BIP-39 Passphrase: What Is the 25th Word and How to Secure Your Wallet
🎯 Key Takeaways
- Hidden wallet: The passphrase generates an entirely different wallet from the same seed — invisible to anyone who doesn’t know it.
- Plausible deniability: You can keep a “decoy” wallet with small funds and hide the bulk behind the passphrase.
- No error messages: Every passphrase is valid. If you type it wrong, you simply open a different (empty) wallet.
- Real risk: If you lose or forget the passphrase, the funds are gone forever — even with the seed phrase intact.
You’ve already secured your 12 or 24-word seed phrase, perhaps even generated it with dice. Great. But there’s an extra layer of security that many overlook — one that can make the difference between sleeping soundly and losing everything: the passphrase.
In this guide we’ll cover what it is, why it matters, how to set it up on the main hardware wallets, and — most importantly — which mistakes to avoid.
🔐 What Is the BIP-39 Passphrase?
The BIP-39 passphrase, often incorrectly called the “25th word,” is an additional text string that combines with your seed phrase to derive an entirely different wallet.
Important: it is not a word from the BIP-39 list of 2,048 words. It’s an arbitrary string that you choose yourself. It can contain uppercase letters, lowercase letters, numbers, spaces and special symbols. It can range from a single character to over 100 characters.
Here’s what happens in practice:
- Seed without passphrase → Wallet A (your “normal” wallet)
- Seed + passphrase “pizza” → Wallet B (completely different)
- Seed + passphrase “Pizza” → Wallet C (different from B — it’s case-sensitive!)
- Seed + passphrase “my-secret-phrase-2026!” → Wallet D (yet another one)
Each seed + passphrase combination generates a completely independent set of private keys, addresses and balances. There is no visible link between them.
🛡️ Why Use It?
The passphrase serves three main purposes:
1. Extra Security (Two-Factor Seed)
If someone finds your seed phrase — maybe engraved on a steel plate at home — they still can’t access your real funds. Without the correct passphrase, they’ll only see the “base” wallet (which you can leave empty or with small amounts).
In practice it’s like having physical two-factor authentication: you need both the seed (something you have) and the passphrase (something you know).
2. Plausible Deniability (Decoy Wallet)
This is the most relevant scenario for privacy-minded users. Imagine being under pressure — a robbery, a search, a nosy relative. You can show the wallet without a passphrase, which contains a believable but limited amount. Your real wallet with your main holdings stays invisible: nobody even knows it exists.
There is no way to prove that a passphrase is in use just by looking at the device or the seed.
3. Protection Against Seed Theft
Even in the worst case — seed compromised, stolen, photographed — the funds protected by the passphrase remain safe. The attacker would also need to guess the passphrase, and since it’s a free-form string, it offers a practically infinite search space.
⚖️ Passphrase vs PIN vs Password
| Feature | Device PIN | App Password | BIP-39 Passphrase |
|---|---|---|---|
| What it protects | Physical access to the device | Access to the app/software | Key derivation itself |
| If you lose it | Reset device, seed still works | Reset app, seed still works | Funds lost forever |
| Where it’s stored | On the device | On the device/cloud | Nowhere (only in your head or on a physical backup) |
| Can it be reset? | Yes (with the seed) | Yes (with the seed) | Never |
| Security level | Medium | Medium | Very high |
⚠️ The key difference: PIN and password protect access to the device. The passphrase changes which keys are generated. If you lose it, no reset in the world can recover those funds.
⚙️ How It Works (Simply Explained)
The mechanism is elegant in its simplicity:
- Your seed phrase (12 or 24 words) is converted into a cryptographic seed (binary seed).
- If you add a passphrase, it gets concatenated to the seed before key derivation.
- The result is an entirely different key tree — different addresses, different private keys, different wallet.
The crucial thing to understand is this: there is no “right” or “wrong” passphrase. Every string you enter generates a valid wallet. If you get even one character wrong, the wallet still opens — but it will be a different, empty wallet. You will never receive an error message.
This is both its greatest strength (nobody can tell if you’re using a passphrase) and its greatest risk (nobody can help you if you forget it).
📱 How to Set It Up on Major Hardware Wallets
Ledger (Nano S Plus, Nano X, Stax, Flex)
Ledger offers two modes:
Temporary Mode:
- Go to Settings → Security → Passphrase on the device
- Select “Set temporary passphrase”
- Type your passphrase on the device screen
- Confirm — the hidden wallet is active until shutdown
PIN-tied Mode (recommended):
- Go to Settings → Security → Passphrase
- Select “Attach to a PIN”
- Type your passphrase
- Choose a second PIN (different from your main PIN)
- Now: PIN 1 opens the base wallet, PIN 2 opens the passphrase wallet
💡 Tip: PIN-tied mode is the most practical. You don’t need to type the passphrase every time — just the right PIN. Plus, if someone asks you to unlock the device, you use PIN 1 and show the decoy wallet.
