How does a Bitcoin seed phrase actually work?

BIP-39 takes 128 to 256 bits of entropy, appends a checksum, splits the result into 11-bit groups and uses each group as an index into a 2048-word list, producing 12 to 24 words. Those words are then stretched with PBKDF2 using HMAC-SHA512 over 2048 iterations, salted with the string mnemonic plus any passphrase, to produce a 512-bit seed. That seed is the master key from which every address is derived.

Should I use a BIP-39 passphrase?

Only if you understand the failure mode. A passphrase creates a separate hidden wallet on top of the same words, which defends against someone who finds your backup. But BIP-39 states that every passphrase produces a valid wallet, so a typo does not raise an error. It silently opens a real, empty wallet instead. Back the passphrase up as carefully as the words, in a different place, or do not use one.

Is a steel seed backup worth it compared to paper?

Yes for any meaningful amount. Jameson Lopp's stress tests note that US house fires reach around 1300F or 704C, and his conclusion is that stainless steel is the best readily available metal. Aluminium melts at 660C, below that peak, so it is a poor choice. Paper survives neither fire nor flood, and inkjet ink runs when the fire brigade puts water on the building.

PillarSecurity & Self-Custody

Bitcoin Cold Storage: Every Method Compared

Q: What actually counts as cold storage?

Cold storage means the private key never exists in usable form on an internet-connected computer. A hardware wallet qualifies because signing happens inside the device and the key is never exported. A desktop wallet does not, because the key is decrypted into the RAM of a machine that also browses the web. The dividing line is where the signature is produced, not where the file is stored.

Q: Is multisig worth the complexity?

It depends on the amount. A 2-of-3 removes the single point of failure that makes single-seed storage hard: one backup that must be simultaneously impossible to steal and impossible to lose. With three keys in three locations, one stolen key spends nothing and one destroyed key costs nothing. The new obligation is backing up the wallet descriptor, without which all three keys are useless.

Q: What is SLIP-39 and how is it different from splitting a seed phrase?

SLIP-39 uses Shamir secret sharing to split a master secret into shares, of which a threshold number reconstructs it, with a two-level group and member structure. Shares are 20 words for 128-bit security or 33 for 256-bit, drawn from a 1024-word list. It is not compatible with BIP-39. Cutting a BIP-39 phrase into pieces yourself is not the same thing and weakens the remaining words.

Published July 29, 2026~12 min read

Cold storage means one thing: the private key never exists in usable form on a machine that touches the internet. A hardware wallet clears that bar because the signature is produced inside the device. A desktop wallet does not, because the key is decrypted into the memory of a computer that also reads email. Everything else in this guide is detail on top of that single test.

The detail matters, though, because almost nobody loses coins to a broken cryptosystem. They lose them to a backup that burned, a passphrase they mistyped, a device bought from a marketplace instead of the manufacturer, or a plan that only ever existed in one person's head.

Diagram of six storage methods arranged by key exposure: exchange account with no key, phone wallet, desktop wallet, then across a dividing line marked cold, a hardware wallet, an air-gapped signer, and a 2-of-3 multisig split across locations. — The line marked cold is the only definition that matters. Everything to its left involves a key that has been readable by an online operating system at some point.Original diagram by BTCLinks.

What actually counts as cold storage?

The marketing has muddied this, so here is the test. Ask where the signature is produced. If the answer is "on a device whose only job is producing signatures, which has no general-purpose OS and no way to export the key," that is cold. If the answer is "in an app, on a computer, that also has a browser," it is not, no matter what the app is called.

By that test, a hardware wallet plugged into an infected laptop is still cold storage. The laptop can lie about what it is sending, and it can refuse to relay the result, but it cannot extract the key. This is why the device's own screen exists and why ignoring it defeats the entire purchase.

An air-gapped signer goes one step further and removes the data cable. Unsigned transactions arrive by microSD card or QR code, signed ones leave the same way, and the USB attack surface goes to zero. Whether that step is worth the friction depends entirely on how much you are protecting, and honest answer: for most people it is not.

