{"id":654,"date":"2026-10-18T09:23:17","date_gmt":"2026-10-18T09:23:17","guid":{"rendered":"https:\/\/getbitcoin.guide\/articles\/?p=654"},"modified":"2026-10-20T09:30:23","modified_gmt":"2026-10-20T09:30:23","slug":"wallet-passphrase","status":"publish","type":"post","link":"https:\/\/getbitcoin.guide\/articles\/wallet-passphrase\/","title":{"rendered":"Wallet Passphrase: How Five Devices Handle the 25th Word"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>A wallet passphrase is an extra word or phrase you choose that combines with your 12 or 24 recovery words to open a separate wallet. No device can tell you it is wrong: a typo quietly opens a different, empty wallet. Lose it, and the recovery words alone will never bring those coins back.<\/strong><\/p>\n\n\n\n<div class=\"msq-audio\" data-article=\"wallet-passphrase\" data-minutes=\"12\">\n<style>.msq-audio{margin:1.25em 0 1.75em;padding:16px 18px;background:#EEF3F8;border:1px solid #CBD8E6;border-radius:12px}\n.msq-audio-lead{margin:0 0 8px;font-size:.95em}.msq-audio audio{width:100%;margin:0 0 12px;display:block}\n.msq-toc-title{margin:0 0 6px;font-weight:700}.msq-toc ol{margin:0;padding:0;list-style:none}\n.msq-toc li{display:flex;gap:10px;align-items:center;padding:6px 6px;border-bottom:1px solid #CBD8E6;border-radius:8px}\n.msq-toc li:last-child{border-bottom:0}.msq-toc li.is-active{background:#fff}\n.msq-toc-play{flex:0 0 auto;width:30px;height:30px;border-radius:50%;border:0;background:#1F4E79;color:#fff;font:inherit;font-size:.72em;line-height:30px;padding:0;cursor:pointer}\n.msq-toc-play.is-playing{background:#B4531A}\n.msq-toc-time{flex:0 0 auto;min-width:3.1em;font-variant-numeric:tabular-nums;color:#4A5560;font-size:.9em}\n.msq-toc a{color:#1B1F24;text-decoration:none;line-height:1.35}.msq-toc li.is-active a{font-weight:700;color:#1F4E79}\n.msq-audio-note{margin:10px 0 0;font-size:.82em;color:#4A5560}\nh2.wp-block-heading[id]{scroll-margin-top:24px}\n.msq-hplay{display:inline-block;vertical-align:middle;width:26px;height:26px;margin:0 0 0 10px;border-radius:50%;border:0;background:#1F4E79;cursor:pointer;padding:0;position:relative;top:-2px}\n.msq-hplay::before{content:'\u25b6\ufe0e';display:block;color:#fff;font-size:11px;line-height:26px;text-align:center}\n.msq-hplay.is-playing{background:#B4531A}.msq-hplay.is-playing::before{content:'\u2016';font-size:13px;font-weight:700}\n.msq-bar{position:fixed;left:0;right:0;bottom:0;z-index:9000;display:flex;align-items:center;gap:10px;padding:8px 12px;padding-bottom:calc(8px + env(safe-area-inset-bottom));background:#FFFFFF;border-top:1px solid #CBD8E6;box-shadow:0 -4px 16px rgba(0,0,0,.08);font-size:.92em;color:#1B1F24;transition:transform .2s ease}\n.msq-bar.is-hidden{transform:translateY(130%)}\n.msq-bar-play{display:inline-flex;align-items:center;gap:8px;border:0;border-radius:999px;background:#1F4E79;color:#fff;font:inherit;font-weight:700;padding:8px 14px 8px 12px;cursor:pointer;white-space:nowrap}\n.msq-bar-play.is-playing{background:#B4531A}\n.msq-bar-icon::before{content:'\u25b6\ufe0e';font-size:12px}.msq-bar-play.is-playing .msq-bar-icon::before{content:'\u2016';font-size:14px;font-weight:700}\n.msq-bar-chapter{flex:1 1 auto;min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}\n.msq-bar-time{flex:0 0 auto;font-variant-numeric:tabular-nums;color:#4A5560;font-size:.9em}\n.msq-bar-rate,.msq-bar-close{flex:0 0 auto;border:1px solid #CBD8E6;background:#fff;color:#1B1F24;font:inherit;font-size:.85em;line-height:1;border-radius:8px;padding:7px 9px;cursor:pointer}\n.msq-bar-close::before{content:'\u2715'}\n.msq-bar.msq-bar-pill{left:auto;right:14px;bottom:14px;padding:6px;padding-bottom:6px;border:1px solid #CBD8E6;border-radius:999px;box-shadow:0 6px 20px rgba(0,0,0,.15)}\n.msq-bar.msq-bar-pill .msq-bar-chapter,.msq-bar.msq-bar-pill .msq-bar-time,.msq-bar.msq-bar-pill .msq-bar-rate{display:none}\nbody.msq-has-bar{padding-bottom:76px}\n@media (max-width:600px){.msq-bar-time{display:none}.msq-bar{gap:8px;padding-left:10px;padding-right:10px}}\n.msq-s.msq-now{background:#EEF3F8;box-shadow:0 2px 0 #1F4E79;border-radius:2px}\ntr.msq-now td,tr.msq-now th{background:#EEF3F8;box-shadow:inset 0 -2px 0 #1F4E79}\n@media (hover:hover){.msq-s,tr[data-i]{cursor:pointer}.msq-s:hover{background:#EEF3F8}}<\/style>\n<script type=\"application\/ld+json\">{\"@context\":\"https:\/\/schema.org\",\"@type\":\"AudioObject\",\"@id\":\"https:\/\/getbitcoin.guide\/articles\/wallet-passphrase\/#audio\",\"name\":\"Wallet Passphrase: How Five Devices Handle the 25th Word, read aloud\",\"description\":\"Synthetic voice reading of the article, recorded 18 October 2026.\",\"contentUrl\":\"https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/wallet-passphrase-audio-202610181457.mp3\",\"encodingFormat\":\"audio\/mpeg\",\"duration\":\"PT11M44S\",\"uploadDate\":\"2026-10-18\",\"inLanguage\":\"en-GB\",\"isAccessibleForFree\":true,\"mainEntityOfPage\":\"https:\/\/getbitcoin.guide\/articles\/wallet-passphrase\/\",\"hasPart\":[{\"@type\":\"Clip\",\"name\":\"Wallet Passphrase: How Five Devices Handle the 25th Word\",\"startOffset\":0,\"endOffset\":61},{\"@type\":\"Clip\",\"name\":\"What does a wallet passphrase actually do?\",\"startOffset\":61,\"endOffset\":108,\"url\":\"https:\/\/getbitcoin.guide\/articles\/wallet-passphrase\/#what-does-a-wallet-passphrase-actually-do\"},{\"@type\":\"Clip\",\"name\":\"How do Trezor, Ledger, Coldcard, Jade and KeepKey handle a passphrase?\",\"startOffset\":108,\"endOffset\":295,\"url\":\"https:\/\/getbitcoin.guide\/articles\/wallet-passphrase\/#how-do-trezor-ledger-coldcard-jade-and-keepkey-handle-a-pass\"},{\"@type\":\"Clip\",\"name\":\"Why does a wrong passphrase open an empty wallet instead of an error?\",\"startOffset\":295,\"endOffset\":347,\"url\":\"https:\/\/getbitcoin.guide\/articles\/wallet-passphrase\/#why-does-a-wrong-passphrase-open-an-empty-wallet-instead-of\"},{\"@type\":\"Clip\",\"name\":\"What do people who use a passphrase actually report?\",\"startOffset\":347,\"endOffset\":486,\"url\":\"https:\/\/getbitcoin.guide\/articles\/wallet-passphrase\/#what-do-people-who-use-a-passphrase-actually-report\"},{\"@type\":\"Clip\",\"name\":\"Does a passphrase protect against a tampered device or a weak seed?