Trezor (Model One, T, Safe 3, Safe 5)
- Connect the Trezor and open Trezor Suite on your computer
- Go to Settings → Device → Passphrase
- Enable the “Enable passphrase” feature
- From now on, every time you connect the Trezor you’ll be asked: “Enter your passphrase”
- Leave it blank → base wallet. Enter a string → corresponding hidden wallet
💡 On Trezor you can choose to enter the passphrase on the device screen (more secure) or on the computer (more convenient). For significant amounts, always use the device screen.
Blockstream Jade
Jade handles passphrases very flexibly:
- Turn on the Jade and before activating a wallet, go to Options → BIP39 Passphrase
- Choose the frequency:
- “Always Ask” — prompts for the passphrase at every boot
- “Next Login Only” — asks only at the next boot (hides the fact that you use a passphrase)
- Choose the input method:
- Manual — type characters one by one
- WordList — select words from a list (faster for long passphrases)
- Enter and confirm the passphrase
💡 Jade is the only one of the three that offers “Next Login Only” mode, which is perfect for total plausible deniability: after rebooting, there’s no trace that the feature was ever used.
⚠️ Critical Risks and Mistakes to Avoid
This is the most important section in the entire guide. Read it carefully.
1. Forgetting the passphrase = losing everything
There is no “password recovery.” There is no customer support. There is no reset. If you forget the exact passphrase, the funds in the associated wallet are lost forever, even if you have the seed phrase perfectly preserved.
2. There is no “wrong passphrase”
If you type “Bitcoin” instead of “bitcoin,” a different wallet opens — empty — with no error message. You might think the funds have vanished when in reality you simply got a character wrong.
3. Don’t store seed and passphrase together
If you keep the seed on a steel plate and the passphrase written on the same sheet next to it, you’ve completely eliminated the security advantage. Anyone who finds both has access to your funds.
4. Don’t use simple passphrases
“password,” “1234,” your name or your date of birth are not secure passphrases. Use a long, complex string that cannot be traced back to your identity. At least 12-15 characters with a mix of letters, numbers and symbols.
5. Not testing = not trusting
Before transferring significant funds to a passphrase wallet:
- Set up the passphrase and generate a receiving address
- Send a minimal amount (e.g. a few euros worth of BTC)
- Completely reset the device
- Restore with seed + passphrase
- Verify that the address and balance match
Only after this verification should you trust the setup.
📋 Backup Best Practices
| What | Where | Notes |
|---|---|---|
| Seed phrase (12/24 words) | Steel plate, fireproof safe | Location A |
| Passphrase | Separate sheet, different location | Location B (physically distant from the seed) |
| Redundant passphrase copy | Second secure location | Optional but recommended — in case of fire/flood at location B |
🛡️ Golden rule: The seed and the passphrase must never be in the same physical location. If someone accesses location A, they should not be able to access location B and vice versa.
Also consider telling a highly trusted person about the existence (not the content!) of the passphrase, with instructions on how to retrieve it in case of emergency. Don’t let your funds die with you.
🔗 Passphrase and Privacy: The Connection
If your threat model includes the possibility that someone could physically access your seed — a housemate, a thief, an authority — the passphrase is your final shield.
Combined with a self-custody wallet and a seed manually generated with dice, the passphrase completes a setup where you and only you control your funds. No intermediaries, no single point of failure.
🎯 Conclusion
The BIP-39 passphrase is one of the most powerful and underrated tools in the self-custody world. It adds a security layer that transforms a single seed phrase into an invisible multi-wallet system.
But it’s a double-edged sword: the very property that makes it secure (no way to recover it) also makes it dangerous if not managed with discipline.
Use it if:
- You’re protecting significant amounts
- You want plausible deniability
- You have a solid backup plan for both seed AND passphrase
Don’t use it if:
- You’re not confident you can reliably store two separate secrets
- You’re not yet comfortable with basic seed phrase management
If you’re not sure where to start, first read our seed phrase generation guide and the self-custody wallet guide. Once you have the basics down, the passphrase is the natural next step.
This article is for informational purposes only and does not constitute financial, legal, or tax advice. Never share your seed phrase or passphrase with anyone. Mismanaging your passphrase can result in the irreversible loss of funds.
This site is supported and sponsored by DeGate Wallet, an outstanding multi-chain self-custody wallet focused on maximum privacy and security. Check out the new DeGate Card!