Passphrase FAQ: What every passphrase user should know

The passphrase is a sharp tool. Used carefully, it adds real security to your wallet. Used carelessly, it's one of the fastest ways to lose access to your own crypto.

This FAQ covers the questions we hear most often.

1. What is a passphrase and how does it work?

A passphrase is an optional string of characters that you add on top of your wallet backup. Together, they generate a completely separate wallet with its own addresses, balances, and transaction history.

Think of it this way:

• Wallet backup alone = your standard wallet
• Wallet backup + passphrase = a different wallet entirely

Every unique passphrase produces a unique wallet. There is no limit to how many you can create. Every single one is valid, which means every typo is also valid.

If you enter "MyPassphrase" instead of "mypassphrase," you'll open a different (empty) wallet with no error message. The device has no way to tell you it's wrong because, technically, it isn't.

A single character difference creates a completely separate wallet, and if you can't reproduce the exact passphrase, you can't access the funds.

2. Do I need a passphrase?

Most users don't. If you're using a Trezor and want to strengthen your backup security, you're usually better off with SLIP39 multi-share backup than with a passphrase.

SLIP39 lets you split your backup into shares (for example, 2-of-3) so that no single share can compromise your wallet, and you can lose one share without losing access. Before SLIP39 existed, the passphrase was one of the few ways to add protection beyond a single backup. Now that you can split your backup, there's a simpler and safer option available for most situations.

A passphrase adds a second secret that is equally necessary to access your wallet. That means if you lose either your wallet backup or your passphrase, your funds are gone. In security terms, this is called a single point of failure: any one thing whose loss causes total failure. A passphrase doesn't remove single points of failure from your setup. It adds one.

That said, if you're an advanced user with a specific security scenario in mind, a passphrase may provide real value. Some users have particular reasons for needing a separate wallet tied to the same backup, and for them the tradeoff makes sense.

A passphrase is worth using if you understand the risks, generate it with real randomness, and commit to writing it down and testing it. If any of that feels uncertain, SLIP39 is the better starting point.

3. What happens if I forget my passphrase?

You lose access to the wallet and everything in it.

Your Trezor device does not store your passphrase, and Trezor Suite doesn't keep it either. There is no recovery option, reset button, or support ticket that can fix this.

If you lose your passphrase, your only path is to try every variation you can think of: different capitalizations, with and without spaces, different special characters, common typos.

4. Should I write down my passphrase?

Absolutely. Write it down on paper or metal, something physical and durable. Do it the moment you create it.

People skip this step because they're confident they'll remember. But your passphrase is a string of characters you might type once a month or even less frequently. Human memory is far less reliable than it feels, especially for information you don't actively use. A passphrase you created weeks or months ago and haven't thought about since is exactly the kind of detail your brain lets go.

Here's what to do:

• Write the passphrase exactly as you typed it. Capital letters, lowercase letters, spaces, special characters. Every detail matters. "Hello World" and "hello world" open completely different wallets.
• Avoid ambiguous characters when choosing your passphrase. For instance, lowercase L (l), uppercase I (I), the number 1, and the number 0 versus uppercase O are easy to confuse when writing by hand. If you can, avoid them entirely.
• Along with your passphrase, write down the last 5 characters of the first receive address in your passphrase wallet's default account. This gives you a quick way to verify you're in the right wallet later. If you use wallet software that displays the wallet fingerprint (an 8-digit hex identifier), write that down instead. It's an even more reliable check.
• Make copies if you need to. Store them in different secure locations. The same rules that apply to your wallet backup apply here: no photos, no cloud storage, no digital copies.
• If your concern is someone finding both together, keep it separate from your wallet backup. The tradeoff is that you now have two things to keep track of in two places.

Can you try to memorize it too? Sure. But treat that as a bonus, never as your only backup.

Test your passphrase before sending significant funds. Create the passphrase wallet, send a small amount, close the wallet, re-enter the passphrase from what you wrote down, and confirm the funds are there. Do this every time you create a new passphrase wallet.

5. Where does the passphrase come from?

You create it yourself. Unlike your wallet backup, which your Trezor generates using hardware randomness, the passphrase is entirely your responsibility to choose, enter, and protect.