\",\"startOffset\":486,\"endOffset\":576,\"url\":\"https:\/\/getbitcoin.guide\/articles\/wallet-passphrase\/#does-a-passphrase-protect-against-a-tampered-device-or-a-wea\"},{\"@type\":\"Clip\",\"name\":\"How do you test a passphrase before trusting it with real money?\",\"startOffset\":576,\"endOffset\":648,\"url\":\"https:\/\/getbitcoin.guide\/articles\/wallet-passphrase\/#how-do-you-test-a-passphrase-before-trusting-it-with-real-mo\"},{\"@type\":\"Clip\",\"name\":\"Where should the passphrase backup live?\",\"startOffset\":648,\"endOffset\":704,\"url\":\"https:\/\/getbitcoin.guide\/articles\/wallet-passphrase\/#where-should-the-passphrase-backup-live\"}],\"contentSize\":\"4.9 MB\"}<\/script>\n<p class=\"msq-audio-lead\"><strong>Listen to this article<\/strong>, about 12 minutes. A synthetic voice reads the article and announces each section title as it begins; tables are read row by row and the questions at the end are left out.<\/p>\n<audio class=\"msq-audio-player\" controls preload=\"metadata\" src=\"https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/wallet-passphrase-audio-202610181457.mp3\"><\/audio>\n<nav class=\"msq-toc\" aria-label=\"In this article\"><p class=\"msq-toc-title\">In this article<\/p>\n<ol>\n<li data-start=\"0.0\"><button type=\"button\" class=\"msq-toc-play\" data-start=\"0.0\" aria-label=\"Play from: Wallet Passphrase: How Five Devices Handle the 25th Word\">&#x25B6;&#xFE0E;<\/button><span class=\"msq-toc-time\">0:00<\/span><a href=\"#top\">Wallet Passphrase: How Five Devices Handle the 25th Word<\/a><\/li>\n<li data-start=\"60.74\"><button type=\"button\" class=\"msq-toc-play\" data-start=\"60.74\" aria-label=\"Play from: What does a wallet passphrase actually do?\">&#x25B6;&#xFE0E;<\/button><span class=\"msq-toc-time\">1:01<\/span><a href=\"#what-does-a-wallet-passphrase-actually-do\">What does a wallet passphrase actually do?<\/a><\/li>\n<li data-start=\"107.96\"><button type=\"button\" class=\"msq-toc-play\" data-start=\"107.96\" aria-label=\"Play from: How do Trezor, Ledger, Coldcard, Jade and KeepKey handle a passphrase?\">&#x25B6;&#xFE0E;<\/button><span class=\"msq-toc-time\">1:48<\/span><a href=\"#how-do-trezor-ledger-coldcard-jade-and-keepkey-handle-a-pass\">How do Trezor, Ledger, Coldcard, Jade and KeepKey handle a passphrase?<\/a><\/li>\n<li data-start=\"295.38\"><button type=\"button\" class=\"msq-toc-play\" data-start=\"295.38\" aria-label=\"Play from: Why does a wrong passphrase open an empty wallet instead of an error?\">&#x25B6;&#xFE0E;<\/button><span class=\"msq-toc-time\">4:55<\/span><a href=\"#why-does-a-wrong-passphrase-open-an-empty-wallet-instead-of\">Why does a wrong passphrase open an empty wallet instead of an error?<\/a><\/li>\n<li data-start=\"346.64\"><button type=\"button\" class=\"msq-toc-play\" data-start=\"346.64\" aria-label=\"Play from: What do people who use a passphrase actually report?\">&#x25B6;&#xFE0E;<\/button><span class=\"msq-toc-time\">5:47<\/span><a href=\"#what-do-people-who-use-a-passphrase-actually-report\">What do people who use a passphrase actually report?<\/a><\/li>\n<li data-start=\"486.42\"><button type=\"button\" class=\"msq-toc-play\" data-start=\"486.42\" aria-label=\"Play from: Does a passphrase protect against a tampered device or a weak seed?\">&#x25B6;&#xFE0E;<\/button><span class=\"msq-toc-time\">8:06<\/span><a href=\"#does-a-passphrase-protect-against-a-tampered-device-or-a-wea\">Does a passphrase protect against a tampered device or a weak seed?<\/a><\/li>\n<li data-start=\"575.64\"><button type=\"button\" class=\"msq-toc-play\" data-start=\"575.64\" aria-label=\"Play from: How do you test a passphrase before trusting it with real money?\">&#x25B6;&#xFE0E;<\/button><span class=\"msq-toc-time\">9:36<\/span><a href=\"#how-do-you-test-a-passphrase-before-trusting-it-with-real-mo\">How do you test a passphrase before trusting it with real money?<\/a><\/li>\n<li data-start=\"647.9\"><button type=\"button\" class=\"msq-toc-play\" data-start=\"647.9\" aria-label=\"Play from: Where should the passphrase backup live?\">&#x25B6;&#xFE0E;<\/button><span class=\"msq-toc-time\">10:48<\/span><a href=\"#where-should-the-passphrase-backup-live\">Where should the passphrase backup live?<\/a><\/li>\n<\/ol><\/nav>\n<p class=\"msq-audio-note\">Recorded 18 October 2026 from the article as published that day. Press a chapter to jump there; the highlighted line is what is playing. A play button sits beside every section heading, and once you scroll past this player a bar at the bottom of the screen keeps the controls in reach. Tap or click any sentence to hear the reading start from there.<\/p>\n<script>var MSQ_SENT = [[0.0,\"h\",\"walletpassphrasehowfived\",47],[4.4,\"p\",\"awalletpassphraseisanext\",107],[11.92,\"p\",\"nodevicecantellyouitiswr\",65],[17.24,\"p\",\"loseitandtherecoveryword\",58],[21.4,\"p\",\"onthispageafivedevicetab\",183],[37.44,\"p\",\"mostpagesonthissubjectwe\",130],[45.84,\"p\",\"thewaypeopleactuallylose\",50],[50.08,\"p\",\"theytypeitslightlydiffer\",54],[53.64,\"p\",\"sothispagereadswhatfived\",72],[60.74,\"h\",\"whatdoesawalletpassphras\",35],[63.54,\"p\",\"therulescomefrombip39the\",58],[68.34,\"p\",\"yourwordsandyourpassphra\",87],[74.62,\"p\",\"changeonecharacterofthep\",66],[79.26,\"p\",\"thestandardsaysitplainly\",99],[86.66,\"p\",\"thatonedesignchoiceexpla\",51],[90.54,\"p\",\"thereisnothingtocheckapa\",70],[95.94,\"p\",\"theblankpassphraseopensy\",41],[98.94,\"p\",\"everyotherstringincludin\",76],[104.02,\"p\",\"thatisthehiddenwalletand\",39],[107.96,\"h\",\"howdotrezorledgercoldcar\",56],[112.96,\"p\",\"theideaisshared\",15],[115.28,\"p\",\"thedetailsarenotandthede\",95],[122.64,\"p\",\"everyrowbelowwasreadfrom\",64],[128.56,\"t\",\"trezor\",212],[153.2,\"t\",\"ledger\",193],[174.56,\"t\",\"coldcard\",257],[200.08,\"t\",\"blockstreamjade\",186],[217.24,\"t\",\"keepkey\",179],[234.0,\"p\",\"threedifferencesmattermo\",38],[236.36,\"p\",\"firstledgeristheonlyoneo\",90],[242.92,\"p\",\"thatremovestyposfromdail\",171],[254.12,\"p\",\"secondthefingerprint\",20],[256.8,\"p\",\"coldcardsdocumentationsa\",136],[266.2,\"p\",\"jadedoesthesameinthecorn\",37],[268.56,\"p\",\"afingerprintistheonlyhon\",100],[275.44,\"p\",\"ourblockstreamjadereview\",49],[279.2,\"p\",\"thirdwherethetypinghappe\",26],[281.2,\"p\",\"keepkeyhasasinglebuttona\",88],[287.72,\"p\",\"trezorletsyouchoose\",19],[290.08,\"p\",\"thatchoicebecamealivearg\",60],[295.38,\"h\",\"whydoesawrongpassphraseo\",56],[299.34,\"p\",\"becausethereisnostoredan\",44],[302.46,\"p\",\"keepkeysdocumentationsay\",228],[320.82,\"p\",\"yourcoinsarenotgonewhent\",34],[323.06,\"p\",\"theyaresittinginthewalle\",48],[326.3,\"p\",\"buteverydifferencecounts\",65],[332.34,\"p\",\"acurlyapostropheandastra\",99],[338.74,\"p\",\"coldcardacceptsasciionly\",59],[343.02,\"p\",\"ontheotherdevicesitisyou\",32],[346.64,\"h\",\"whatdopeoplewhouseapassp\",43],[349.84,\"p\",\"wereadfivepublicthreadsf\",114],[360.28,\"p\",\"thesearewhatpeoplereport\",69],[365.12,\"p\",\"inanovember2025rtrezorth\",208],[380.72,\"p\",\"atrezorsupportaccountsai\",129],[389.48,\"p\",\"otherspointedattyposandc\",39],[392.88,\"p\",\"inajune2026threadanowner\",148],[404.16,\"p\",\"therepliesrangedfromamis\",56],[409.0,\"p\",\"asreadon18october2026the\",48],[413.76,\"p\",\"inaseptember2026threadan\",90],[420.64,\"p\",\"therepliesagreedononepoi\",60],[425.96,\"p\",\"theonlyrouteanyoneoffere\",86],[431.4,\"p\",\"twooctober2026threadscam\",54],[435.72,\"p\",\"oneonrledgerwalletargued\",106],[443.0,\"p\",\"itsopeningpostclaimedthe\",112],[452.12,\"p\",\"theotheronrtrezoraskedtr\",158],[464.16,\"p\",\"wheretheaccountsagreewit\",113],[471.12,\"p\",\"wheretheygofurthertwoown\",156],[481.36,\"p\",\"thefingerprintcheckinthe\",68],[486.42,\"h\",\"doesapassphraseprotectag\",55],[490.5,\"p\",\"sometimesandthelimitsare\",43],[493.94,\"p\",\"inastatementdated15octob\",237],[511.18,\"p\",\"thestatementdoesnotmenti\",42],[514.34,\"p\",\"ourledgerdevicecompariso\",55],[518.18,\"p\",\"hereisthereasoningoursan\",35],[520.74,\"p\",\"apassphrasetypedonadevic\",101],[527.02,\"p\",\"typingitonacomputermoves\",83],[532.62,\"p\",\"neitherchoiceissafeagain\",36],[535.14,\"p\",\"thatisthetradetheoctober\",47],[538.98,\"p\",\"coldcardownersfaceadiffe\",48],[541.62,\"p\",\"coinkitessecuritystatusp\",304],[569.82,\"p\",\"ourcoldcardmk3seedflawex\",60],[575.64,\"h\",\"howdoyoutestapassphraseb\",52],[579.0,\"p\",\"ofthemakerswhosepagesadd\",102],[586.08,\"p\",\"keepkeysversionistheligh\",97],[595.16,\"p\",\"dothatfirst\",11],[596.84,\"p\",\"itcatchesapassphraseyout\",61],[600.68,\"p\",\"thefulltestgoesonestepfu\",67],[605.28,\"p\",\"doitoncewhilethewalletho\",47],[608.8,\"p\",\"1openthepassphrasewallet\",241],[633.56,\"p\",\"nevertypeeitherintoacomp\",109],[643.4,\"p\",\"ifanythingdiffersstopand\",50],[647.9,\"h\",\"whereshouldthepassphrase\",34],[650.26,\"p\",\"notwiththerecoverywords\",23],[652.42,\"p\",\"keepkeysownblogsaysthati\",146],[662.38,\"p\",\"trezorsguideaddsthatpass\",130],[671.62,\"p\",\"thepatternthatfollowsfro\",154],[683.34,\"p\",\"ourguidetothewayspeoplea\",68],[688.38,\"p\",\"forthedevicesthemselvess\",78],[693.66,\"p\",\"trezoritselfcallsthepass\",129]];\n(function(){\n  function init(){\n  var root = document.querySelector('.msq-audio'); if (!root) { return; }\n  var audio = root.querySelector('audio'), items = Array.prototype.slice.call(root.querySelectorAll('.msq-toc li'));\n  var starts = items.map(function(li){ return parseFloat(li.getAttribute('data-start')) || 0; });\n  var names = items.map(function(li){ return li.querySelector('a').textContent; });\n  var anchors = items.map(function(li){ var h = li.querySelector('a').getAttribute('href') || ''; return (h.charAt(0) === '#' && h !== '#top') ? document.getElementById(h.slice(1)) : null; });\n  var article = root.getAttribute('data-article') || location.pathname, minutes = root.getAttribute('data-minutes') || '';\n  var marks = {}, started = false, pausedAt = -1, closed = false, ended = false;\n  var RATES = [1, 1.25, 1.5], rate = 1;\n  try { var saved = parseFloat(localStorage.getItem('msq-audio-rate')); if (RATES.indexOf(saved) >= 0) { rate = saved; } } catch (e) {}\n  audio.playbackRate = rate;\n  function track(name, extra){ try { if (typeof gtag === 'function') { var p = { article: article }; for (var k in extra) { p[k] = extra[k]; } gtag('event', name, p); } } catch (e) {} }\n  function current(){ var t = audio.currentTime, idx = 0; for (var i = 0; starts.length > i; i += 1) { if (t + 0.25 >= starts[i]) { idx = i; } } return idx; }\n  function onScreen(){\n    var line = window.innerHeight \/ 3, idx = 0;\n    for (var i = 0; anchors.length > i; i += 1) { var el = anchors[i]; if (el && line >= el.getBoundingClientRect().top) { idx = i; } }\n    return idx;\n  }\n  function fmt(s){ s = Math.max(0, Math.round(s || 0)); var m = Math.floor(s \/ 60), r = s % 60; return m + ':' + (10 > r ? '0' : '') + r; }\n  function play(from, source){\n    if (from !== null) { audio.currentTime = from; }\n    var p = audio.play(); if (p && p.catch) { p.catch(function(){}); }\n    track(from === null ? 'audio_resume' : 'audio_chapter', { chapter: names[current()], start: Math.round(audio.currentTime), source: source });\n  }\n  var hbtns = anchors.map(function(el, i){\n    if (!el) { return null; }\n    var b = document.createElement('button'); b.type = 'button'; b.className = 'msq-hplay'; b.setAttribute('aria-label', 'Play this section: ' + names[i]);\n    b.addEventListener('click', function(){\n      if (!audio.paused && current() === i) { audio.pause(); track('audio_pause', { source: 'heading' }); return; }\n      play(starts[i], 'heading');\n    });\n    el.appendChild(b); return b;\n  });\n  var bar = document.createElement('div'); bar.className = 'msq-bar msq-bar-pill is-hidden'; bar.setAttribute('role', 'region'); bar.setAttribute('aria-label', 'Audio player');\n  var playBtn = document.createElement('button'); playBtn.type = 'button'; playBtn.className = 'msq-bar-play';\n  var icon = document.createElement('span'); icon.className = 'msq-bar-icon'; icon.setAttribute('aria-hidden', 'true');\n  var label = document.createElement('span'); label.className = 'msq-bar-label';\n  playBtn.appendChild(icon); playBtn.appendChild(label);\n  