How to Back Up a Seed Phrase: Paper, Metal, and Split Backups
A seed phrase backup has to survive fire, water, theft, and your own filing habits, which is why the three practical options are paper stored in more than one place, a stamped or engraved metal plate, and a split backup that requires several shares to reconstruct the secret.
Updated · By RampAtlas Research
Key takeaways
- A seed phrase backup has to survive fire, water, theft, and disorganization, which leaves paper in multiple locations, metal, and split backups as the practical options.
- A seed phrase is a complete, portable copy of the wallet, so a backup protects against loss and creates a new target for theft at the same time.
- BIP-39 encodes the phrase against a fixed public list of 2,048 words, so the first four letters of each word are enough to identify it.
- SLIP-39 splits a secret into shares where a chosen threshold reconstructs it, with shares of 20 or 33 words depending on the secret length.
- A backup you have never restored from is an assumption rather than a backup, so test it while the balance is still small.
In this guide
A seed phrase backup has to survive fire, water, theft, and your own filing habits, which is why the three practical options are paper stored in more than one place, a stamped or engraved metal plate, and a split backup that requires several shares to reconstruct the secret.
Choosing between them is a question about which failure you consider more likely: losing the only copy, or somebody finding a copy. Every method trades one against the other. This guide explains what each protects against, so you can pick deliberately rather than by default.
What you are actually backing up
A seed phrase is not a password and not a hint. It is an encoded copy of the randomness your wallet was built from, and it regenerates every private key in that wallet on any compatible software, anywhere, with no other information required.
That has two consequences that pull in opposite directions. Because the phrase is complete, losing every copy destroys access permanently, so redundancy matters. And because the phrase is complete, every copy is a full set of keys sitting somewhere, so each additional copy is another place you can be robbed. Backup design is the process of balancing those two.
The words themselves come from a fixed, public list. BIP-39 encodes 128 to 256 bits of entropy against a list of 2,048 words and appends a checksum of one bit per 32 bits of entropy, producing the familiar 12- and 24-word phrases (source: BIP-39 specification).
2,048 words
BIP-39 word list
BIP-39 specification
128 to 256 bits
Entropy encoded
producing the familiar 12- and 24-word phrases, BIP-39 specification
20 or 33 words
SLIP-39 share length
for a 128-bit or 256-bit secret, SLIP-0039 specification
Two practical facts follow. The list is public, so a stranger who finds your words does not need to guess anything. And because no two words in the list share their first four letters, recording four letters per word is enough to reconstruct the phrase, which matters when you are stamping metal.
| Method | Survives fire and water | Protects against a copy being found | Main cost |
|---|---|---|---|
| Paper, in more than one location | No. Fire, water and fading ink are its weaknesses | No. Each copy is a full set of keys | Free, but fragile |
| Stamped or engraved metal | Usually. That is the one reason it exists | No. A plate in a drawer is as spendable as a sheet in a drawer | Errors are permanent |
| Split backup, such as SLIP-39 | Depends on the material used for each share | Yes. A single share found by someone else is useless | Administration: more locations, instructions and a harder restore |
Paper, done properly
Paper is free, immediately available, and better than most people expect. Its weaknesses are fire, water, fading ink, and being thrown out by someone tidying up.
- Write with pencil or an archival pen. Not a receipt printer, and not a gel pen that fades.
- Record the word order, the number of words, and which wallet software or device created the phrase. A restore is much harder when you cannot remember the derivation the wallet used.
- Leave off anything that identifies it. Do not record the wallet's balance, and do not label the sheet "Bitcoin wallet."
- Seal it against moisture and store it away from the device. Not the same room.
- Make a second copy and store it at a different location. One copy in a home safe and one at a family member's house or a bank deposit box covers the single-site disasters that destroy the primary. Two copies in the same building is one copy.
Metal, for durability
A metal backup is a plate or a set of tiles onto which the words are stamped, punched, or engraved. It exists for one reason: paper does not survive a house fire and metal usually does.
