How to Choose a BIP39 Passphrase

What a passphrase is

A passphrase is an extra passcode you add on top of your seed words — a second lock.

There is only one rule:

Same seed words + a different passphrase = a completely different wallet.

That means two things:

1. If you type the wrong passphrase, the wallet won’t complain — it simply opens a new, empty wallet.
2. Lose the passphrase, and you lose the coins.

It’s easier to crack than you think

The BIP39 standard says that deriving private keys from a passphrase uses only 2048 rounds of PBKDF2.

2048 is deliberately small — so that an underpowered hardware wallet can finish the computation in about a second. The price: once an attacker knows / guesses your seed words, testing candidate passphrases is just as cheap. An ordinary graphics card can make tens of thousands of complete guesses per second.

So don’t tell yourself that a somewhat complex passphrase makes a low-entropy seed safe — our main defense is still the seed words.

The seed words are the main lock, the big lock; the passphrase is the auxiliary lock, the small lock.

Note: I hesitated about writing that — strictly speaking it isn’t accurate, since a passphrase can easily be set with far more entropy than the seed words. But I do want to warn the people who think “with a somewhat complex passphrase, I can safely keep serious money on seed words generated by a phone wallet”: high-entropy seed words are our main line of defense.

How we use a passphrase

So the real question is: who are you defending against?

Your seed words were generated with dice and have never touched the internet — brute-forcing them would cost the energy of a universe. The realistic scenarios are:

1. People who visit your home — relatives, friends, roommates, cleaners, repair workers, movers — who catch sight of your backup;
2. The $5 wrench attack — someone coerces you in person to hand over the wallet.

So you’re not fighting a GPU farm — you’re fighting the imagination of people who know you. That changes the design goal:

You don’t need to beat the world’s computing power, only the guesses of people who know you — so the design should lean toward “memorable”.

The popular advice of “6 or more random words” is a configuration for fighting GPU farms. The cost: you can never remember it, so you have to store it somewhere — and storing it is a new risk and burden. The cleaner your seed words (rolled with dice, never online), the more entitled you are to make the passphrase easy to remember.

My advice:

1. Do use a passphrase — and keep no coins under the bare seed words. (After the 2026 Coldcard incident: keeping a small “sentinel” amount under the bare seed words is like hanging a “nothing valuable here” sign on your door — it only tells a hacker there is treasure behind it, and that your passphrase is worth spending real computing power to crack.)
2. Make sure the seed words — your main line of defense — were rolled with dice; then design the passphrase on the principle that you’ll never forget it. You can use a password you already rely on every day, such as an everyday app or bank-card password, as the passphrase — and rehearse a recovery every now and then, because anything left unused for long enough is guaranteed to be forgotten.

Passphrase checklist

• Case-sensitive, and spaces count. Kiwi iron and kiwi iron are two different wallets. During the handover period, copy your notes exactly as written.
• A wrong passphrase won’t error out. One character off and the wallet happily opens a brand-new empty wallet. So when “my balance is gone,” don’t panic — nine times out of ten the passphrase was mistyped. Replay it character by character and try again.
• Store it apart from the seed words. Whoever holds both holds the coins; writing them together is as good as having no second lock.
• Rehearse first, fund later. After setting a passphrase, do a full recovery drill with a small amount: wipe the wallet, restore from memory and your backup, confirm the spelling, and only then move serious funds in.

Plenty of people like to base their passphrase on “initials + birthday”. Please don’t.