The Trezor Safe 5 is a $129 touchscreen signer with an EAL6+ secure element, and its default backup is a 20 word SLIP39 share rather than the familiar 12 or 24 word BIP39 phrase. That is a one way choice: SLIP39 cannot be converted back, and a shorter list of wallets can restore it.
Listen to this article, about 14 minutes. A synthetic voice reads the article and announces each section title as it begins; tables are read row by row and the questions at the end are left out.
Recorded 2 October 2026 from the article as published that day. Press a chapter to jump there; the highlighted line is what is playing. A play button sits beside every section heading, and once you scroll past this player a bar at the bottom of the screen keeps the controls in reach. Tap or click any sentence to hear the reading start from there.
On this page: the Trezor Safe 5 price read from the vendor on 2 October 2026, a sourced table of every wallet that can restore a 20 word SLIP39 backup, the SLIP-0039 specification text saying the standard is not compatible with BIP39, what the EAL6+ secure element does and does not hold, and a still open Trezor bug report about a backup word that was written down wrong.
Think you already know this? Five questions, one minute.
Every answer is on this page. Answer from what you know now; the page fills in the rest.
-
1. Trezor lists one price for the Safe 5 on its own product page. What is it?
The Trezor Safe 5 product page listed $129 when read on 2 October 2026, alongside a 1.54 inch 240 by 240 colour touchscreen and an EAL6+ secure element. The $249 figure belongs to the Safe 7. Read the section
-
2. You set up a Safe 5, accept the default 20 word backup, then decide you would rather hold a BIP39 phrase. What does Trezor say you can do?
Trezor’s SLIP39 FAQ says converting SLIP39 wallets back to BIP39 is not possible, and the SLIP-0039 specification states the two standards are not compatible. No legitimate tool ever asks you to type backup words into a website. Read the section
-
3. Your Safe 5 is lost and you are holding a 20 word SLIP39 share. According to Trezor, which of these can read it?
Trezor’s SLIP39 FAQ names Rabby, Electrum, Sparrow, BlueWallet and Wasabi plus the Keystone hardware wallet. A BIP39 only wallet cannot read a SLIP39 share, and the Sparrow 2.0.0 release note describes recovering shares rather than creating them. Read the section
-
4. Where does Trezor say the wallet seed is held on a Safe 5?
Trezor’s secure element page says the OPTIGA Trust M (V3) chip does not store the seed or the PIN. It enforces PIN verification, stores a genuineness certificate, contributes entropy, and holds a secret used with your PIN to encrypt the keys on the main chip. Read the section
-
5. Trezor published an advisory on the Ledger Donjon evaluation of the Safe family. What does it say about the Safe 5?
Trezor’s advisory, reported on 12 November 2024 and read again on 2 October 2026, says the Safe 5 is not affected because it uses a more recent microcontroller designed to be more resilient to similar attacks. The finding concerns Safe 3 supply chain countermeasures. Read the section
Checked on 2 October 2026 against Trezor’s own product page, its backup documentation, the SLIP-0039 specification and its published advisories. Every page ranking for this search earns a commission when you click through, and not one of them answers the question that decides whether you still hold your coins in ten years: if this device stops existing, what can read the words it gave you?
What is the Trezor Safe 5, and what does the price include?
A touchscreen signing device, and the middle of the three Trezor models currently sold. Trezor’s product page, read on 2 October 2026, lists $129 for a 1.54 inch colour touchscreen at 240 by 240 pixels behind Gorilla Glass 3, an NDA free EAL6+ secure element, USB-C, a microSD card slot, haptic feedback, a tamper evident PC-ABS body with anodised aluminium backplates, and 65.9 by 40 by 8 mm at 23 grams. PIN and passphrase are entered on the device itself.
That price is worth fixing in place, because our own guide to what a Trezor protects you from could not reach it earlier this year: it is $129, and the review sites quoting other figures were quoting each other.
Why is the default 20 word backup not a BIP39 seed phrase?
Because Trezor switched standards on the Safe family and most buyers never notice. Trezor’s own single share backup page says the 20 word Single-share Backup is the default on the Safe devices, that it is based on SLIP39, and that it replaces the older 12 word backups from early Trezor models. So the ordinary path through setup hands you something that is not a BIP39 seed phrase at all.
SLIP-0039 is a SatoshiLabs specification, finalised on 18 December 2017. The specification text says it is mainly intended as a replacement for BIP-0039 and that the two are not compatible. Each share is 20 words for a 128 bit secret, or 33 words for 256 bits, and three of those words are a checksum.
The multi share version is Shamir’s secret sharing proper. Trezor’s multi share page puts the range at 1 to 16 shares with a recovery threshold on the Safe 7, Safe 5, Safe 3 and Model T, and says a single share wallet has been upgradeable to multi share since June 2024. The SLIP39 FAQ sets the floor at firmware 2.7.2, and states the part that cannot be softened: lose more shares than your threshold allows and the funds are permanently inaccessible.
The direction of travel matters more than the word count. Trezor’s FAQ says converting a SLIP39 wallet back to BIP39 is not possible, and going the other way, which it advises against, produces a 59 word share with limited passphrase support. This is a door that opens one way, offered as a default rather than as a decision.
