Write, don't screenshot
Phones sync photos to clouds; clouds get phished. Paper or stamped steel, stored in two locations, beats every digital copy.
The entropy vault
Each glowing tile is one seed word — one of 2,048 possibilities (2¹¹ each). Switch between 12 and 24 words, then crank the attacker's guessing speed and watch how long a brute-force takes. Drag to orbit.
Drag to rotate · wheel/pinch to zoom
128 bitsEntropy
2¹²⁸ ≈ 3.4×10³⁸Possible seeds
…
What actually happens when you "recover"
Entropy → words
Your wallet generates 128 or 256 random bits, adds a checksum, and maps every 11 bits to a word from the fixed BIP-39 list of 2048 words.
Words → master key
The phrase is stretched (PBKDF2, 2048 rounds of HMAC-SHA512) into a 512-bit seed, which derives a master private key.
One key → every address
Hierarchical derivation (BIP-32/44) generates all your addresses from that one master key. That's why one phrase restores an entire wallet.
Recovery = re-derivation
"Recovering" a wallet just replays this math on a new device. Nothing is stored on a server; the words are the wallet.
The uncomfortable corollary
Anyone who has your words has your money — instantly, irreversibly
- "Recovery services" that ask you to type or scan your seed phrase are the single most common crypto theft vector. Legitimate software never needs your existing phrase sent anywhere.
- "Scan → review → recover" is safe ONLY if the scanning happens locally for lost-wallet-file forensics — never for seed phrases entered into a website or chat.
- Real recovery options for forgotten phrases: partial-phrase brute-forcing on an OFFLINE machine (tools like open-source BTCRecover), professional firms that work under contract on hardware you ship — never upfront-fee strangers in DMs.
- The "$5 wrench attack" reminder: physical backups (steel plates, split storage) protect against fire and flood; telling people you hold crypto protects against nothing.
The 4 habits that make recovery boring
Test the restore
Before funding a wallet seriously, wipe the device and restore from your written phrase once. A backup you've never tested is a hope, not a backup.
Consider a passphrase
An optional 25th word (BIP-39 passphrase) creates a hidden wallet — even someone holding your 24 words finds only a decoy. Forgetting it, however, is unrecoverable by design.
Know your threat model
For most people the realistic risks are (1) losing the phrase and (2) typing it into a scam site — not brute force. The math above shows why: attackers go around the vault, never through it.