Passphrase

The passphrase is mixed into the words before any key exists, so changing a single character yields an entirely new and empty wallet. Nothing rejects a wrong entry, because every possible string is valid input. That property is the whole feature and also the most common way people lose money with it.

How it works

BIP-39 defines the passphrase as an optional extension of the salt used when converting words into a seed. The salt is the literal text "mnemonic" with your passphrase appended, and the pair goes through 2,048 rounds of PBKDF2 with HMAC-SHA512. Change the passphrase and every one of the 512 output bits changes, which changes the master key, which changes every address the wallet will ever show.

Three consequences follow, and all three surprise people.

There is no wrong answer. Type your passphrase with a capital letter you did not use last time and the wallet opens successfully, shows a zero balance, and hands you fresh receiving addresses. Nothing is broken and nothing warns you. Sending coins to that wallet is how the mistake becomes permanent.

Every character counts exactly as typed. Case, spaces, punctuation, and accented characters are all part of the secret, including a trailing space you cannot see. Wallets normalize the text to Unicode NFKD before hashing, which handles most accent encoding differences, but nothing rescues a phrase you remember only approximately.

The stretching is weak. Two thousand and forty-eight PBKDF2 iterations were cheap in 2013 and are close to free now. An attacker who already holds your written words can test dictionary passphrases at enormous speed, so "bitcoin2020" or a pet's name adds hours of protection rather than years. A passphrase should be long and unguessable, or it is theatre.

The nicknames mislead as well. Calling it the "25th word" suggests it comes from the BIP-39 wordlist and is covered by the checksum. It is neither: it is arbitrary text, unchecked, unlisted, and unrecoverable.

Why this matters when you buy bitcoin

The passphrase exists for one specific threat: somebody physically holding your device or your written words. Everything else in your setup already covers remote attackers.

That threat is not hypothetical for older hardware. Both Trezor devices reviewed on this site, the Model One and the Model T, lack a secure element, and their vendor states plainly that an attacker with the device in a lab can extract the stored seed. A passphrase is the documented mitigation, because the extracted secret alone opens the wrong wallet. The same reasoning applies to a written backup found during a burglary or read by a visitor.

The cost is that recovery now needs two independent secrets, and the second one usually exists only in your head. That is where most passphrase losses come from: not theft, but a person who died, forgot, or moved house. If you use one, write it down and store it in a different place from the words, so that no single location holds both and no single accident destroys both. Trezor caps entry at 50 characters, so plan a length that fits.

Use one when your holdings would meaningfully change your life and your realistic threat is a person, not a hacker. Skip it when you are still learning, when your balance is small, or when you have no plan for what happens to it if you are unavailable.

The duress wallet that actually works

The hidden-wallet feature only helps if the visible wallet is believable, and most people get this backwards.

Set up your device with no passphrase and put a real, spendable amount in it. A few hundred dollars of bitcoin that moves occasionally looks like someone's wallet. An empty standard wallet looks like exactly what it is: proof that a passphrase exists somewhere.

Keep savings in the passphrase wallet and let it stay quiet. On a Trezor, entering the passphrase opens a hidden wallet as a separate session, and leaving it blank returns to the decoy without any indication that another exists.

Be honest about the limit. This protects you from someone who finds or steals the device and looks for what is on it. It protects you far less from someone who knows the feature exists, and in several jurisdictions actively lying to authorities about assets is a separate offence from anything to do with bitcoin. Silence is a defensible position. A false statement is not.

Passphrase vs two-factor authentication

A passphrase is a second secret, not a second factor in the sense that banks use the term. Two-factor authentication is a check performed by a server that can reject you, rate limit attempts, lock the account, and let a support team restore access. A passphrase is checked by nobody, cannot be reset, allows infinite offline guesses by anyone holding your words, and silently opens a different wallet when it is wrong. The comparison flatters it in exactly the wrong direction.

Passphrase vs Shamir backup

A passphrase adds a secret; a Shamir backup divides one. They answer different questions. The passphrase asks how to make a found backup useless, and it does that by requiring something the finder does not have. Shamir asks how to survive losing a backup, and it does that by turning one sheet into several of which only some are needed. Combining them is possible and multiplies the ways a recovery can fail, so choose the problem you actually have.