Which wallets can restore a 20 word SLIP39 backup?
This is the table the affiliate reviews leave out, and it is the one that matters if Trezor is ever not there to sell you a replacement. Every row is the vendor’s or the project’s own words.
| Where you can restore it | SLIP39 support | Source |
|---|---|---|
| Trezor Safe 7, Safe 5, Safe 3, Model T | Create and restore | Trezor multi share page |
| Electrum | Restore | Trezor SLIP39 FAQ |
| Sparrow | Restore, stated as recovering shares | Sparrow 2.0.0 release note |
| BlueWallet, Rabby, Wasabi | Restore | Trezor SLIP39 FAQ |
| Keystone hardware wallet | Restore | Trezor SLIP39 FAQ |
| OneKey Pro | Added in version 4.15.0, user report | Bitcointalk, 5 September 2025 |
| Any BIP39 only wallet or seed tool | No, and no conversion exists | SLIP-0039, not compatible |
That list is longer than the forums assume, which is the honest finding here rather than the alarming one. It is still far shorter than the list for a BIP39 phrase, which every wallet ever shipped will read. Our review of the Keystone hard wallet covers the one hardware alternative on it. And if your plan was a 24 word phrase on steel, note that SLIP39 draws on a different wordlist, so a metal backup plate stamped for BIP39 may not carry the letters you need. Our Cryptotag Zeus review tests exactly that case: the 20 word share fits its 24 numbered slots, the 33 word multi share does not, and the plate has to say which list the numbers came from.
Which backup format are you actually holding?
Count the words on your backup and count how many lists you have. Nothing else. Every answer below restates Trezor’s own documentation. This tool never asks you to enter a single backup word, it does not run in anybody’s hands but yours, and no legitimate wallet, support agent or firmware update will ever ask you for those words either.
Nothing here is a recommendation to buy, sell or hold anything. Your selection stays in this page and is never sent anywhere.
What does the EAL6+ secure element actually protect?
Not your seed, which is the sentence missing from almost every review of this device. Trezor’s own page on the secure element says the OPTIGA Trust M (V3) chip, certified to Common Criteria EAL6+, does three things: it enforces PIN verification, it stores a certificate proving the device is genuine, and it contributes entropy when the seed is created. The same page states that it does not store the seed or the PIN. It holds a secret combined with your PIN to encrypt the private keys, and those keys sit on the main chip.
That is a real improvement over a device with no secure element, and not the thing people imagine they are buying. The certification covers the chip, not the firmware, not Trezor Suite and not the website you were looking at when you approved a transaction, which is why our guide to the real Trezor website exists.
The microSD slot is the one hardware feature here that genuinely raises the cost of a physical attack. Trezor’s documentation describes microSD card encryption on the Safe 5 and Model T as a 256 bit random value written to a FAT32 card and combined with your PIN before the device can be decrypted, so the card goes in at every unlock. It needs trezorctl 0.11.6 or later, which means a command line, which means most owners will never turn it on.
Was the Trezor Safe 5 affected by the Ledger Donjon finding?
No, and the headlines said otherwise. Trezor’s own advisory, reported on 12 November 2024 and read again on 2 October 2026, says Ledger Donjon reused a known attack to show that some Trezor Safe 3 countermeasures against supply chain attacks can be bypassed. On the Safe 5 it is explicit: not affected, because it uses a more recent microcontroller designed to resist similar attacks.
Several news headlines from March 2025 named both the Safe 3 and the Safe 5, which is how an advisory about one model becomes a search result implying two. The real reading is narrow and still worth taking seriously: this attack class is physical and aimed at devices that passed through somebody else’s hands, so a second hand Safe 5 is a different proposition from a sealed one. According to the Safe 5 FAQ the device runs an authenticity check against Trezor automatically on first connection to Trezor Suite, and that is the one setup step nobody should skip.
What do people who have used Shamir backups actually report?
Very little, and that is the finding. We read six posts in a Bitcointalk thread asking exactly that dated 3 to 27 January 2026, ten posts in a second thread on wallet support from September 2024 to September 2025, and one open bug report in Trezor’s repository. Treat all of it as what people report, not as evidence.
Not one poster said they had created and then recovered one in practice. Cricktor, on 4 January 2026, described experimenting with a browser based tool and was not confident about the Trezor implementation. DeeppRockk, on 26 January 2026, argued against secret sharing altogether and preferred multisignature. gmaxwell opened the thread on 3 January 2026 by linking a critical wiki article rather than an experience. The engaged posters converged on one piece of advice: test the recovery on a clean device before you rely on it.
The wallet support thread cuts the other way and is more useful. dkbit98 listed the compatible wallets on 18 September 2024, SFR10 reported on 5 September 2025 that OneKey Pro had added SLIP39 in version 4.15.0, and Saint-loup asked in October 2024 whether Electrum can generate and split shares rather than only restore them, which nobody there could confirm. So the gap is in creating shares outside a Trezor, not in reading them.
