BIP39 passphrase: the 25th word, hidden wallets and how makers differ

A BIP39 passphrase is an optional secret added to your recovery phrase when the wallet calculates its seed. BIP39 runs the words, with the string “mnemonic” plus the passphrase as salt, through PBKDF2 (2,048 rounds of HMAC-SHA512) to make a 512-bit seed; with no passphrase it uses an empty string. Change one character and the seed, every key and every address change with it. (BIP39 first normalises the text to Unicode NFKD, so characters that Unicode treats as equivalent give the same seed.)

What is a BIP39 passphrase?

It is a second secret next to the words. Someone who finds your written recovery phrase can open the wallet that has no passphrase, but not the one behind yours, unless they can guess it. Trezor warns: “Anyone who has your wallet backup can try to guess a weak passphrase.”

COLDCARD lists “BIP-39 Passphrases (25th word)” and Keystone calls it “an extra ‘25th word’”, but the name is a nickname: the passphrase does not have to come from the BIP39 word list (COLDCARD does offer to pick words from it) and can be any string within the device’s limit. Trezor allows up to 50 ASCII characters, COLDCARD up to 100, and NGRAVE between 1 and 512.

What is a hidden wallet?

BIP39 says “every passphrase generates a valid seed (and thus a deterministic wallet) but only the correct one will make the desired wallet available”, which it calls plausible deniability. There is no stored answer to check against: the device derives whichever wallet matches what you typed. NGRAVE puts it plainly: “Adding a passphrase creates a new hidden wallet with new coins and addresses.” NGRAVE adds that a passphrase wallet with a small amount can act as a “duress wallet”, which is not the same as a duress PIN that wipes the device.

What happens if you forget or mistype the passphrase?

A typo opens a different, most likely empty wallet, because no passphrase is wrong. Tangem puts it as “There is no ‘incorrect’ passphrase.” BIP39 cannot tell a typo from a new passphrase; wallet apps help only at the edges. Trezor Suite shows “Passphrase mismatch” when two entries differ and tells you when a passphrase wallet is empty, but a typo still derives a valid wallet. Case matters, and so do spaces.

A typo can be undone: type the original passphrase and the original wallet opens. Of a mistyped passphrase, Trezor says “This doesn’t mean your funds are lost.” Forgetting it is different. Trezor says “Passphrases cannot be changed, removed, or recovered”, and BitBox that the passphrase is not part of the wallet backup and “cannot be recovered by BitBox”. A Ledger with the passphrase attached to a secondary PIN still opens the hidden accounts with that PIN, but after a reset or on a new device only the exact passphrase brings them back.

So:

• Write it down. Ledger calls keeping it only in your head “a dangerous game” and says “if you forget it, it’s game over”.
• Store it apart from the recovery phrase. Whoever finds both has everything. Our seed phrase guide covers storage and what an heir needs.
• Check which wallet opened. COLDCARD shows the new wallet’s extended fingerprint (XFP) after you enter a passphrase; Trezor displays the passphrase on the device so you can check it character by character.

How does a Ledger passphrase work?

Ledger says “All Ledger hardware devices have the passphrase option available”, which covers the Nano S Plus, Nano X, Nano Gen5, Flex and Stax. You enter it “directly on your Ledger signer”, and Ledger Academy describes two modes:

• Temporary passphrase. Typed each time you want the hidden accounts. It “only stays active while your Ledger is powered on”; after that the device returns to the standard accounts.
• Attached to a secondary PIN. At start-up the normal PIN opens the standard accounts and a second PIN the passphrase accounts. Ledger warns that “after three incorrect attempts your device will be reset”. You then restore from the recovery phrase and need the written passphrase to reach the hidden accounts again.

Ledger’s rule for both modes: “Never enter your Passphrase on a computer, smartphone, or other internet-connected device.”

How does a Trezor passphrase work?

On the Safe 3, Safe 5, Safe 7, Model One and Model T you switch passphrases on in Trezor Suite. The Safe 3, Safe 5, Safe 7 and Model T then let you type it in Suite or on the device; the Model One takes it in Suite only. Trezor’s guide says the Safe 7, Safe 5 and Model T take it on the touchscreen and the Safe 3 with its buttons, while “Trezor Model One has no on-device entry”, so on that model it is typed in Suite. Trezor’s advice is “Type your passphrase on your Trezor whenever you can.”

How do other hardware wallets handle the passphrase?

Typed on the device, not saved to it. On the BitBox02 Nova Multi you enable the feature in the BitBoxApp, then the device asks for a passphrase after its password at each unlock; leave it empty for the standard wallet. BitBox says enabling it does not “store one on the device”. Blockstream Jade Plus offers an on-device keyboard or BIP39 word suggestions and a frequency setting (Disabled, Next Login Only, Always Ask); Jade “will not store your passphrase”. On the NGRAVE ZERO you set it under Settings. NGRAVE’s passphrase FAQ says it is kept encrypted in the secure element “for the duration of a session” and wiped when the ZERO goes into standby or turns off; it extends either a seed phrase or NGRAVE’s own Perfect Key backup.

On the device, with an optional encrypted save. The COLDCARD Mk5 and COLDCARD Q accept it from the keypad, a microSD card or, on the Q, a QR scan. It can be saved to a microSD card “encrypted with AES-256”, tied to that card, and stays active until logout or power-off. COLDCARD notes different rules for Codex32 backups.

In the phone app, import only. Tangem’s May 2024 post says its app, used with the Tangem Wallet and Tangem Ring, can “import a wallet created with a seed phrase and passphrase” but “does not yet support creating a wallet with a passphrase”. The same post allows keeping the passphrase in a password manager if the seed is stored physically; Ledger says “Never store it digitally”.

Listed without implementation details. Keystone 3 Pro, SafePal S1 Pro, SafePal X1, ELLIPAL Titan 2.0, OneKey Pro, KeepKey and Passport Prime list a passphrase on their product or FAQ pages without saying where it is typed or whether it is stored.

Not documented. For the Arculus we found no extension passphrase: where the maker’s FAQ says passphrase, it means the 12- or 24-word recovery phrase itself. Bitkey has no seed phrase to extend.

When does a passphrase help, and when does it add risk?

It helps when the threat is someone finding your written words, provided the passphrase is too strong to guess. It adds risk when the threat is your own memory or handwriting: a lost passphrase locks funds as firmly as a lost recovery phrase, and every heir needs it too. In a multisig, Coinkite warns that passphrase wallets made from one COLDCARD seed “share one parent-seed failure domain”: “Do not treat them as independently generated multisig cosigners.”

What we could not verify

• Which standard Passport Prime’s passphrases follow; Foundation does not name BIP39.
• Whether NGRAVE ZERO passphrase wallets restore on other wallets. NGRAVE says the feature “aims to be compatible” and that “you’ll also need to consider the specifications of other wallets”, but does not confirm a cross-wallet restore.
• Where the passphrase is typed, and whether it is stored, on the Keystone, SafePal, ELLIPAL, OneKey and KeepKey models.
• Jade Plus specifics: Blockstream’s passphrase pages describe the Jade family.
• Whether Tangem now creates passphrase wallets; the “not yet” post is dated 2 May 2024.