Seed Phrase

Writing your seed phrase on paper is the minimum baseline.  It's better than a text file on your computer — but only barely.  Paper burns, tears, fades, and can be found by anyone who opens the drawer.

When paper is appropriate:

• Temporary backup while setting up a wallet before engraving metal
• Small holdings where the cost of metal isn't justified
• As a secondary backup alongside a metal primary

How to implement:

1. Use the seed phrase card that comes with your hardware wallet, or high-quality archival paper
2. Write with a ballpoint pen or pencil — not gel pens (ink can smudge) or felt-tip (bleeds through)
3. Write each word clearly and number it (1, 2, 3…). Word order matters — getting it wrong means losing everything
4. Verify every word against the device display by re-reading it back
5. Store in a sealed envelope inside a fireproof bag or document safe
6. A photographed, typed-in, or cloud-stored phrase lives wherever that copy lives — every computer, phone, and cloud service it touches is a machine you do not control

Engraving or stamping your seed phrase into metal protects against fire, water, corrosion, and physical damage.  A house fire can reach 1,100°C (2,000°F) — paper is gone at 233°C (451°F).  Stainless steel melts at ~1,400°C (2,550°F).  Titanium is even higher.  Metal survives what paper cannot.

You don't need to write the full words — just the first four letters of each word.  The BIP-39 word list is designed so that the first four letters uniquely identify every word.  This makes metal stamping faster and reduces error risk.

Metal Backup Products

How to implement (Trezor Keep Metal example):

1. Set up your Trezor device. During setup, Trezor Suite generates your recovery seed or Shamir shares
2. Take the Trezor Keep Metal capsule out of the box. It comes with a pre-marking pen, a holding box, and security seals
3. Write each word's first four letters onto the metal plate using the pre-marking pen (erasable, for positioning)
4. Verify every word against the Trezor device screen
5. Once verified, use a steel punch tool to permanently stamp each letter into the marked positions
6. The capsule sits in the holding box to keep it steady while punching
7. Apply the tamper-evident security seals. If someone opens the capsule later, the seals break — you'll know it was accessed
8. Store the completed capsule in a safe, hidden location (see sections below)

How to implement (DIY budget method):

1. Purchase a 304 or 316 stainless steel plate (~^$5) and a 3mm letter/number stamping set (~^$15) from a hardware store or Amazon
2. Write your words on paper first as a reference template
3. Mark positions on the plate with a marker — number each row 1–24
4. Stamp the first four letters of each word into the metal, one word per row
5. Stamp the word number at the start of each row (critical — order matters)
6. Verify against your paper reference, then destroy the paper
7. Store the plate in a sealed container to prevent corrosion

Shamir's Secret Sharing (SSS) is a cryptographic algorithm created by Adi Shamir.  It splits your seed phrase into multiple shares — where a minimum number of shares (the threshold) is needed to reconstruct the original.  No individual share reveals anything about the secret.

This eliminates the single point of failure.  If one share is lost, stolen, or destroyed, your wallet is still recoverable — as long as you can gather enough shares to meet the threshold.

How it works:

• 2-of-3 — split into 3 shares, any 2 needed. Simple, good for smaller holdings. Lose 1 share? Still recoverable. Thief finds 1 share? Useless.
• 3-of-5 — split into 5 shares, any 3 needed. Good for medium holdings distributed across multiple locations
• 5-of-7 — high security for large holdings. Distributed across multiple people and locations
• You can choose 1 to 16 shares. The threshold cannot be 1 — you always need at least 2

Trezor Shamir Backup (SLIP-39):

Trezor Safe 3, Safe 5, and Safe 7 support Shamir Backup natively.  The default backup on the Safe 3 (since June 2024), Safe 5 and Safe 7 is a 20-word SLIP-39 Single-share Backup; Multi-share (Shamir shares) is one drop-down choice away, and a Single-share Backup can later be upgraded to Multi-share.  The Trezor Model T also supports Shamir Backup.

