In short
- A recovery phrase, also called a seed phrase, is a list of 12 to 24 words that can recreate every key in a wallet.
- Anyone who has the words can control the funds from any device in the world, without your password.
- No support team, app, website or official ever needs your recovery phrase. A request for it is the scam.
What a recovery phrase is
When a self-custody wallet is created, the software generates a large random number. Every private key the wallet will ever use is calculated from that number. Because a long random number is impossible for people to write down reliably, it is converted into a list of ordinary words. That list is the recovery phrase. You will also see it called a seed phrase, mnemonic phrase or secret recovery phrase.
The most widely used method for turning the number into words is described in a public technical document called BIP-39. It uses a fixed list of 2,048 English words (lists in other languages exist too), and phrases are usually 12 or 24 words long, although 15, 18 and 21 words are also allowed. The last word contains a small checksum, which lets software spot many typing mistakes.
Why it is so powerful
The recovery phrase is not a password for an account. It is the master copy of the keys themselves. If you type the same words into compatible wallet software on any device, anywhere, it recreates the same keys and shows the same funds. This is useful: if your phone is lost, the phrase lets you restore access. But it works exactly the same way for a thief. There is no company in the middle that can say "this is not the real owner", no extra login and no way to change the phrase once someone else has it.
That is why the most important rule in this whole site is simple: whoever has your recovery phrase has your funds.
Recovery phrase, password or PIN?
People often mix up the three. A PIN or password usually unlocks the wallet app on one particular device, and it can be changed. The recovery phrase sits underneath: it recreates the wallet on any device and cannot be changed without creating a new wallet. Forgetting a PIN is an inconvenience. Losing control of the recovery phrase is usually permanent.
Who may ask for it
Nobody. That includes:
- customer support of any app, exchange or wallet provider;
- a website that says it needs to "validate", "synchronise", "upgrade" or "verify" your wallet;
- a pop-up, form or chatbot that appears while you are using a site;
- a friend, partner, online contact, teacher or "mentor";
- police, regulators, tax authorities, lawyers or recovery services.
The only time you should ever type your recovery phrase is when you yourself are restoring your own wallet, in wallet software you deliberately installed from its official source, on a device you trust. If you did not start that process, any request for the words is an attack.
How people are tricked into revealing it
Fake support
Someone posts about a problem and receives a message from a "support agent" who asks for the phrase to "fix the wallet". See our guide on impersonation scams.
Phishing pages and fake apps
A copy of a real wallet's website or app asks you to "restore" or "import" your wallet as part of an update. Everything you type is sent to the fraudster.
Malware and photos
Malicious software searches devices and cloud storage for anything that looks like a recovery phrase, including screenshots and photos. A picture of the words in your gallery can be found automatically.
"Shared" wallets
A new online contact offers to create a wallet for you and gives you a phrase they already know, or asks you to share yours "so we can manage it together". Either way, they hold the keys.
Writing it down safely
A recovery phrase should be written by hand, offline, at the moment the wallet is created, and checked word by word. Keep it away from cameras, cloud services, e-mail, messaging apps and notes apps. Never make up your own words: a phrase chosen by a person is far easier to guess than one generated randomly by software. How to protect the paper copy from fire, water and loss is covered in our guide to backups that survive emergencies.
An optional extra word
BIP-39 also allows an optional passphrase — sometimes called a "25th word" — which is combined with the recovery phrase to create a different set of keys. It adds protection if someone finds the written words, but if the passphrase is forgotten, the funds behind it cannot be reached. It is a balance to understand fully before using it, not a default.
Do and don't with a recovery phrase
| Do | Don't |
|---|---|
| Write it by hand, offline, and check every word | Photograph it, screenshot it or store it in the cloud |
| Keep it somewhere private and protected | Type it into any site, form or chat that asks for it |
| Use it only to restore your own wallet, when you started the process | Share it with support, a friend, an online contact or an official |
| Let software generate the words | Choose your own words or use a phrase someone gave you |
| Treat any request for it as a scam warning | Believe that "validation" or "synchronisation" needs it |
If it already happened
If someone else may have seen or received your recovery phrase, assume that they can move the funds at any moment. The usual response is to create a completely new wallet with a new phrase on a device you trust and move what remains into it as quickly as possible, before the old phrase is used against you. Do not reuse the exposed phrase for anything. Then save the details and report it — see our reporting page.
Printable checklist
Protecting a recovery phrase — Secret, readable and recoverable — check all three.
Sources
This guide is general safety education. It is not financial, legal or security advice for your individual situation, and it does not recommend acquiring, holding or disposing of any crypto-asset. If you think you are dealing with fraud, contact your bank and the police.