var chap = document.createElement('span'); chap.className = 'msq-bar-chapter';\n  var clock = document.createElement('span'); clock.className = 'msq-bar-time';\n  var rateBtn = document.createElement('button'); rateBtn.type = 'button'; rateBtn.className = 'msq-bar-rate'; rateBtn.setAttribute('aria-label', 'Playback speed');\n  var closeBtn = document.createElement('button'); closeBtn.type = 'button'; closeBtn.className = 'msq-bar-close'; closeBtn.setAttribute('aria-label', 'Close the audio bar');\n  bar.appendChild(playBtn); bar.appendChild(chap); bar.appendChild(clock); bar.appendChild(rateBtn); bar.appendChild(closeBtn);\n  document.body.appendChild(bar);\n  function showRate(){ rateBtn.textContent = (rate === 1 ? '1' : String(rate)) + 'x'; }\n  showRate();\n  rateBtn.addEventListener('click', function(){\n    rate = RATES[(RATES.indexOf(rate) + 1) % RATES.length]; audio.playbackRate = rate; showRate();\n    try { localStorage.setItem('msq-audio-rate', String(rate)); } catch (e) {}\n    track('audio_rate', { rate: rate });\n  });\n  closeBtn.addEventListener('click', function(){\n    closed = true; if (!audio.paused) { audio.pause(); } paint(); track('audio_bar_close', {});\n  });\n  function mode(){\n    if (!audio.paused) { return 'pause'; }\n    if (ended) { return 'again'; }\n    if (!started) { return 'listen'; }\n    return (pausedAt === onScreen()) ? 'resume' : 'section';\n  }\n  playBtn.addEventListener('click', function(){\n    var m = mode();\n    if (m === 'pause') { audio.pause(); track('audio_pause', { source: 'bar' }); return; }\n    if (m === 'again') { ended = false; play(0, 'bar'); return; }\n    if (m === 'resume') { play(null, 'bar'); return; }\n    play(starts[onScreen()], 'bar');\n  });\n  function paint(){\n    var idx = current(), playing = !audio.paused, m = mode();\n    items.forEach(function(li, i){\n      var on = (i === idx) && playing, b = li.querySelector('.msq-toc-play'), a = li.querySelector('a');\n      li.classList.toggle('is-active', on); b.classList.toggle('is-playing', on);\n      b.textContent = on ? '\u2016' : '\u25b6\ufe0e';\n      b.setAttribute('aria-label', (on ? 'Pause: ' : 'Play from: ') + a.textContent);\n    });\n    hbtns.forEach(function(b, i){ if (b) { var on = (i === idx) && playing; b.classList.toggle('is-playing', on); b.setAttribute('aria-label', (on ? 'Pause this section: ' : 'Play this section: ') + names[i]); } });\n    playBtn.classList.toggle('is-playing', playing);\n    label.textContent = m === 'pause' ? 'Pause' : m === 'again' ? 'Play again' : m === 'resume' ? 'Resume' : m === 'section' ? 'Play this section' : 'Listen, ' + minutes + ' min';\n    playBtn.setAttribute('aria-label', label.textContent);\n    chap.textContent = started ? names[(playing || m === 'resume') ? idx : onScreen()] : '';\n    clock.textContent = started ? fmt(audio.currentTime) + ' \/ ' + fmt(audio.duration) : '';\n    bar.classList.toggle('msq-bar-pill', !started);\n    var show = !closed && (started || 0 > root.getBoundingClientRect().bottom);\n    bar.classList.toggle('is-hidden', !show);\n    document.body.classList.toggle('msq-has-bar', show);\n  }\n  root.addEventListener('click', function(e){\n    var b = e.target.closest ? e.target.closest('.msq-toc-play') : null; if (!b) { return; }\n    var li = b.parentNode, s = parseFloat(b.getAttribute('data-start')) || 0;\n    if (!audio.paused && current() === items.indexOf(li)) { audio.pause(); track('audio_pause', { source: 'index' }); return; }\n    play(s, 'index');\n  });\n  audio.addEventListener('play', function(){ ended = false; closed = false; if (!started) { started = true; track('audio_play', { minutes: Math.round((audio.duration || 0) \/ 60) }); } paint(); });\n  audio.addEventListener('pause', function(){ pausedAt = current(); paint(); });\n  audio.addEventListener('timeupdate', function(){\n    paint();\n    if (audio.duration > 0) {\n      var pct = Math.floor(audio.currentTime \/ audio.duration * 100);\n      [25, 50, 75].forEach(function(m){ if (pct >= m && !marks[m]) { marks[m] = true; track('audio_progress', { percent: m }); } });\n    }\n  });\n  audio.addEventListener('ended', function(){ ended = true; track('audio_complete', {}); paint(); });\n  var ticking = false;\n  function onScroll(){ if (ticking) { return; } ticking = true; setTimeout(function(){ ticking = false; paint(); }, 80); }\n  window.addEventListener('scroll', onScroll, { passive: true }); window.addEventListener('resize', onScroll);\n  paint();\n  }\n  if (document.readyState === 'loading') { document.addEventListener('DOMContentLoaded', init); } else { init(); }\n})();\n\n(function(){\n  function start(){\n    var root = document.querySelector('.msq-audio'), audio = root ? root.querySelector('audio') : null;\n    var map = (typeof MSQ_SENT !== 'undefined') ? MSQ_SENT : [];\n    if (!root || !audio || !map.length) { return; }\n    var scope = root.closest('main') || root.closest('article') || root.closest('.entry-content') || document.body;\n    var SKIP = '.msq-audio,.msq,.msq-tool,.msq-end,.msq-bar,script,style,noscript,figcaption,#rank-math-faq,.rank-math-block,nav,header,footer';\n    function norm(s){ return s.toLowerCase().replace(\/[^a-z0-9]+\/g, ''); }\n    var nodes = [], stream = '', walker = document.createTreeWalker(scope, NodeFilter.SHOW_TEXT, null), n;\n    while ((n = walker.nextNode())) {\n      var el = n.parentElement; if (!el || el.closest(SKIP)) { continue; }\n      var raw = n.nodeValue, keep = [], norms = '';\n      for (var i = 0; raw.length > i; i += 1) { var c = raw.charAt(i).toLowerCase(); if (\/[a-z0-9]\/.test(c)) { keep.push(i); norms += c; } }\n      if (!norms) { continue; }\n      nodes.push({ node: n, a: stream.length, b: stream.length + norms.length, keep: keep });\n      stream += norms;\n    }\n    var segs = [], cursor = 0, lastRow = null;\n    map.forEach(function(m, idx){\n      var kind = m[1], f = m[2], len = m[3];\n      if (kind === 't') {\n        var rows = scope.querySelectorAll('tr'), after = !lastRow;\n        for (var r = 0; rows.length > r; r += 1) {\n          var tr = rows[r];\n          if (!after) { if (tr === lastRow) { after = true; } continue; }\n          var cell = tr.querySelector('td,th');\n          if (cell && norm(cell.textContent).indexOf(f) === 0) { tr.setAttribute('data-i', idx); lastRow = tr; break; }\n        }\n        return;\n      }\n      var p = stream.indexOf(f, cursor); if (0 > p) { return; }\n      segs.push({ i: idx, a: p, b: Math.min(p + len, stream.length) }); cursor = p + len;\n    });\n    var si = 0;\n    nodes.forEach(function(nd){\n      var frag = document.createDocumentFragment(), raw = nd.node.nodeValue, rawPos = 0, any = false;\n      for (var k = si; segs.length > k; k += 1) {\n        var sg = segs[k]; if (sg.a >= nd.b) { break; } if (nd.a >= sg.b) { continue; }\n        var s = Math.max(sg.a, nd.a), e = Math.min(sg.b, nd.b);\n        var rs = nd.keep[s - nd.a], re2 = nd.keep[e - nd.a - 1] + 1;\n        if (rs > rawPos) { frag.appendChild(document.createTextNode(raw.slice(rawPos, rs))); }\n        var span = document.createElement('span'); span.className = 'msq-s'; span.setAttribute('data-i', sg.i); span.textContent = raw.slice(rs, re2);\n        frag.appendChild(span); rawPos = re2; any = true;\n        if (sg.b > nd.b) { break; }\n      }\n      while (segs.length > si && nd.b >= segs[si].b) { si += 1; }\n      if (!any) { return; }\n      if (raw.length > rawPos) { frag.appendChild(document.createTextNode(raw.slice(rawPos))); }\n      nd.node.parentNode.replaceChild(frag, nd.node);\n    });\n    var starts = map.map(function(m){ return m[0]; }), curIdx = -1, lastUser = 0, timer = null, autoUntil = 0, dragging = false;\n    function idxAt(t){ var lo = 0, hi = starts.length; while (hi > lo + 1) { var mid = (lo + hi) >> 1; if (t + 0.15 >= starts[mid]) { lo = mid; } else { hi = mid; } } return (t + 0.15 >= starts[0]) ? lo : -1; }\n    function setNow(i){\n      if (i === curIdx) { return; }\n      Array.prototype.forEach.call(scope.querySelectorAll('.msq-now'), function(el){ el.classList.remove('msq-now'); });\n      curIdx = i; if (0 > i) { return; }\n      var els = scope.querySelectorAll('[data-i=\"' + i + '\"]'); if (!els.length) { return; }\n      Array.prototype.forEach.call(els, function(el){ el.classList.add('msq-now'); });\n      var r = els[0].getBoundingClientRect(), now = Date.now();\n      if (!dragging && now > lastUser + 2500 && (80 > r.top || r.bottom > window.innerHeight - 140)) {\n        var reduce = window.matchMedia && window.matchMedia('(prefers-reduced-motion: reduce)').matches;\n        autoUntil = now + (reduce ? 400 : 1600);\n        els[0].scrollIntoView({ block: 'center', behavior: reduce ? 'auto' : 'smooth' });\n      }\n    }\n    function tick(){ if (!audio.paused) { setNow(idxAt(audio.currentTime)); } }\n    function userScrolled(){ lastUser = Date.now(); }\n    ['wheel', 'touchmove', 'keydown'].forEach(function(ev){ window.addEventListener(ev, userScrolled, { passive: true }); });\n    window.addEventListener('scroll', function(){ if (Date.now() > autoUntil) { userScrolled(); } }, { passive: true });\n    window.addEventListener('mousedown', function(e){ if (e.clientX >= document.documentElement.clientWidth) { dragging = true; userScrolled(); } }, { passive: true });\n    window.addEventListener('mouseup', function(){ if (dragging) { dragging = false; userScrolled(); } }, { passive: true });\n    audio.addEventListener('play', function(){ if (timer) { clearInterval(timer); } timer = setInterval(tick, 150); tick(); });\n    audio.addEventListener('pause', function(){ if (timer) { clearInterval(timer); timer = null; } });\n    scope.addEventListener('click', function(e){\n      if (e.target.closest('a, button, input, select, textarea, label, summary, .msq, .msq-tool, .msq-end, .msq-audio, .msq-bar')) { return; }\n      var sel = window.getSelection ? String(window.getSelection()) : '';\n      if (sel && sel.trim()) { return; }\n      var el = e.target.closest('[data-i]'); if (!el) { return; }\n      var i = parseInt(el.getAttribute('data-i'), 10); if (isNaN(i)) { return; }\n      if (!audio.paused && i === curIdx) { return; }\n      lastUser = Date.now();\n      audio.currentTime = starts[i];\n      var p = audio.play(); if (p && p.catch) { p.catch(function(){}); }\n      try { if (typeof gtag === 'function') { gtag('event', 'audio_chapter', { article: location.pathname, source: 'sentence', start: Math.round(starts[i]) }); } } catch (err) {}\n    });\n    audio.addEventListener('seeked', tick);\n    audio.addEventListener('ended', function(){ setNow(-1); });\n  }\n  if (document.readyState === 'loading') { document.addEventListener('DOMContentLoaded', start); } else { start(); }\n})();<\/script>\n<\/div>\n\n\n\n<p class=\"msq-hook wp-block-paragraph\">On this page: a five device table of how Trezor, Ledger, Coldcard, Jade and KeepKey handle a passphrase, read from each maker&#8217;s documentation on 18 October 2026, five owner threads on what went wrong, and a restore test checklist.<\/p>\n\n\n\n<div class=\"msq\" id=\"ms-quiz\" data-slug=\"wallet-passphrase\" data-category=\"self custody and wallets\" data-list=\"1\">\n<style>.msq,.msq-hook,.msq-box,.msq-end,.msq-tool{--msq-accent:#1F4E79;--msq-accent-text:#FFFFFF;--msq-line:#CBD8E6;--msq-warn:#B4531A;--msq-muted:#4A5560;--msq-tint:#EEF3F8;--msq-base:#FFFFFF}\n.msq{margin:1.25em 0 1.75em}\n.msq-hook{border-left:3px solid var(--msq-accent);padding:6px 14px;color:var(--msq-muted);font-size:.97em}\n.msq-box{background:var(--msq-tint);border:1px solid var(--msq-line);border-radius:12px;padding:0}\n.msq-box>summary{cursor:pointer;list-style:none;padding:14px 18px;font-weight:700;color:var(--msq-accent)}\n.msq-box>summary::-webkit-details-marker{display:none}\n.msq-box>summary::before{content:\"+\";display:inline-block;width:1.1em;font-weight:800}\n.msq-box[open]>summary::before{content:\"\\00d7\"}\n.msq-body{padding:2px 18px 18px}\n.msq-intro{margin:0 0 12px;font-size:.95em;color:var(--msq-muted)}\n.msq-list{margin:0;padding:0;list-style:none}\n.msq-q{margin:0 0 18px;padding:0}\n.msq-question{font-weight:700;margin:0 0 8px}\n.msq-options{display:flex;flex-direction:column;gap:8px}\n.msq-opt{text-align:left;background:var(--msq-base);border:1px solid var(--msq-line);border-radius:8px;padding:10px 