During device setup, Trezor Suite guides you through creating Shamir shares.  Each share is a sequence of 20 English words (128-bit strength) or 33 words (256-bit strength).  The first two words of each share are the same across all shares — they serve as identifiers so you can recognize shares that belong together.  The third word encodes the group index.

How to implement with a Trezor:

1. Get a Trezor Safe 3, Safe 5, Safe 7, or Model T. Buy only from trezor.io — never from resellers
2. Open Trezor Suite and begin device setup
3. When prompted for backup type, select Multi-share Backup (Shamir) from the Wallet backup type drop-down.  Current devices preselect the 20-word Single-share Backup, so Multi-share has to be chosen
4. Choose your scheme: number of shares (e.g., 3) and threshold (e.g., 2)
5. The device displays each share one at a time — write each one down. The device generates the shares internally; your seed never touches a computer
6. Verify by re-entering each share when prompted
7. Store each share in a different physical location.  Shares kept together are one find away from being the whole seed
8. Optionally stamp each share into metal (Trezor Keep Metal is designed for SLIP-39 20-word shares)
9. The passphrase (Trezor Suite → Settings → Device → Passphrase) works with both backup standards: it opens a hidden wallet the shares alone cannot reach

Full walkthroughs of both standards — SLIP-39 multi-share and 24-word BIP-39 — plus the passphrase setup, the practice restore, and the 33-word command-line expert path live in the backup guide.  Note: Trezor Suite creates 20-word shares; 33-word shares require the command line.

Tools that support Shamir's Secret Sharing:

• Trezor hardware wallets — native SLIP-39 Shamir Backup during device setup. The gold standard
• SeedTool — open-source tool for creating Shamir shares from any seed phrase. Run offline
• Ian Coleman's BIP39 tool — can be downloaded and run offline for advanced seed management

Single Backup vs. Shamir Backup:

A bank safe deposit box provides off-site physical security in a vault.  It protects against fire, flood, and theft at your home.  Most banks and credit unions offer boxes in various sizes at annual rates of ^$50–^$200.

Pros:

• Banks have professional vaults — fire suppression, climate control, physical security
• Dual-key system: the bank keeps one key, you keep the other — both needed to open
• Off-site — a home break-in doesn't compromise this backup
• Contents are private — bank employees cannot legally open your box

Cons:

• Bank hours only — you can't access it at 2am on a Sunday
• If the bank fails, box access may be temporarily frozen during resolution
• Not ideal as your only backup — combine with a home backup
• Some jurisdictions require next-of-kin to access boxes after death — plan your estate

How to implement:

1. Open a safe deposit box at your bank or credit union (small size is fine for a metal plate)
2. Place your stamped metal seed backup (or one Shamir share) in a sealed, tamper-evident envelope
3. Store the envelope in the box
4. Keep the box key separate from your house keys — don't label what it's for
5. Visit once or twice a year to verify it's still there and intact
6. Include instructions for your next of kin — they need to know what it is and how to use it

The core principle: never store all your backup copies in one place.  A single location — your home, a single safe, one bank — is a single point of failure.  Fire, flood, burglary, or a natural disaster at one location should not mean total loss.

This strategy pairs naturally with Shamir's Secret Sharing (each share goes to a different location) but also works with duplicate metal backups.

Example: 3-location setup with Shamir 2-of-3

• Share 1 — Home safe (fireproof, bolted to floor)
• Share 2 — Bank safe deposit box
• Share 3 — Trusted family member or attorney's office

Any 2 of these 3 shares reconstruct your wallet.  If your house burns down (lose Share 1), you still have Shares 2 and 3.  If a thief finds Share 3, it's useless without at least one more.

Example: Duplicate metal backups (no Shamir)

• Copy A — Home safe
• Copy B — Bank safe deposit box or trusted family member

Each copy is a full seed, so one found copy opens the wallet on its own unless a passphrase is set; with a passphrase set, the passphrase is what still guards the funds.  The trade: simpler than shares, and a BIP-39 seed restores on nearly any wallet.

