Passphrase, 25th word, and the rest of the ritual

A BIP39 mnemonic is not “the wallet password”. It is a readable representation of a random secret, long enough that it cannot be guessed, structured enough that a human can copy it onto steel. These 12 or 24 words, plus optionally a passphrase, go through a function (PBKDF2) that produces the binary seed. From that seed, BIP32 derives a tree of keys: one for Bitcoin, one for Ethereum, accounts, addresses. The entire vault comes from there.

Twelve words encode 128 bits of entropy (plus a checksum). Twenty-four words encode 256 bits. Against an honest RNG, 128 bits suffice against brute force for the rest of the age of the universe. Against a defective RNG, the word count no longer matters: it is the quality of the randomness that counts, not the length of the phrase. The 2026 Coldcard bug illustrated this without ambiguity.

The last word is not freely chosen: it contains a checksum. If you get one word wrong, many devices reject the phrase. This is not protection against a thief, it is protection against you.

Ledger often talks about “25th word”. Trezor talks about passphrase and hidden wallet. Coldcard talks about passphrase. It is the same extension of the BIP39 standard. After the 12 or 24 mnemonic words, you add an arbitrary character string — a word, a phrase, special characters. This string is not drawn from the 2048-word BIP39 list. It can be “correct horse battery staple”, “7!gR…”, or a twelve-word phrase you invented. Each different passphrase derives an entirely different vault, with no visible on-chain link to the others.

Without a passphrase (empty string), you get the so-called “standard” wallet. That is the one anyone who finds your 24 words reconstitutes. With a passphrase, you get another key tree. The 24 words remain necessary, but they are no longer sufficient. That is why we say the passphrase turns one secret into two secrets: the plate, and what you have in your head — or on a second medium.

A dangerous misunderstanding: the “25th word” is not a twenty-fifth word from the BIP39 list that the device would draw at random. If you choose “abandon” or another word from the wordlist, it is a very short passphrase, therefore weak. Strength comes from the entropy of your phrase, not from the fact that it is called “25th”.

Because each passphrase opens a distinct vault, you can leave a small balance in the standard wallet (24 words alone) and hide the bulk behind a passphrase. Faced with physical coercion — the “$5 wrench attack” — you open the decoy. This is plausible deniability, not magic: an adversary who knows you use a passphrase can keep hitting. An adversary who analyzes your flows can see that the decoy is too small for your lifestyle.

Trezor often asks, at each session, whether you open the standard wallet or a hidden wallet. Ledger derives the 25th word in settings and can keep it “attached” or ask for it. Coldcard allows several passphrases. In all cases, the device cannot “recover” a forgotten passphrase. Forgotten = funds inaccessible, permanently. A typo at creation, never retested by a small send-and-return, is an elegant way to burn yourself.

If the passphrase is entered on the computer, a keylogger owns it. The hardware wallet protects the seed, not what you type on the Mac keyboard. Good rituals: entry on the device (even if it is painful on a small screen), or at minimum on a device you accept into the trust model.

Trezor long allowed “on-host” entry for comfort. That is a compromise, not a security feature. Ledger, Coldcard, Passport push on-device entry. A passphrase too long to type on a Nano is not “safer” if you end up storing it in a cloud password manager.

Paper burns, soaks, fades. Steel (Cryptosteel, Billfodl, Seedplate, an engraved plate) survives a domestic fire. This is not snobbery: it is the medium suited to a secret you still want to be able to read in twenty years. Two copies, two places, never a photo “for later”.

SLIP39, popularized by Trezor, is an “official” Shamir: you split the seed into N shares, M suffice (for example 2-of-3). One share at home, one with a parent, one in a safe. One share says nothing. This is not Ledger Recover: you choose the custodians, there is no KYC, no company in the middle — but you must train the custodians, or they will lose the piece of metal.

SeedXOR (Coldcard) mixes two (or more) seeds: each looks like a valid BIP39 seed, only the XOR combination reconstitutes. Useful for splitting without admitting Shamir. Dangerous if you lose the ritual. BIP85, for its part, derives child seeds for other devices without exposing the mother — practical for feeding a daily wallet from a cold vault.

A single hardware wallet, even excellent, is a single point of failure: entropy bug, manufacturer bankruptcy, traitor firmware, evil maid. A 2-of-3 multisig with three different brands (for example Coldcard + Jade + Trezor, or Passport + BitBox + SeedSigner) means one compromised vendor does not spend. In 2026, this is the adult answer for large amounts.

The cost is operational: descriptor backups (output descriptor / wallet configuration), recovery tests, documented inheritance. Without the descriptor, you have keys and no longer know how to combine them. A poorly documented multisig is an expensive way to lose access by yourself.

The device protects the private key against PC malware and, if it has an SE, against amateur physical extraction. It does not protect a photographed seed, a passphrase in iCloud, an heir without instructions, a send to a poisoned address (address poisoning), a misread contract. Most 2024–2026 losses remain human error and phishing, not lasers.

Generating the seed is the most dangerous moment: look at the screen off camera, away from the window, away from a curious roommate, write it down, verify word by word, do a restore test on a second device or after reset, put only a speck on it first, then the rest.