Seed Phrase Backup: Paper vs Metal vs Multisig

What You Are Actually Backing Up

A seed phrase is a human-readable encoding of the master secret from which your wallet derives every private key it will ever use. Back it up correctly and the hardware is disposable. Lose it and nothing else you did matters.

The words come from a fixed list of 2,048 defined by the BIP-39 standard. A 12-word phrase encodes 128 bits of entropy, a 24-word phrase encodes 256. One detail from that standard has direct practical value: the first four letters of every word on the list are unique. abandon can only be aban. That is why metal plates with four character slots per word work, and why a smudged fifth letter is not a disaster.

The device is a signing tool. The phrase is the asset. If you have not yet decided how much belongs in a hot wallet and how much belongs offline, start with our guide to hot wallets versus cold wallets, then come back to how you store the words.

Two Failure Modes That Pull in Opposite Directions

Every backup decision is a trade between two risks that move against each other.

Loss. The backup is destroyed, degraded, forgotten, or dies with you. Nobody knows how much crypto has been lost this way, because the blockchain does not mark a wallet as abandoned. Analysts infer it from dormancy, and the estimates diverge widely: figures published between 2025 and 2026 range from roughly 1.5 million to 4 million BTC, or somewhere between 7% and 19% of the 21 million cap. Treat the range as a signal about how common the failure is, not as a measurement.

Theft. Someone finds the backup. Copies in more places means a lower chance of losing everything and a higher chance of someone else finding a copy. There is no configuration that reduces both risks at once, only configurations that let you choose where the exposure sits.

The theft side has changed shape recently. Attacks on the person rather than the device are at record levels.

That matters for backup design in a specific way. A plate hidden in your house protects against fire. It does not protect against someone who is standing in your house asking where it is. The answer to that threat is not a better hiding place, it is a backup that is incomplete on its own.

Paper Backups

Paper is the default because it comes free in the box.

Where it works

It is legible, it needs no tools, and for a wallet holding a few hundred dollars in a safe at home it is proportionate. A backup that exists on paper beats a backup you kept meaning to stamp.

Where it fails

Fire. Paper chars well below the temperature of a structure fire. Lopp puts the average house fire at around 1,100°F, and paper does not need anything close to that.

Water. Firefighters put out the fire you survived, which means the surviving paper is soaked. Ballpoint ink runs. Thermal paper and some inkjet output fade to blank on their own within a few years.

Handling. Paper gets tidied away, filed with tax documents, thrown out during a move, or found by whoever is helping you move.

If you use paper, use pencil rather than ink, keep it in a sealed bag, and treat it as a temporary measure rather than the final state.

Metal Backups

A metal backup is a plate, tile set, or capsule that holds the words as stamped, punched, etched, or slotted characters. The point is surviving a fire and the water that follows it.

The reference work here is Jameson Lopp’s metal seed storage stress test series, which has run through more than 70 products across multiple rounds. His method is deliberately harsher than the threat: roughly 2,000°F applied for ten minutes, then immediate submersion in water to simulate a fire crew, followed by acid corrosion and a hydraulic press.

What the tests actually showed

The failures were not about the metal. Stainless steel and titanium both survive a house fire comfortably. The failures were about construction.

Devices built from individual letter tiles held in a tray failed repeatedly, because heat warped the tray enough for letters to fall out. The plate survived; the data did not. Devices where the characters are stamped or punched directly into a single solid piece came through with discoloration and nothing else.

The practical rule that falls out of hundreds of tests: one solid piece of metal, with the characters physically deformed into it. Not letters in slots, not ink on steel, not stickers.

What metal does not solve

A stamped plate is a complete, permanent, readable copy of your wallet for anyone who finds it. Fire resistance and theft resistance are different problems, and metal only solves the first one. Which brings us to the cheapest upgrade available.

The Passphrase, or 25th Word

A BIP-39 passphrase is an optional secret combined with your seed words during key derivation. Add one and the same 24 words produce a completely different wallet with different addresses.

This turns your backup into two factors: the words are something you have, the passphrase is something you know. Someone who finds the plate finds an empty wallet.

