What is passphrase (25th word)?
An extra secret added to a recovery phrase that produces an entirely different set of wallets, so the written phrase alone does not reach the funds.
Not yet verifiedHow we verify
3 min read
In this entry
An extra secret added to a recovery phrase that produces an entirely different set of wallets, so the written phrase alone does not reach the funds.
Hardware wallets expose it under names like passphrase, 25th word, or hidden wallet. It is standardized as an optional extension in Bitcoin Improvement Proposal 39, which defines both the recovery word list and the way an additional passphrase feeds into the key derivation (source: BIP-39).
It protects against someone who finds your backup and against being forced to unlock a device. Forgetting it loses the funds permanently, because nothing records it anywhere. Those two sentences describe the entire trade, and people consistently underweight the second.
How it works
A recovery phrase is converted into a seed through a key derivation function. The passphrase is mixed into that conversion as salt. Change one character and you get a completely different seed, and therefore a completely different set of addresses.
There is no wrong passphrase. Every possible string produces a valid, empty wallet. The device cannot tell you that you mistyped, because from its perspective you have simply opened a different wallet that happens to have no funds. That is the property that makes plausible deniability work, and the same property that makes a typo unrecoverable.
The practical arrangement is two wallets from one backup. The phrase alone opens a wallet you can leave a small amount in. The phrase plus the passphrase opens the real one. Someone who finds the paper, or who compels you at the door, reaches the first.
Two rules follow from the derivation. The passphrase must be backed up separately from the phrase, in a different place, because storing them together defeats the purpose entirely. And it must be recorded exactly, including case, spaces, and punctuation, because there is no approximate match.
Example
Illustrative demonstration. The same twelve-word phrase with three different passphrases produces three unrelated wallets.
| Passphrase | Result |
|---|---|
| None | Wallet A, holds a small decoy balance |
correct horse | Wallet B, holds the real balance |
Correct horse | Wallet C, empty, and indistinguishable from a valid wallet |
The third row is the risk. A capital letter typed by accident opens an empty wallet with no error message, and someone who never wrote the passphrase down exactly has no way to tell which of the two they meant.
Why it matters when you buy
This becomes relevant when you move funds off an exchange into self-custody and start thinking about how the backup could fail. A passphrase is a genuine improvement for a meaningful holding and a genuine liability for someone who will not maintain two separate backups. Decide before you fund the wallet, not after. The setup steps are at Hardware wallet setup and backup approaches at Seed phrase backup methods.
Related terms
- seed phrase — what the passphrase modifies
- bip 39 — the standard defining both
- hardware wallet — where it is usually configured
- hd wallet — the derivation the seed drives
- shamir backup — a different split-backup approach
- self custody — the practice this hardens
Questions
Is a passphrase the same as my device PIN?
No. A PIN unlocks the hardware and can be reset by restoring from the phrase. A passphrase is part of the cryptography and cannot be reset by anyone.
What if I forget one character?
The wallet it opens will be empty, with no error. Recovery means guessing the exact string, which is only feasible if you remember nearly all of it and can enumerate the rest.
Should I use one?
Only if you will maintain the passphrase backup separately and reliably for years. For most people a single well-protected seed phrase in a secure location is the lower-risk choice.