This means the security of your passphrase depends on how you create it. A well-chosen passphrase can be extremely strong. A poorly chosen one can be cracked in minutes or even seconds. The next question goes deeper into what "strong" actually means.

6. Is my passphrase strong enough?

Only if you generated it with real randomness. Most self-chosen passphrases are weaker than they feel.

Strength comes down to entropy: a measure of randomness, counted in bits. Each extra bit doubles the number of possible combinations. At 50 bits, that's about a quadrillion combinations. At 77 bits, it's billions of times more.

Entropy only counts if the randomness is real. Words you thought of yourself, song lyrics or quotes, objects you looked at in the room, keyboard mashing, foreign-language words, personal dates and names: none of it counts as random, no matter how unpredictable it feels. All of it follows patterns, and cracking tools are built to exploit exactly those patterns.

If an attacker has your wallet backup, they can run those cracking tools against it:

• Dictionary attacks try common words and phrases from published word lists.
• Leaked password databases replay billions of real passwords stolen in other breaches.
• Pattern-based guessing checks common substitutions (3 for e, @ for a), keyboard patterns, and capitalization habits.
• Targeted guessing tries names, dates, and phrases pulled from what an attacker knows about you.

Pure brute force, trying every character combination, only works up to about 5 to 6 characters. Past that, attackers switch to the methods above. Security researcher Ryan Castellucci proved how effective this is at DEF CON 23, cracking real wallets protected by weak passphrases, including one holding 250 BTC that he tracked down and returned to its owner.

Passphrase strength examples

Each random word adds 12.9 bits of entropy when picked from a list of 7,776 words:

Length alone doesn't guarantee entropy. A word you chose yourself, with a date or a symbol swapped in, still follows a pattern cracking tools check first.

Two ways to generate genuine randomness

• Roll physical dice and pick words from a published list like the EFF Diceware wordlist or the Reinhold Diceware wordlist.
• Use a password manager's built-in generator. Bitwarden, KeePass, and 1Password all use cryptographic randomness on your device.

7. Can I use my passphrase with wallets other than Trezor?

Yes. Passphrases are part of the BIP39 and SLIP39 standards, both created by Trezor and widely adopted across the industry.

The same wallet backup combined with the same passphrase will generate the same wallet and the same addresses in any compatible software. Your funds are secured by open standards, not locked to a single vendor.

If you're using another wallet that supports BIP39 or SLIP39, it almost certainly supports passphrases as well. Look for it in the advanced settings or check the wallet's documentation.

8. What if I lose my Trezor device?

You can restore your wallet on a new Trezor. But you'll need two things: your wallet backup AND the exact passphrase.

The passphrase adds a second requirement beyond your wallet backup for restoring access. If you have both, buy a new Trezor, import your wallet backup, enable the passphrase feature, and enter the same passphrase. You'll see the same wallet with the same funds.

If you have the backup but have lost the passphrase, see question #3.

9. Should I use a passphrase to create a new account?

You don't need a passphrase for that. Trezor Suite and most other wallets let you create multiple accounts within your standard wallet backup. Click + Add account and you'll get a fresh set of addresses.

Creating a separate account is simple, free, and doesn't introduce new risks. If all you need is another Bitcoin or Ethereum account, use the account feature instead.

10. Should I share my passphrase with anyone?

Treat your passphrase like a part of your wallet backup. Anyone who has both can access your funds.

If you're planning for inheritance or want someone to access your crypto in an emergency, share it with a trusted person. Make sure they know what the passphrase is, where the wallet backup is stored, and how to use both together. Consider a written guide stored with the passphrase that explains the steps.

Without this kind of planning, a passphrase-protected wallet becomes permanently inaccessible if something happens to you. This isn't optional for long-term holders.

Conclusion

A passphrase creates a separate wallet tied to your existing wallet backup. It's a powerful security tool for experienced users.

If you choose to use a passphrase: write it down, test it, and store it as carefully as your wallet backup. Consider whether SLIP39 multi-share backup might achieve your goals with fewer risks.