12px;font:inherit;font-size:.95em;color:inherit;cursor:pointer;line-height:1.35}\n.msq-opt:hover{border-color:var(--msq-accent)}\n.msq-opt[disabled]{cursor:default}\n.msq-opt.is-right{border-color:var(--msq-accent);background:var(--msq-line);font-weight:700}\n.msq-opt.is-wrong{border-color:var(--msq-warn);color:var(--msq-warn)}\n.msq-explain{margin:8px 0 0;font-size:.92em;padding:10px 12px;border-left:3px solid var(--msq-accent);background:var(--msq-base);border-radius:0 8px 8px 0}\n.msq-explain[hidden]{display:none}\n.msq-verdict{font-weight:700}\n.msq-result{margin-top:14px;padding:14px 16px;background:var(--msq-base);border:1px solid var(--msq-line);border-radius:10px}\n.msq-result[hidden]{display:none}\n.msq-result h3{margin:0 0 6px;font-size:1.1em}\n.msq-result p{margin:0 0 8px}\n.msq-jump{margin:0 0 8px;padding-left:1.2em}\n.msq-form{margin-top:10px;display:flex;flex-wrap:wrap;gap:8px;align-items:center}\n.msq-form input[type=email]{flex:1 1 220px;padding:10px 12px;border:1px solid var(--msq-muted);border-radius:8px;font:inherit;background:#fff}\n.msq-btn{background:var(--msq-accent);color:var(--msq-accent-text);border:0;border-radius:8px;padding:11px 18px;font:inherit;font-weight:700;cursor:pointer}\n.msq-btn:hover{filter:brightness(.92)}\n.msq-btn[disabled]{opacity:.7;cursor:default}\n.msq-no{font-size:.9em;color:var(--msq-muted);margin-left:4px}\n.msq-privacy{margin:6px 0 0;font-size:.82em;color:var(--msq-muted);flex-basis:100%}\n.msq-hp{position:absolute;left:-5000px;width:1px;height:1px;overflow:hidden}\n.msq-msg{margin:8px 0 0;font-size:.92em}\n.msq-end{margin:1.5em 0;padding:18px;border:1px solid var(--msq-accent);border-radius:12px;text-align:center;background:var(--msq-tint)}\n.msq-end p{margin:0 0 12px}\n.msq-end .msq-body{text-align:left;padding:16px 0 0}\n.msq-end .msq-start-test[hidden]{display:none}\n.msq-tool{margin:1.5em 0;padding:18px 20px;background:var(--msq-tint);border:1px solid var(--msq-line);border-radius:12px}\n.msq-tool h3{margin:0 0 6px;font-size:1.15em}\n.msq-tool p{margin:0 0 10px}\n.msq-tool .msq-note{font-size:.85em;color:var(--msq-muted);margin:10px 0 0}\n.msq-check label{display:flex;gap:10px;align-items:flex-start;padding:9px 0;border-bottom:1px solid var(--msq-line);cursor:pointer;line-height:1.4}\n.msq-check label:last-of-type{border-bottom:0}\n.msq-check input{margin-top:5px;flex:0 0 auto;width:18px;height:18px;accent-color:var(--msq-accent)}\n.msq-check-count{font-weight:700;margin:10px 0 0}\n.msq-verdict-box{margin:12px 0 0;padding:10px 14px;border-radius:8px;background:var(--msq-base);border-left:3px solid var(--msq-warn)}\n.msq-verdict-box[hidden]{display:none}\n.msq-calc{display:grid;grid-template-columns:1fr 1fr;gap:10px 16px}\n.msq-calc label{display:flex;flex-direction:column;gap:4px;font-size:.92em}\n.msq-calc input,.msq-calc select{padding:8px 10px;border:1px solid var(--msq-muted);border-radius:8px;font:inherit;background:#fff}\n.msq-calc-out{grid-column:1 \/ -1;margin-top:6px;padding:12px 14px;background:var(--msq-base);border-radius:8px;border:1px solid var(--msq-line)}\n.msq-calc-out strong{font-size:1.15em}\n.msq-choose label{display:block;padding:9px 12px;margin:0 0 8px;background:var(--msq-base);border:1px solid var(--msq-line);border-radius:8px;cursor:pointer}\n.msq-choose input{margin-right:8px;accent-color:var(--msq-accent)}\n.msq-choice-result{margin-top:10px;padding:12px 14px;background:var(--msq-base);border-left:3px solid var(--msq-accent);border-radius:0 8px 8px 0}\n.msq-choice-result[hidden]{display:none}\n@media (max-width:600px){.msq-calc{grid-template-columns:1fr}}\nh2.wp-block-heading[id]{scroll-margin-top:24px}<\/style>\n<noscript><style>.msq-explain{display:block !important}<\/style><\/noscript>\n<details class=\"msq-box\">\n<summary>Think you already know this? Five questions, one minute.<\/summary>\n<div class=\"msq-body\">\n<p class=\"msq-intro\">Every answer is on this page. Answer from what you know now; the page fills in the rest.<\/p>\n<ol class=\"msq-list\">\n<li class=\"msq-q\" data-q=\"1\" data-answer=\"b\" data-title=\"What does a wallet passphrase actually do?\" data-section=\"#what-does-a-wallet-passphrase-actually-do\">\n<p class=\"msq-question\">1. According to BIP39, what happens when a passphrase is typed with one character different?<\/p>\n<div class=\"msq-options\" role=\"group\" aria-label=\"Question 1 options\"><button type=\"button\" class=\"msq-opt\" data-opt=\"a\">The device shows an error and asks again<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"b\">A different, valid seed and a different wallet are produced<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"c\">The device locks after three attempts<\/button><\/div>\n<p class=\"msq-explain\" hidden><span class=\"msq-verdict\"><\/span>The standard says every passphrase generates a valid seed, so any change opens a different wallet. See <a href=\"https:\/\/github.com\/bitcoin\/bips\/blob\/master\/bip-0039.mediawiki\" target=\"_blank\" rel=\"noopener\">BIP39 on GitHub<\/a>. <a class=\"msq-section\" href=\"#what-does-a-wallet-passphrase-actually-do\">Read the section<\/a><\/p>\n<\/li>\n<li class=\"msq-q\" data-q=\"2\" data-answer=\"a\" data-title=\"How do Trezor, Ledger, Coldcard, Jade and KeepKey handle a passphrase?\" data-section=\"#how-do-trezor-ledger-coldcard-jade-and-keepkey-handle-a-pass\">\n<p class=\"msq-question\">2. Which of the five devices can store a passphrase for you, attached to a second PIN?<\/p>\n<div class=\"msq-options\" role=\"group\" aria-label=\"Question 2 options\"><button type=\"button\" class=\"msq-opt\" data-opt=\"a\">Ledger<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"b\">Trezor<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"c\">KeepKey<\/button><\/div>\n<p class=\"msq-explain\" hidden><span class=\"msq-verdict\"><\/span>Ledger offers a temporary passphrase or one attached to a secondary PIN, per <a href=\"https:\/\/www.ledger.com\/academy\/passphrase-an-advanced-security-feature\" target=\"_blank\" rel=\"noopener\">Ledger Academy<\/a>. Trezor and KeepKey say they never store it. <a class=\"msq-section\" href=\"#how-do-trezor-ledger-coldcard-jade-and-keepkey-handle-a-pass\">Read the section<\/a><\/p>\n<\/li>\n<li class=\"msq-q\" data-q=\"3\" data-answer=\"c\" data-title=\"Why does a wrong passphrase open an empty wallet instead of an error?