How to implement:

1. Identify 2–3 geographically separate locations. "Separate" means a fire at one can't reach the other
2. Choose trusted people if using family/friends — give them only a share, never the full seed
3. Stamp each share into metal. Paper in multiple locations is still paper — it burns everywhere
4. Document what each share is, without revealing its contents. A label like "Recovery Share 2 of 3" is fine
5. Create a recovery instruction sheet — stored separately — so your heirs know what to do
6. Review annually: verify each location is still accessible and shares are intact

Even with metal backups and Shamir shares, where you hide the backup matters.  A burglar who finds your safe will take what's inside.  Concealment adds another layer — they can't steal what they can't find.

Concealment methods:

• Wall safe — installed behind a picture or mirror. Invisible to casual inspection. Cost: ^$50–^$300
• Floor safe — embedded in concrete floor under a rug or furniture. Very hard to find or remove. Cost: ^$100–^$500
• Hollow book — a real book with a cutout. Hide on a shelf among hundreds of books. Cost: ^$5–^$15
• False container — fake food cans, cleaning product bottles, or electrical outlets with hidden compartments. Cost: ^$10–^$30
• Inside furniture — taped under drawers, inside hollow chair legs, behind baseboards
• Buried — in a waterproof container in your yard. Use a PVC pipe with end caps. Cost: ^$5–^$10

Decoy strategy:

A decoy is a fake or low-value backup placed where an attacker would look first — a visible safe, a drawer, a USB drive.  The idea: if someone breaks in and finds something that looks like your seed phrase, they take it and leave.  Your real backup stays hidden elsewhere.

• Put a paper with random 24 words (not your real seed) in a visible safe
• Label it "Bitcoin Recovery Seed" — make it obvious so the thief takes the bait and runs
• Store your real metal backup in a concealed location the burglar won't find

How to implement:

1. Choose a concealment method that fits your home and lifestyle
2. Store your real metal backup or Shamir share in the concealed location
3. Create a decoy: generate random BIP-39 words (use an offline tool), write on paper, place in a visible safe or drawer
4. Tell only trusted family members where the real backup is — not where the decoy is
5. Document the real location in your estate planning documents (stored with your attorney)

Memorizing your seed phrase means it exists only in your head — no physical object to steal, burn, or lose.  This sounds appealing, but it is extremely risky as a sole strategy and should only be used as a supplement to physical backups.

The risks:

• Head injury or illness — amnesia, stroke, or cognitive decline can erase the memory permanently
• Death — if you die, the seed phrase dies with you. Your heirs lose everything
• Stress and time — under duress, people forget things they "knew." Months later, doubt creeps in: "Was it 'actual' or 'actuar'?"
• No redundancy — if you forget one word, the entire seed is unrecoverable

If you choose to memorize:

1. Memorize in chunks: 4 words at a time, creating a rhythm or story. 6 chunks of 4 = 24 words
2. Recite it weekly at first, then monthly, to maintain retention
3. Test yourself by writing it down and verifying against your metal backup
4. A memory with no physical backup is a single point of failure — memorization is a supplement, not a replacement
5. A passphrase (the "25th word") is shorter than a seed phrase; forgotten, it takes its hidden wallet with it — the seed phrase alone opens only the standard wallet

For most users with meaningful crypto holdings, the recommended combination is:

Quantum computers powerful enough to break current elliptic curve cryptography are not available today; experts generally estimate they could appear sometime between the late 2020s and mid-2030s.  The realistic quantum risk is Shor's algorithm deriving private keys from public keys revealed when you spend — a risk no backup format changes.

What this means for you today:

• Pick your backup for theft and fire, not quantum — twelve words, 24 words, Shamir shares, metal plates: those are theft-and-fire decisions, not quantum ones.
• Hold long-term on receive-only addresses — an address that has never signed has never shown its public key, and there is nothing on-chain for Shor to attack.
• When a vault must spend, sweep it whole — move the entire balance to a fresh address in one transaction.

The full reasoning is in Security, section 8; the deep dive on quantum threats to seed phrases and ECDSA has the realistic Shor's-algorithm timelines.