01The conclusion first: a seed phrase is roughly the asset
A seed phrase is not a login password, not an account name, and not a recovery credential in the ordinary sense. It is data that derives a private key directly. Whoever obtains it can move everything in that wallet, from any device, without your phone and without a verification code.
People meeting it for the first time tend to file it alongside a bank card PIN. That comparison is wrong, and dangerously so: a leaked PIN still leaves you with the card, an identity, and a branch you can walk into. A leaked seed phrase leaves you nothing, because a chain has no concept of "you" — only of who can produce a valid signature.
A closer comparison: a seed phrase is a key that starts a car with no plates, no registration and no police station to report it to. Whoever finds the key and drives off looks, to the system, exactly like you driving off.
Once that clicks, every recommendation below follows on its own — why not to photograph it, why not to message it to yourself, why no support agent could possibly need it.
02How it relates to keys, public keys and addresses
The seed phrase derives the private key, the private key derives the public key, the public key derives the address. The chain runs one way: every step to the right is computable, and not one of them runs back.
Laid out in order:
| What it is | What it does | Share it? |
|---|---|---|
| Seed phrase 12 or 24 English words | Restores the entire wallet, every account under it | Never |
| Private key a very large random number | Signs transactions — that is, spends what is at that address | Never |
| Public key computed from the private key | Verifies that a signature came from that key | Harmless, but rarely needed |
| Address computed from the public key; what you paste to people | Receives funds; anyone can inspect its balance | Yes, it is public by design |
The hierarchy between phrase and key deserves emphasis: one seed phrase usually corresponds to an entire tree of accounts, spanning many addresses across many chains. So a leaked private key costs you one address, while a leaked seed phrase costs you the wallet.
The derivation itself, and why publishing an address is harmless, are covered in private key, public key, address.
03Why there is no recovery, and why that is not a defect
Because nobody holds your seed phrase. Not the wallet's developers, not the network, not your handset manufacturer. Since nobody knows it, nobody can return it to you.
This gets read as an industry that has not matured. It is the design goal. If some institution could restore your wallet, that institution could also move your assets without your knowledge, or be compelled to hand them over — at which point self-custody exists in name only.
Put differently: "no recovery" and "nobody can freeze your coins" are the same property described from two sides. You do not get to keep one and discard the other. Understanding that is understanding what self-custody actually trades.
If the price sounds too high, that is a perfectly sound conclusion. Who does not need a Web3 wallet is written for exactly that judgement.
04Exposure routes, listed by what you actually do
Seed phrases rarely leak because someone targeted you. They leak because at some moment the phrase was placed somewhere networked. Every item below has happened to a lot of people.
Photographing it
The most common one. Camera rolls sync to the cloud by default, so the photo lands in your cloud account. The security of your seed phrase drops from "a piece of paper only you can see" to "however strong that account's password is" — and that password is, for many people, reused elsewhere.
There is a second layer people miss: plenty of apps request photo library access. Among the utilities, editors and social apps on your phone, how many have you actually checked?
Screenshotting it
Same problem, and screenshots additionally get filed into a dedicated album that is easy to enumerate.
Putting it in cloud notes, storage or saved messages
Notes apps, drives, the "saved" folder in a chat app. These services are designed for convenient sync, not for guarding something directly convertible into money. Breaching them takes far less than a seed phrase warrants.
Typing it with a third-party keyboard
Many keyboards offer cloud sync and vocabulary learning. Whether what you typed left the device depends on switches you have probably never opened.
Sending it to yourself
Your own inbox, your own draft folder, a self-chat. The instinct is "only I can see this." The result is that it now lives inside an account anyone can attempt to log into from anywhere.
Copying and pasting on a computer
The clipboard is shared system-wide and readable by any running program. Some systems also sync the clipboard across devices, which means it went to a server.
Every item above is the same move: you took the phrase from offline to online. You do not need to memorise a list of rules. Ask one question — could this thing be uploaded to some server at a moment I do not see? If the answer is anything other than a firm no, do not use it.
To audit your current arrangement item by item, use the seed backup self-check. For what attackers typically do once they have it, read how wallets actually get drained.
05Anyone or any page asking for it is running a scam
There is exactly one exception: you, in a wallet app whose source you verified, deliberately choosing "restore wallet" and typing it in. Outside of that, it does not matter who is asking or how reasonable it sounds.
Write out the usual scripts and the pattern is obvious — every one of them manufactures a reason to act now:
- "We detected unusual activity on your wallet. Please verify your seed phrase to secure your assets."
- "We are migrating assets for a chain upgrade. Please sync your wallet."
- "You have an unclaimed distribution. Connect and verify your wallet to claim it."
- "This is support — I can see your ticket. Send me the phrase and I will check it from this side."
- "Participation requires verifying wallet ownership first."
Why must all of these be fake? Because no legitimate technical flow requires a seed phrase to leave your device. Proving an address is yours is done by signing a message: the signing happens locally, and neither key nor phrase goes anywhere. Every serious product knows this. So when someone asks, there is only one explanation.
Make "I never type my seed phrase anywhere, except a restore I started myself" a rule you do not reason about. Do not evaluate trustworthiness case by case — the entire craft of the scam goes into making that case look trustworthy.
06How to store it offline
Two goals: keep it away from anything networked, and make sure no single accident destroys the only copy. Handwriting handles the first; two copies in two places handles the second.
- Handwrite it, with the numbering. Wrong order means it will not restore, so the numbers matter as much as the words.
- Read it back word by word against the screen. Handwriting fails by confusing similar words and by skipping one.
- At least two copies, two physical locations. One at home, one somewhere else you control long term. A single copy makes fire and flood into asset risks.
- Think about the environment. Damp, being thrown out as scrap paper, getting lost in a move. A moisture-proof bag and a fixed place solve most of it.
- Do not annotate it with what it is or how much it holds. You will recognise it.
- Think about what happens if you do not come back. If you want this to reach family, there has to be an arrangement they can find and a stranger cannot. If you do not, make sure it will not be thrown away by someone tidying up.
Metal plates suit larger amounts held for years. But they solve exactly one problem — paper degrades — and not the two more common ones: only having one copy, and having let someone see it.
07When you will actually use it
In normal use you will essentially never touch the seed phrase. It comes out for three things: moving devices, reinstalling the app, and restoring the same wallet in different software.
That is useful, because it gives you a very simple test: if you are not doing one of those three things and something is asking for your phrase, something is wrong.
Day-to-day sending, connecting to sites and confirming signatures all run on your local password or biometrics. You can lock the paper away and not look at it for years.
A related question: what if the phone is gone? The answer is in lost your phone — are the coins gone?. The short version is that the coins live on the chain rather than the handset and a seed phrase restores them, which is one more demonstration that the phrase is the thing that matters.