\" data-section=\"#why-does-a-wrong-passphrase-open-an-empty-wallet-instead-of\">\n<p class=\"msq-question\">3. What does Coldcard&#8217;s documentation say about checking a passphrase?<\/p>\n<div class=\"msq-options\" role=\"group\" aria-label=\"Question 3 options\"><button type=\"button\" class=\"msq-opt\" data-opt=\"a\">It checks it against a stored hash<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"b\">It checks it against the recovery words<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"c\">No validation is performed on it<\/button><\/div>\n<p class=\"msq-explain\" hidden><span class=\"msq-verdict\"><\/span>The <a href=\"https:\/\/coldcard.com\/docs\/passphrase\/\" target=\"_blank\" rel=\"noopener\">Coldcard passphrase docs<\/a> say there is no validation, so a wrong one simply opens a different wallet. The 8 digit fingerprint is how you tell. <a class=\"msq-section\" href=\"#why-does-a-wrong-passphrase-open-an-empty-wallet-instead-of\">Read the section<\/a><\/p>\n<\/li>\n<li class=\"msq-q\" data-q=\"4\" data-answer=\"b\" data-title=\"Does a passphrase protect against a tampered device or a weak seed?\" data-section=\"#does-a-passphrase-protect-against-a-tampered-device-or-a-wea\">\n<p class=\"msq-question\">4. What does Coinkite&#8217;s security page say a passphrase does for a seed made on affected Coldcard firmware?<\/p>\n<div class=\"msq-options\" role=\"group\" aria-label=\"Question 4 options\"><button type=\"button\" class=\"msq-opt\" data-opt=\"a\">It fully repairs the seed<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"b\">It can add a barrier but does not repair the seed<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"c\">Nothing at all<\/button><\/div>\n<p class=\"msq-explain\" hidden><span class=\"msq-verdict\"><\/span>The <a href=\"https:\/\/coldcard.com\/security\/\" target=\"_blank\" rel=\"noopener\">Coldcard security status page<\/a>, verified 1 October 2026, says a passphrase can add a barrier but passphrase users should still migrate. <a class=\"msq-section\" href=\"#does-a-passphrase-protect-against-a-tampered-device-or-a-wea\">Read the section<\/a><\/p>\n<\/li>\n<li class=\"msq-q\" data-q=\"5\" data-answer=\"a\" data-title=\"How do you test a passphrase before trusting it with real money?\" data-section=\"#how-do-you-test-a-passphrase-before-trusting-it-with-real-mo\">\n<p class=\"msq-question\">5. What is KeepKey&#8217;s lightweight passphrase test?<\/p>\n<div class=\"msq-options\" role=\"group\" aria-label=\"Question 5 options\"><button type=\"button\" class=\"msq-opt\" data-opt=\"a\">Enter it, note an address, reconnect, enter it again and compare the address<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"b\">Email it to yourself and compare<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"c\">Type it into a website that checks passphrases<\/button><\/div>\n<p class=\"msq-explain\" hidden><span class=\"msq-verdict\"><\/span>That is the test in the <a href=\"https:\/\/docs.keepkey.com\/docs\/desktop\/passphrase\" target=\"_blank\" rel=\"noopener\">KeepKey passphrase docs<\/a>. No legitimate check ever needs a website or an email. <a class=\"msq-section\" href=\"#how-do-you-test-a-passphrase-before-trusting-it-with-real-mo\">Read the section<\/a><\/p>\n<\/li>\n<\/ol>\n<div class=\"msq-result\" hidden><\/div>\n<\/div>\n<\/details>\n<script>(function(){\n  if (window.__msqInit) { return; }\n  window.__msqInit = true;\n  var root = document.getElementById('ms-quiz');\n  if (!root) { return; }\n  var meta = { slug: root.getAttribute('data-slug'), category: root.getAttribute('data-category'),\n               list: root.getAttribute('data-list') || '1' };\n  function qs(el, s){ return el.querySelector(s); }\n  function qsa(el, s){ return Array.prototype.slice.call(el.querySelectorAll(s)); }\n  function track(name, params){\n    try { if (typeof gtag === 'function') { var p = params || {}; p.article = meta.slug; gtag('event', name, p); } } catch (e) {}\n  }\n  function jumpList(missed){\n    if (!missed.length) { return ''; }\n    return '<ul class=\"msq-jump\">' + missed.map(function(q){\n      return '<li><a href=\"' + q.getAttribute('data-section') + '\">' + q.getAttribute('data-title') + '<\/a><\/li>';\n    }).join('') + '<\/ul>';\n  }\n  function emailForm(){\n    return '<div class=\"msq-sub\"><p><strong>Get the next one.<\/strong> We publish new articles on ' + meta.category\n      + ' most weeks and recheck this page on Sundays. Email me when a new article goes up or this page changes.<\/p>'\n      + '<form class=\"msq-form\" method=\"post\" action=\"\/mail\/form.php\" novalidate>'\n      + '<input type=\"hidden\" name=\"list\" value=\"' + meta.list + '\">'\n      + '<input type=\"hidden\" name=\"name\" value=\"\">'\n      + '<label class=\"msq-hp\" aria-hidden=\"true\">Leave this empty<input type=\"text\" name=\"website\" tabindex=\"-1\" autocomplete=\"off\"><\/label>'\n      + '<input type=\"email\" name=\"email\" placeholder=\"you@example.com\" required aria-label=\"Email address\" autocomplete=\"email\">'\n      + '<button type=\"submit\" class=\"msq-btn\">Email me the updates<\/button>'\n      + '<a href=\"#\" class=\"msq-no\">No thanks<\/a>'\n      + '<p class=\"msq-privacy\">We store your email and this page\\'s topic, nothing else. Unsubscribe any time.