The practical options are stamping letters into a steel plate, punching into pre-printed tiles, or engraving. All of them are permanent, which means an error is permanent too, so verify each word against the device screen before you commit and again after.
Metal solves durability and solves nothing else. A plate found in a drawer is exactly as spendable as a sheet of paper found in a drawer, and a plate is heavier to hide and harder to destroy in a hurry if you need to. Treat it as a paper backup that survives more, not as a security upgrade.
Split backups
A split backup divides the secret so that no single location holds enough to spend, while a chosen number of pieces together restores it. This is the answer for people whose real worry is a copy being found rather than every copy being lost.
SLIP-39 is the standard implementation. It applies Shamir's Secret Sharing to the wallet secret, supports up to 16 groups with up to 16 member shares each, and produces shares of 20 words for a 128-bit secret or 33 words for a 256-bit secret, each ending in three checksum words (source: SLIP-0039 specification). The scheme is built into consumer hardware: Trezor documents its Shamir Backup as generating between 1 and 16 recovery shares of 20 or 33 words, with a user-chosen threshold such as 2 of 3 (source: Trezor, "What is Shamir Backup?").
A 2-of-3 arrangement is the usual starting point. Any two shares restore the wallet, so one lost share is survivable, and any single share found by someone else is useless to them. The cost is administration. You now have three locations to maintain, three sets of instructions for whoever inherits the problem, and a restore procedure that is harder to execute under stress. For shared or business funds, a multisig wallet often fits better than a split backup because it distributes signing authority rather than a single secret, which is the subject of Multisig basics.
The passphrase question
BIP-39 defines an optional passphrase mixed into the seed derivation, with an empty string used when none is present (source: BIP-39 specification). Adding one means a stolen phrase reaches a different wallet than yours.
It also means you now have two secrets to lose instead of one, stored in different places, and no recovery path if you forget the passphrase. It is a reasonable choice for someone with a documented storage plan and a bad one for someone adding it because it sounds safer.
Test the restore
Whatever you choose, restore from it before it matters. Wipe the device and recover from your written words, or load the phrase into a second wallet, while the balance is still small. This catches transposed words, a missing word, an unreadable character, and the wrong derivation path, all of which are common and all of which are cheap to fix now and impossible to fix later.
Re-check the backup on a schedule. Paper fades, ink runs, houses get cleared out, and the people who know where the second copy lives forget or move away. Once a year is enough.
Where this fits
A backup plan is only worth building around funds you actually control. If your coins are still on a trading account, the exchange holds the keys and there is no phrase to back up, which is a different set of risks covered in Self custody vs exchange custody. The exchanges we track are listed at Exchanges, and if you are still deciding what to hold, the asset pages start at Bitcoin and Ethereum. Setting up the device itself is covered in Hardware wallet setup, and what to do when the backup fails is in Lost seed phrase.
Frequently Asked Questions
Can I store my seed phrase in a password manager?
It defeats the purpose. A password manager is software on a networked device protected by a password, which is the category of risk self custody exists to escape. Anyone who compromises the vault gets the wallet with no further work.
Is a bank safe deposit box a good location?
It is durable and hard to burgle, and it is also subject to access hours, bank failures, and legal processes that can seal it. It works well as one of two locations and badly as the only one.
How many copies should I keep?
Two is the common answer for personal holdings: one where you live and one elsewhere. Three copies of the same complete phrase starts adding more theft exposure than loss protection. If you want more redundancy than that without more exposure, use a split scheme instead of more copies.
Do I need to back up my wallet again after receiving new coins?
No. The phrase generates every address the wallet will ever use, so it covers funds received in future. The exception is a wallet where you added a passphrase or created accounts on a different derivation path, which you should record alongside the words.
Should I write down my PIN with the phrase?
No. The PIN protects the physical device and the phrase bypasses it entirely, so storing them together gives an intruder both layers at once for no benefit.