Wallet Backup Formats
BIP39 mnemonic (standard)
12 / 15 / 18 / 21 / 24 words from BIP39 wordlist + optional passphrase. Recoverable into any BIP39-compatible wallet.
Encoding density: 12 words ≈ 132 bits (128 entropy + 4 checksum). Average length: ~70-90 ASCII chars.
SLIP-39 Shamir Backup
Trezor-introduced format using Shamir's Secret Sharing:
- M-of-N share threshold.
- Each share is 20-33 words from a different wordlist (1024 words).
- Can be split into groups (e.g., 2-of-3 family + 2-of-2 board) for hierarchical recovery.
Use case: distributing shares geographically/socially without giving any single party full key access.
Compatibility: Trezor (native), Keystone (partial), most others require BIP39 → SLIP-39 conversion.
Important: SLIP-39 uses a different wordlist than BIP39 — the shares are not BIP39 words.
SeedQR
A QR code encoding of BIP39 mnemonic for hardware wallet interaction.
Format:
- Each word's wordlist index (0-2047) → 4 decimal digits → 4 characters.
- 12 words → 48-char string → QR code.
CompactSeedQR variant: encodes raw entropy bytes directly (more dense, slightly less wallet-compatible).
Use case: airgap signing devices (SeedSigner, Krux) scan a printed SeedQR rather than typing 12 words.
Coldcard's CTL format
words.txt → 24 words newline-separated. Tarot-encoded paper grids
also supported on Coldcard for entry resilience.
A backup of an affected seed is a backup of a compromised seed. Seeds generated on COLDCARD firmware before the July 2026 seed-entropy fix (Mk2 / Mk3 4.0.1-4.1.9; Mk4 / Mk5 Standard < 5.6.0, Edge < 6.6.0X; Q Standard < 1.5.0Q, Edge < 6.6.0QX) have badly reduced entropy. Coinkite's advisory (updated 1 August 2026): "Updating the firmware does not change or repair an existing seed." Remediation is update firmware → generate a new seed → verify that backup → sweep the funds. Re-writing the old words onto a fresh plate is not remediation. Exception per the advisory: a seed mixed with ≥ 50 fair, independent, private dice rolls is not at risk from this bug alone. See ../../hardware/coldcard/SKILL.md.
Plate / metal backups
Stamping seed words into stainless steel / titanium plates protects against fire, water, and light damage.
Vendors:
- Cryptosteel Capsule — letter tiles in steel cylinder.
- Blockplate — stamped grid.
- SeedXOR — XOR-based two-plate scheme (2-of-2).
- Hodlr Plate — center-punch grid.
- Cobo Tablet — stainless steel embossed plates.
Trade-offs:
- Stamped plates: durable but visible; unauthorized observer can read words.
- Tile-based: theft-detect-friendly (one missing tile breaks key).
- XOR plates: unreadable without both halves.
Paper backup hygiene
- Use acid-free paper for >5 year shelf life.
- Avoid thermal printer paper (fades).
- Don't laminate seed-on-paper unless you also want to make it indestructible by fire — laminated paper burns sealed inside its pouch and is harder to destroy intentionally.
- Store in 2+ physical locations — single point of failure.
Threat model considerations
| Threat | Mitigation |
|---|---|
| House fire | metal backup + offsite copy |
| Flood | metal backup + offsite |
| Burglary | hidden / encrypted (passphrase) |
| Coercion | passphrase = "duress" wallet with small balance + BIP85 main wallet |
| Heir access | Shamir 2-of-3 with a lawyer / family member / safety deposit box |
| Inheritance | encrypted instructions revealed on death (Casa Inheritance, dead-man switches) |
Passphrase backup
Passphrase ("25th word") is not included in the BIP39 mnemonic. It must be backed up separately with the same care.
- Store somewhere completely different from the seed.
- Memorize if possible.
- If compromise risk is real, use multi-factor (e.g., split into 2 pieces).
Loss of passphrase = loss of wallet (no protocol-level recovery).
Backup verification
After backup, practice recovery before depositing real funds:
- Erase the wallet.
- Restore from backup (and passphrase, if used).
- Verify the first receiving address matches.
- Optionally: sign a test message and verify with original recorded data.
Many funds are lost not from the seed loss but from a backup that was never tested.
Common pitfalls
- Photo of seed on phone → cloud-synced → exposed.
- Passphrase not backed up → permanent loss.
- Confusing BIP39 ↔ SLIP-39 wordlists during recovery.
- Using a wallet's "backup file" (encrypted blob) without understanding what's inside — wallet-specific format may not be importable elsewhere.
- Single backup location → physical risk.
- Mixed-up passphrase capitalization during recovery → completely different wallet, looks empty.