The account that should change your handwriting is in Trezor’s own repository. Issue 1839, opened by Trezor engineer Andrew Kozlik on 7 October 2021 and still open when checked on 2 October 2026, records a user who wrote down guest as quest while copying a Shamir backup. Quest is not in the SLIP-0039 wordlist, so recovery failed. The issue asks for a larger or uppercase font on the backup screen. Use the device’s built in backup check rather than your own eyesight, every time, as our guide to protecting your recovery phrase sets out.
Where does the Safe 5 sit now that the Safe 7 exists?
Below it, and the gap is wider than the price. SatoshiLabs announced the Trezor Safe 7 on 21 October 2025 at $249, with two secure elements rather than one: the TROPIC01, which the announcement describes as transparent and auditable, alongside an NDA free EAL6+ secondary element, plus a 2.5 inch screen, a quantum secure bootloader and a LiFePO4 battery. The backup standards are the same, so a 20 word share made on a Safe 5 reads on a Safe 7 and the reverse holds too.
Transparent cuts both ways, which is the point of it. Ledger Donjon found a laser fault injection route into the TROPIC01 in late January 2026, and Tropic Square then extended it to the chip’s PIN related functions. Trezor’s disclosure, read on 2 October 2026, says the attack reaches neither the PIN, the funds nor the wallet backup, and that no user action is needed. A chip you are allowed to audit is a chip whose flaws get published.
| Trezor Safe 3 | Trezor Safe 5 | Trezor Safe 7 | |
|---|---|---|---|
| Screen | 0.96 in monochrome, two buttons | 1.54 in colour touchscreen | 2.5 in colour touchscreen |
| Secure element | One, OPTIGA Trust M (V3), EAL6+ | One, OPTIGA Trust M (V3), EAL6+ | Two, OPTIGA plus TROPIC01 |
| Default backup | 20 word SLIP39 | 20 word SLIP39 | 20 word SLIP39 |
| Donjon 2024 finding | Affected | Not affected | Not applicable, launched later |
| Price on the vendor site | Not read on this date | $129, read 2 October 2026 | $249 at announcement |
This site does not tell you what to buy. It will say that a review written before 21 October 2025 was reviewing the top of the range and one written after it was not, and that most ranking pages have quietly inherited the earlier framing. Our comparison of Trezor and Ledger covers the choice between the companies instead.
One last line, because it is the only one here that never goes stale: nobody from Trezor, from any wallet, from any exchange, or from any giveaway will ever need your backup words. Not for a firmware update, not for a security check, not for a migration, not for verification. There is no version of that request that is real.
Frequently asked questions
Can I choose a 12 or 24 word BIP39 backup on a Trezor Safe 5?
Yes. Trezor’s product page lists 12, 20 and 24 word backups, and the 12 and 24 word options are BIP39. The 20 word SLIP39 single share is the default the setup flow offers, so choosing BIP39 is a deliberate step rather than the path of least resistance. Trezor’s own FAQ advises against converting an existing wallet between the two standards and suggests creating a new wallet and moving funds instead.
Is a 20 word Trezor backup the same thing as a multi share backup?
No, although both use 20 word shares. A single share backup is one list of 20 words that recovers the wallet on its own. A multi share backup splits the secret into between 1 and 16 shares with a threshold, and since June 2024 a single share wallet can be upgraded to multi share. Both are SLIP39, and the word academic appearing twice in a share is how Trezor’s FAQ says you identify a single share configuration.
What happens if I lose one share of a multi share backup?
It depends entirely on the threshold you set. If your threshold is two of three, losing one share is survivable and the sensible response is to replace it. Trezor’s SLIP39 FAQ states plainly that losing more shares than the threshold allows makes recovery impossible and the funds permanently inaccessible. There is no vendor reset, no support ticket and no appeal for this, which is the whole point of self custody.
Do duplicate words in a 20 word backup mean something went wrong?
No. SLIP39 shares are generated from a wordlist and a repeat somewhere in 20 words is ordinary probability rather than a fault. The SLIP-0039 specification allocates three of the words to a checksum, so the device itself can tell you whether what you wrote down is valid. Use the built in backup check on the device to confirm it instead of judging the list by eye.
Does the Trezor Safe 5 need a microSD card to work?
No. The slot supports an optional feature, microSD card encryption, which Trezor documents for the Safe 5 and the Model T. It writes a 256 bit secret to a FAT32 card that must then be combined with your PIN at every unlock. It requires trezorctl version 0.11.6 or later, so it is a command line feature rather than a setting in the app, and the device works normally with nothing in the slot.
Is a second hand Trezor Safe 5 a security problem?
The Ledger Donjon work Trezor published in November 2024 concerns physical supply chain attacks, the kind that need a device to have passed through somebody else’s hands, and the advisory says the Safe 5 is not affected by that specific attack because of its newer microcontroller. A sealed device from the vendor still removes the whole class of risk. Whatever the source, a Safe 5 runs an authenticity check against Trezor when first connected, so run it and read the result before any coins move.
Finished the page? The same five questions from the top, to see what stuck.
This article is educational and is not financial advice. Nothing here is a recommendation to buy, sell or hold anything. Speak to a suitably qualified professional about your own situation, and remember that you are responsible for your own security decisions.
Leave a Reply