It also enables a decoy. The words alone open a wallet you can leave a small, believable balance in. The real holdings sit behind the passphrase, and there is no way for anyone to prove from the seed that another wallet exists.

The risk is symmetrical and severe. A passphrase has no checksum. Seed words do, so wallet software can tell you when you mistyped one. A passphrase cannot. Type Vault instead of vault, or leave a trailing space, and the wallet does not report an error. It silently derives a valid, empty wallet belonging to nobody. You will not know whether you mistyped or simply have no funds there.

Three rules make this survivable:

Choose for entropy, not cleverness. A common word or a four digit PIN is brute-forced quickly by anyone holding your seed. Several random words is the usual advice.

Record it, separately. “I will remember it” fails on a five year horizon, and it fails completely if you are hit by a bus. Store it in a different location and a different format from the words.

Test the restore before funding. Set it up, wipe the device, restore with the passphrase, confirm the addresses match. Then send funds.

Splitting the Backup: SLIP-39 Shamir Shares

Shamir’s Secret Sharing splits one secret into N shares of which any K reconstruct it, while K minus 1 shares reveal nothing at all. In crypto this is standardised as SLIP-39, published by SatoshiLabs and supported natively on Trezor devices. Ledger does not implement it.

A 2-of-3 or 3-of-5 setup means no single location holds anything usable. A house fire, a burglary, or a relative going through a drawer costs you one share and nothing else.

Two warnings matter more than the feature itself.

Cutting your seed phrase in half is not Shamir. Two halves are not two shares, and the reason is worth stating precisely, because the usual version of this warning is wrong.

Splitting 24 words into two groups of 12 leaves an attacker who finds one half with roughly 124 bits of entropy to search. That is not breakable by anyone. The real problem is the other direction: neither half recovers the wallet on its own, so you have doubled your chance of losing everything and gained no threshold in return. A genuine 2-of-3 does the opposite.

The security argument does apply at shorter lengths. Half of a 12-word phrase leaves about 62 bits, which is no longer impossible, only expensive, and expensive is a moving target. Either way, a scheme where shares below the threshold reveal nothing at all is available and standardised, so there is no reason to improvise one that leaks.

Reconstruction has a moment of exposure. When you recover, the complete secret is assembled on one device. Shamir protects the storage of a key. It does not change how the key is used.

Multisig

Multisig attacks the problem from the other end. Instead of one key backed up in pieces, you have several independent keys and a rule that a transaction needs a quorum, typically 2 of 3.

The distinction worth remembering: Shamir protects the backup of a key, multisig protects the use of keys. With multisig there is never a moment where one secret exists in one place, at setup, in storage, or at signing.

 

Collaborative custody is the packaged version. Providers such as Casa, Unchained, and Nunchuk hold one key in a 2-of-3 while you hold two, which means you can always spend without them and they can never spend without you. Their key exists as a recovery backstop. Entry tiers at Casa and Unchained have sat around $250 a year, with higher tiers adding more keys and concierge setup, though pricing and tiers change and are worth checking directly.

The costs are real:

You now back up a wallet configuration too. A multisig wallet needs the extended public keys and the descriptor to be reconstructed, not just the individual seeds. Losing that file while holding all the keys is a genuine and underappreciated way to lose funds.

Higher on-chain fees. Multisig transactions are larger, though Taproot implementations are starting to close that gap.

Harder inheritance. More moving parts means a more complicated set of instructions for whoever comes after you.

Multisig is the right answer for large holdings, company treasuries, and shared family funds. It is overkill for a wallet holding a few thousand dollars, where the added complexity is more likely to cause a loss than prevent one.

Which Method Fits Which Situation

A Regime That Actually Holds Up

Stamp or punch metal, one solid piece. Four characters per word is enough. Do this before the wallet is funded, not after.

Keep two copies in genuinely separate places. Two plates in the same house is one plate against fire. A second location means a different building, ideally a different neighbourhood.

Add a passphrase and store it apart from the words. Different location, different medium. Neither piece alone should be enough.

Test the restore. Wipe the device, recover from the backup, check that the first receiving address matches. An untested backup is an assumption, and people discover their assumption was wrong at the worst possible time.

