trillion trillion valid phrases, a number 39 digits long.

Now an illustration with an imaginary machine. Suppose it could test one trillion phrases every second. Working through all of them would take about ten billion billion years.

So words that a wallet picked at random are safe from guessing. The weak point is the person and the places where the phrase is kept.

How seed phrases get stolen

Thieves almost never guess a seed phrase. They get you to reveal it, or they find a copy. Common routes include:

• a photo or screenshot that syncs to a cloud account
• a notes app, email draft or document on a computer that later catches malware
• a fake support agent in a chat who asks for your words to fix or verify the wallet
• a website or app that asks you to type the phrase to claim a reward or sync your wallet
• a hardware wallet bought second-hand or from an unofficial seller, with words already printed on a card

A wallet you already use never needs your seed phrase again. You type it only when you restore a wallet yourself, on a device you trust.

The lesson on common crypto scams shows how these tricks are dressed up.

How to store a seed phrase safely

Write the words by hand, in order, and check each one against the screen. Keep the paper offline, away from cameras and cloud backups.

Some people stamp the words on a metal plate, which survives fire and water better than paper.

Two copies in two safe places mean one fire or flood cannot take both. Tell someone you trust how to find them if something happens to you, without showing them the words.

Before you move real money in, test the backup. Send a small amount to the wallet, reset it, restore it from your written words, and confirm the small amount is still there.

Some wallets let you add an optional passphrase, an extra word or sentence of your choosing. The same 12 words with a different passphrase open a different wallet.

A passphrase protects you if someone finds the paper. If you forget it, though, the words alone will not bring the coins back.

One habit looks clever and backfires: splitting the 12 words into two halves stored apart. Losing either half locks you out.

Whoever finds one half has only 6 words left to guess. The imaginary machine from earlier would try every option for those 6 in under three years, against ten billion billion years for all 12.