A BIP39 passphrase — often called the 25th word — is an optional extra secret that you add to your seed phrase. The same 12 or 24 words with a different passphrase produce a completely different wallet with different addresses. Someone who finds your written seed phrase but not the passphrase sees only the wallet without it, which you can leave empty or nearly empty. The price is responsibility: there is no “wrong passphrase” error, so a forgotten or mistyped passphrase means funds you cannot reach.
How the passphrase changes the wallet
BIP39 turns the words into a 512-bit seed with PBKDF2-HMAC-SHA512: the mnemonic is the password, the string “mnemonic” plus your passphrase is the salt, and the function runs 2,048 iterations. All keys and addresses are derived from that seed. Change one character of the passphrase and the seed is entirely different.
seed = PBKDF2-HMAC-SHA512(password = mnemonic words,
salt = "mnemonic" + passphrase,
iterations = 2048) -> 64 bytesBecause every passphrase is valid, the wallet cannot tell you that you typed it wrong. It simply opens another wallet, empty, with zero history. Case matters (“Summer” ≠ “summer”), and so do spaces and the character set; most wallets normalise Unicode with NFKD as BIP39 requires, but stick to plain ASCII letters and digits to avoid surprises across wallets.
What a passphrase protects against
- Someone finding the written words. A burglar, a curious relative or a person who photographs the backup gets nothing without the passphrase.
- A compromised backup service or storage place, for example a bank deposit box you do not fully trust.
- Coercion, to a degree: the wallet without passphrase (or with a decoy passphrase) can hold a small amount, while the main funds sit behind another passphrase.
It does not protect against malware on the device where you type the passphrase, against a fake wallet app, or against you signing a malicious transaction. It is a protection of the backup, not of the device.
Where wallets support it
| Wallet | Feature name | Notes |
|---|---|---|
| Trezor | Passphrase / hidden wallet | Entered on device or host each session; not stored |
| Ledger | Passphrase (temporary or attached to a second PIN) | Attached mode stores it on the device behind a second PIN |
| Electrum | “Extend this seed with custom words” | Electrum’s own seed format; BIP39 import also supports a passphrase |
| Sparrow | Passphrase on BIP39 import/creation | Shows the master fingerprint so you can check |
| Many mobile wallets | Often not supported | Check before relying on it |
Back it up correctly
- Choose a passphrase you can write down unambiguously: words or random characters without look-alikes (0/O, l/1).
- Write it down on paper or metal and store it separately from the seed phrase. If both sit in one envelope, the passphrase adds nothing.
- Note the wallet’s master fingerprint (Sparrow, Trezor Suite and others show it) or the first receive address. When you restore, matching it proves the passphrase is right before you send money.
- Test the full restore once with a small amount: wipe, restore with words plus passphrase, see the funds.
- Make sure your heirs know that a passphrase exists — the inheritance checklist has a line for it.
Passphrase, Shamir or multisig?
A passphrase is the simplest upgrade: no new devices, nothing extra on-chain. Its weakness is that it is still one secret you must remember or store. Shamir backup (SLIP-39) splits a backup into shares so that, for example, any 2 of 3 restore it. A multisig wallet goes further by needing several keys to sign, not just to restore. For a few thousand dollars a passphrase is often enough; for larger sums or family setups, compare with the multisig planner.
A worked example with a decoy wallet
Say you hold 0.8 BTC. You create a hardware wallet, write the 24 words on a steel plate and keep it at home. In the wallet without passphrase you keep 0.01 BTC and use it now and then, so it has a believable history. The main 0.79 BTC sits in the wallet opened by a passphrase of five random words, written on a card stored in a different building. A burglar who finds the plate restores a wallet with 0.01 BTC and a normal history. To lose the main funds, someone needs both the plate and the card — or you need to lose both, which is why each has its own place and why your heir must know where both are.
Common mistakes
- Using a short dictionary word: the point is to resist someone who has the seed and tries common passphrases.
- Relying on memory alone and losing it years later.
- Typing it into a phone or computer note to “remember” it — see where not to store a seed phrase.
- Forgetting that each passphrase is a separate wallet with its own addresses: receiving to the no-passphrase wallet by mistake.
FAQ
Is the BIP39 passphrase the same as the wallet PIN?
No. The PIN unlocks a device. The passphrase is part of the seed itself and changes all keys and addresses.
What happens if I enter the wrong passphrase?
The wallet opens a different, empty wallet without any error. Check the fingerprint or first address.
Can I add a passphrase to an existing wallet?
Adding one creates a new wallet. Move the funds from the old addresses to the new ones with ordinary transactions.
How long should the passphrase be?
Long enough to resist guessing by someone who already has the words — several random words or 12+ random characters.
Does the passphrase work in other wallets?
It works in any wallet that implements BIP39 passphrases with the same derivation path. Test restore before relying on it.