Write the instructions for someone else. If you are the only person who knows the backup exists and how it works, your holdings die with you. A sealed instruction with an attorney, or a documented inheritance process from a custody provider, turns a private secret into a recoverable one.

Re-check on a schedule. Once a year, confirm both copies are where you left them and still legible.

Mistakes That Cost People Money

Photographing the phrase. A camera roll syncs to the cloud. This converts every other precaution into decoration, and malware scans for exactly this.

Typing it into anything. Password managers, notes apps, encrypted files. Once the words exist as text on a connected device, they are online.

Storing both copies at one address. The single most common version of this is one plate in the safe and one in the desk drawer, in the same building, against a threat that takes the whole building.

Never testing the restore. The failure that produces the largest losses, because it stays invisible until recovery is the only option left.

Inventing your own encryption. Shifted words, personal ciphers, and “I will remember the trick” schemes fail on a ten year horizon. Use a standard, or use nothing.

Telling people what you hold. Given the trend in physical attacks, the amount you hold is itself a piece of security information. Discretion is part of the backup plan.

A backup regime protects the key. It does nothing about the two ways funds leave a wallet whose key was never compromised: a malicious permission you signed, and an address you copied from the wrong place.

Frequently Asked Questions

Is a metal seed phrase backup worth it?

For any balance you would be upset to lose, yes. Paper fails to fire, water, and ink fade, and those are ordinary household events rather than exotic ones. A stamped metal plate costs less than most hardware wallets and removes the entire category of physical degradation. Choose a single solid plate with stamped or punched characters, since Jameson Lopp’s stress tests repeatedly found that devices using loose letter tiles lost data under heat.

Can I split my seed phrase in half and store the halves separately?

No, and not for the reason usually given. Half of a 24-word phrase still leaves an attacker around 124 bits to search, which nobody is breaking. The actual problem is that neither half recovers the wallet alone, so you have doubled your chance of total loss without gaining any threshold recovery. Half of a 12-word phrase is weaker still, leaving about 62 bits. Use SLIP-39 Shamir shares, where anything below the threshold reveals nothing at all.

What is a BIP-39 passphrase and should I use one?

A BIP-39 passphrase is an optional secret combined with your seed words to derive a completely different wallet. It means someone who finds your written backup finds nothing spendable, and it lets you keep a decoy wallet behind the words alone. The risk is that a passphrase has no checksum, so a typo silently produces a valid empty wallet with no error message. Use one, record it separately from the words, and test the restore before funding.

What happens if I lose one Shamir share?

Nothing, as long as you still hold the threshold number. In a 2-of-3 setup, any two shares reconstruct the wallet, so losing one costs you redundancy rather than access. Replace it promptly, because the second loss is the one that matters. This is the core advantage of Shamir over a single backup: it converts a catastrophic event into an inconvenient one.

Is multisig better than a Shamir backup?

They solve different problems. Shamir protects the backup of a single key, so the complete secret still exists on one device at the moment you recover. Multisig protects the use of several independent keys, so no single secret ever exists anywhere. Multisig is stronger and more complex, requires backing up the wallet configuration as well as the keys, and costs more in fees. It suits large holdings and shared funds rather than everyday balances.

Where should I store my seed phrase backup?

In at least two locations you control, far enough apart that one fire or flood cannot reach both. A home safe plus a second property, or a safe deposit box, are the usual choices. Bank boxes are durable but access is limited to banking hours and can be complicated by a death or a legal dispute, so avoid making one the only copy. Never store a backup with anyone who knows what it is.

How do I test my backup without risking my funds?

Wipe the hardware wallet and restore it from the backup alone, including the passphrase if you use one, then confirm the first receiving address matches what you had before. Do this before you send meaningful funds. If you are nervous about wiping a funded device, restore onto a second device or into a watch-only wallet from the derived public key instead.

Can someone steal my crypto if they find my seed phrase?

Yes, immediately and irreversibly, unless you use a passphrase or a multisig setup. A seed phrase is not a password protecting an account, it is the key itself, and anyone holding it can sweep the wallet without needing your device, your PIN, or anything else. This is why a written backup should never be complete on its own for meaningful balances.