Cold storage methods compared by cost, main risk and who each suits
Method	Rough cost	Protects against	Fails when
Paper seed, no device	free	online theft	fire, flood, a curious visitor, your own handwriting
Hardware wallet	$70 to $200	malware, key extraction, clipboard swaps	you ignore the device screen, or bought it secondhand
Hardware wallet plus steel backup	$120 to $300	the above, plus house fires	one location holds everything and someone finds it
Air-gapped signer	$150 to $250	the above, plus USB-borne attacks	the friction makes you stop using it properly
2-of-3 multisig	$250 to $600	single-point theft and single-point loss	you lose the wallet descriptor, or nobody else understands it
Collaborative custody	subscription	the above, with a co-signer who can help you recover	the provider disappears and you never tested recovery

Costs are indicative device prices, not quotes. The "fails when" column is the one to read: every method on this list has been defeated in practice, and never by breaking the cryptography.Table by BTCLinks.

How does a seed phrase actually work?

Understanding this properly changes how you treat the backup, so it is worth two minutes.

BIP-39 starts with raw entropy, between 128 and 256 bits of it. It appends a checksum derived from the SHA-256 hash of that entropy, chops the result into 11-bit groups, and uses each group as an index into a fixed list of 2048 words. Twelve words carry 128 bits of entropy; twenty-four carry 256. The checksum is why a phrase with one wrong word usually fails to load rather than quietly opening a different wallet.

Then comes the part people skip. The words are not the key. They are fed into PBKDF2 with HMAC-SHA512, 2048 iterations, salted with the literal string "mnemonic" plus your passphrase if you set one, and the output is a 512-bit seed. That seed becomes the BIP-32 master key, and every address you will ever use hangs beneath it.

Pipeline diagram: entropy of 128 to 256 bits gains a checksum and becomes 12 to 24 words, which are stretched by PBKDF2 with HMAC-SHA512 over 2048 iterations, salted with the string mnemonic plus an optional passphrase, producing a 512-bit seed and the BIP-32 master key. — Four steps, and the optional passphrase enters at step three as part of the salt. This is why the passphrase is not a password on a file: it changes which wallet exists.Original diagram by BTCLinks, from the BIP-39 specification.

Should you use a passphrase?

A BIP-39 passphrase, sometimes marketed as a 25th word, creates a completely separate wallet from the same twelve or twenty-four words. Someone who finds your steel plate gets the wallet with no passphrase, which you can deliberately leave holding a small, plausible amount. The real balance sits behind the passphrase and is invisible.

That is genuinely useful. Now the warning, which is written into the specification itself: every passphrase produces a valid wallet, and only the correct one opens the wallet you want. There is no error message. Mistype one character and your wallet loads perfectly, shows a zero balance, and gives you no way to distinguish "wrong passphrase" from "the coins were never here."

So the rule is simple. If you use a passphrase, back it up with the same seriousness as the words, store it somewhere the words are not, and test the whole recovery with a trivial amount before you fund it properly. A passphrase you are 90 percent sure of is not a security feature. It is a countdown.

How should you physically back up the words?

Paper is fine for an amount you would shrug at losing. For anything else it is a bad bet, and the reason is not exotic. Jameson Lopp has been running metal seed storage stress tests for years, and his framing of the heat problem is the useful number: US house fires reach roughly 1300F, about 704C. His overall conclusion after all that testing is blunt, that stainless steel is the best readily available metal.

Hold that 704C against the materials. Aluminium melts at 660.3C according to the Royal Society of Chemistry, which is below the peak of an ordinary house fire. A stamped aluminium plate is therefore a device that works right up until the day you need it. Stainless steel and titanium both stay solid well past that point.

Lopp's testing also submerges devices in water after heating, on the reasoning that a fire is usually followed by a fire brigade, and separately checks corrosion and crush resistance. Devices are graded from A for no data loss down to F for catastrophic loss. He notes that one black coating failed under flame in under thirty seconds, which is worth knowing if you are choosing a plate on looks.

Seed phrase backup media compared against fire, water, crush and discovery
Medium	House fire (about 704C)	Flood	Found by a person
Paper, pen	gone	gone or illegible	readable instantly
Paper, inkjet	gone	ink runs	readable instantly
Laminated paper	gone, plus melted plastic	survives	readable instantly
Aluminium plate	melts at 660.3C	survives	readable instantly
Stainless steel, stamped	survives	survives	readable instantly
Stainless steel, plus passphrase held elsewhere	survives	survives	useless without the passphrase

Notice that only the last row changes the third column. Every physical backup is readable by whoever holds it, which is the problem a passphrase or a multisig quorum exists to solve.Fire temperature per Jameson Lopp's stress-test series; aluminium melting point per the Royal Society of Chemistry. Verified 2026-07-29.

Practical notes. Stamping into solid metal beats assembling letter tiles, because tiles can be shaken loose by the same crush that a stamped plate shrugs off. Only the first four letters of each BIP-39 word are needed to identify it, which halves your stamping and is a genuine time saver on twenty-four words. And keep at least one copy somewhere that is not your house, because house fires and burglaries are both location-scoped events.

Steel plates and blank stamping kits are ordinary hardware and buying them from a marketplace is fine: stainless steel seed backup plates on Amazon. Hardware wallets are the opposite case and should never be bought that way. Buy direct from Coinkite, Trezor, Foundation Devices or BitBox. A device that arrives already initialised, or with a seed phrase helpfully printed on a card, belongs to whoever printed it. Our hardware wallet comparison goes through the current models.

Is multisig worth the complexity?

Single-seed storage asks one backup to be two contradictory things at once: impossible for anyone else to find, and impossible for you to lose. Nothing is both. Every hiding place clever enough to defeat a burglar is clever enough to defeat your executor, and every backup convenient enough to be safe from your own forgetfulness is convenient enough to be found.

Multisig dissolves that contradiction by splitting the requirement across keys. In a 2-of-3, any two of the three signatures move the coins. One key stolen achieves nothing, because the thief needs a second from a different building. One key destroyed costs nothing, because the other two still sign and you can rebuild the third afterwards.

Diagram of a 2-of-3 multisig with key A at home, key B in another city and key C at an institution, showing that any two signatures spend, and three outcome panels covering one key stolen, one key lost, and two locations breached. — Three keys, three buildings, two signatures to spend. The failure case that remains requires coordinated access to two separate locations.Original diagram by BTCLinks.

The cost is a new obligation that catches people out. A multisig wallet needs its descriptor, the record of which public keys and which quorum, to reconstruct itself. Lose that and all three keys are so much stamped metal. Back the descriptor up alongside every key, in plain text, and treat it as part of the wallet rather than as configuration.

The threshold where this becomes worth it is personal, but a reasonable rule: when the amount is large enough that you have started losing sleep about the single seed, you have outgrown the single seed. Before that point, multisig mostly adds ways to make mistakes.

What about Shamir shares and SLIP-39?

Two things get confused here and only one of them is safe.

The unsafe one is cutting a BIP-39 phrase into pieces yourself. Splitting twenty-four words into three groups of eight does not create three keys that each reveal nothing. It creates three groups that each reveal a third of your entropy and hand an attacker a dramatically smaller search space. Do not do this.

The safe one is SLIP-39, which applies Shamir secret sharing properly. The master secret is split so that a threshold number of shares reconstructs it and anything below that threshold reveals nothing at all. It supports a two-level structure, so you can express arrangements like "two of my own shares, plus three of five friends" in the scheme itself. Shares are 20 words for 128-bit security or 33 for 256-bit, drawn from a 1024-word list where no word is shorter than four letters or longer than eight and every word has a unique four-letter prefix.

The catch is compatibility. SLIP-39 and BIP-39 are not interchangeable, and support is narrower than BIP-39's near-universal coverage. Converting an existing BIP-39 mnemonic across produces 59-word shares, and the conversion cannot be reversed. Pick one scheme when you set the wallet up, not later.

Where do people actually lose coins?

Not to cryptography. The recurring list, in rough order of how often it shows up:

The backup that was never tested. Write the words down, fund the wallet, never wipe the device and restore from those words. The first time you discover the backup is wrong should not be the day you need it.
A passphrase remembered slightly wrong. Covered above, and it is the quietest failure on this list because nothing ever reports an error.
One location holding everything. Device, backup and passphrase note in the same drawer. A single fire, flood or burglary takes all three.
A plan only one person understands. If you are hit by a bus, does anyone know a wallet exists, where the keys are, and what to do? A sealed letter with instructions is not a security hole if the keys themselves are protected.
Hardware from the wrong seller. Tampered and pre-initialised devices are a real, documented supply-chain attack. The manufacturer's own shop costs the same.
Trusting the computer's screen. The address shown in your browser is whatever the malware wants it to be. Verify on the device, every time. The scams that exploit this are catalogued in our guide to common Bitcoin scams.

What we would actually set up

No single answer fits every balance, so here is the honest version by amount. These are thresholds for thinking, not advice about your finances.

Suggested cold storage setup by amount held
Roughly how much	Setup	The thing people get wrong here
Pocket money	Reputable phone wallet, words on paper	Overbuilding. A steel plate for $40 of bitcoin is theatre.
Meaningful but not life-changing	Hardware wallet bought direct, words stamped in steel, one copy off-site	Never testing the restore, and keeping both copies in one building.
Life-changing	The above, plus a passphrase stored separately, or a 2-of-3 multisig	Adopting a passphrase without a tested backup of the passphrase itself.
Enough that people might know	2-of-3 multisig across locations, descriptor backed up with every key, written instructions for heirs	Assuming the descriptor is optional. It is not.

The column on the right is where the actual losses come from. Every row's failure is procedural, and every one of them is cheap to prevent and impossible to fix afterwards.Table by BTCLinks.

One habit outranks every product decision on this page. Wipe the device and restore from your backup, before you fund it, and again whenever you change anything. It takes twenty minutes and it converts a hopeful assumption into a fact. If you want to reason more broadly about which threats are worth defending against at all, our threat model guide is the companion to this one, and how to buy your first bitcoin covers getting the coins off an exchange in the first place.

Sources

BIP-39: Mnemonic code for generating deterministic keys. Source of the entropy and word-count table, the PBKDF2 with HMAC-SHA512 at 2048 iterations, the "mnemonic" salt, and the specification's own statement that every passphrase generates a valid seed. Verified 2026-07-29.
SLIP-0039: Shamir's Secret-Sharing for Mnemonic Codes. Source of the group and member threshold structure, the 20 and 33 word share lengths, the 1024-word list rules, and the incompatibility with BIP-39. Verified 2026-07-29.
Jameson Lopp: Why stress test metal seed storage devices. Source of the 1300F / 704C house fire figure and the conclusion that stainless steel is the best readily available metal. Verified 2026-07-29.
Jameson Lopp: Metal Bitcoin Seed Storage Stress Test, Round IV. Source of the test methodology, the A to F grading and the coating that failed under flame in under thirty seconds. Verified 2026-07-29.
Royal Society of Chemistry: Aluminium. Melting point of 660.323C, which is below the house fire peak above. Verified 2026-07-29.
BIP-32: Hierarchical Deterministic Wallets. The master key derivation that the 512-bit seed feeds. Verified 2026-07-29.

Some links are affiliate links. As an Amazon Associate we earn from qualifying purchases. We do not link hardware wallets on marketplaces; buy those direct from the manufacturer. Not financial advice.