<\/p>'\n      + '<\/form><p class=\"msq-msg\" aria-live=\"polite\"><\/p><\/div>';\n  }\n  \/* The autoresponder always answers 200 with its own page. A \".msg.err\" box means the\n     address was rejected, \"You're subscribed\" means accepted, and a redirect only happens\n     after a successful subscribe. Same reading as the landing pages on the other sites. *\/\n  function sendForm(form){\n    return fetch(form.getAttribute('action'), { method: 'POST', body: new FormData(form), credentials: 'same-origin', redirect: 'manual' })\n      .then(function(res){\n        if (res.type === 'opaqueredirect') { return { status: 'ok' }; }\n        if (res.status === 404) { return { status: 'notlive' }; }\n        if (!res.ok) { throw new Error('HTTP ' + res.status); }\n        return res.text().then(function(t){\n          var doc = new DOMParser().parseFromString(t, 'text\/html');\n          var err = doc.querySelector('.msg.err');\n          if (err) {\n            var m = err.textContent.trim();\n            if (\/something went wrong\/i.test(m)) { throw new Error(m); }\n            return { status: 'rejected', message: m };\n          }\n          if (\/you.re subscribed\/i.test(doc.body.textContent)) { return { status: 'ok' }; }\n          return { status: 'unknown' };\n        });\n      });\n  }\n  function wireForm(sub){\n    var form = qs(sub, '.msq-form'), msg = qs(sub, '.msq-msg');\n    qs(form, '.msq-no').addEventListener('click', function(e){\n      e.preventDefault();\n      sub.innerHTML = '<p class=\"msq-msg\">No problem. The Sunday refresh keeps this page current either way.<\/p>';\n      track('quiz_email', { result: 'declined' });\n    });\n    form.addEventListener('submit', function(e){\n      e.preventDefault();\n      var input = qs(form, 'input[name=email]'), btn = qs(form, '.msq-btn');\n      var email = input.value.trim(); input.value = email;\n      if (!\/^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$\/.test(email)) { msg.textContent = 'That email does not look right.'; return; }\n      btn.disabled = true; btn.textContent = 'Sending';\n      function reset(){ btn.disabled = false; btn.textContent = 'Email me the updates'; }\n      sendForm(form).then(function(r){\n        if (r.status === 'ok' || r.status === 'unknown') {\n          sub.innerHTML = '<p class=\"msq-msg\"><strong>Done.<\/strong> We will email you when the next article on ' + meta.category\n            + ' goes up and when this page changes. If a confirmation email arrives, click it.<\/p>';\n          track('quiz_email', { result: r.status });\n          if (r.status === 'ok') { track('generate_lead', { method: 'quiz' }); }\n        } else if (r.status === 'notlive') {\n          msg.textContent = 'Sign up is not switched on yet for this site. Nothing was stored.'; reset();\n          track('quiz_email', { result: 'notlive' });\n        } else {\n          msg.textContent = r.message || 'Please check the email address and try again.'; reset();\n          track('quiz_email', { result: 'rejected' });\n        }\n      }).catch(function(){\n        msg.textContent = 'Could not reach the sign up service just now. Nothing was stored.'; reset();\n        track('quiz_email', { result: 'error' });\n      });\n    });\n  }\n  function finish(container, mode, score, total, missed){\n    var result = qs(container, '.msq-result');\n    track('quiz_complete', { mode: mode, score: score, total: total });\n    var h;\n    if (mode === 'pre') {\n      h = '<h3>You knew ' + score + ' of ' + total + ' before reading.<\/h3>';\n      h += (score === total) ? '<p>All of them. Read on anyway; the sections below carry the detail behind each answer.<\/p>'\n                             : '<p>The rest is below. Jump straight to what you missed:<\/p>' + jumpList(missed);\n      try { sessionStorage.setItem('msq-pre-' + meta.slug, String(score)); } catch (e) {}\n    } else {\n      var pre = null;\n      try { pre = sessionStorage.getItem('msq-pre-' + meta.slug); } catch (e) {}\n      h = '<h3>You got ' + score + ' of ' + total + '.<\/h3>';\n      if (pre !== null) { h += '<p>Before reading you had ' + pre + ' of ' + total + '.<\/p>'; }\n      if (missed.length) { h += '<p>Worth a second look:<\/p>' + jumpList(missed); }\n      h += emailForm();\n    }\n    result.innerHTML = h; result.hidden = false;\n    if (mode !== 'pre') { wireForm(qs(result, '.msq-sub')); }\n    result.scrollIntoView({ behavior: 'smooth', block: 'nearest' });\n  }\n  function setup(container, mode){\n    var qEls = qsa(container, '.msq-q'), answered = 0, score = 0, missed = [];\n    qEls.forEach(function(q){\n      var answer = q.getAttribute('data-answer'), opts = qsa(q, '.msq-opt'), explain = qs(q, '.msq-explain');\n      q.removeAttribute('data-done'); explain.hidden = true; qs(explain, '.msq-verdict').textContent = '';\n      opts.forEach(function(b){ b.disabled = false; b.classList.remove('is-right', 'is-wrong'); });\n      opts.forEach(function(b){\n        b.addEventListener('click', function(){\n          if (q.getAttribute('data-done')) { return; }\n          q.setAttribute('data-done', '1');\n          var ok = b.getAttribute('data-opt') === answer;\n          opts.forEach(function(o){ o.disabled = true; if (o.getAttribute('data-opt') === answer) { o.classList.add('is-right'); } });\n          if (ok) { score += 1; } else { b.classList.add('is-wrong'); missed.push(q); }\n          qs(explain, '.msq-verdict').textContent = ok ? 'Right. ' : 'Not quite. ';\n          explain.hidden = false;\n          answered += 1;\n          track('quiz_answer', { mode: mode, question: q.getAttribute('data-q'), correct: ok ? 1 : 0 });\n          if (answered === qEls.length) { finish(container, mode, score, qEls.length, missed); }\n        });\n      });\n    });\n  }\n  var box = qs(root, '.msq-box');\n  setup(root, 'pre');\n  if (box) { var skipFirst = box.hasAttribute('data-default-open'); box.addEventListener('toggle', function(){ if (!box.open) { return; } if (skipFirst) { skipFirst = false; return; } track('quiz_open', { mode: 'pre' }); }); }\n  \/* The end block sits far below this script, so it does not exist yet while this runs\n     during parsing. A delegated listener finds it at click time. *\/\n  document.addEventListener('click', function(e){\n    var startBtn = (e.target && e.target.closest) ? e.target.closest('.msq-start-test') : null;\n    if (!startBtn) { return; }\n    var end = startBtn.closest('.msq-end');\n    if (!end) { return; }\n    var mount = qs(end, '.msq-mount');\n    var clone = qs(root, '.msq-body').cloneNode(true);\n    var intro = qs(clone, '.msq-intro');\n    if (intro) { intro.textContent = 'The same five questions, now that you have read the page.'; }\n    var res = qs(clone, '.msq-result'); if (res) { res.hidden = true; res.innerHTML = ''; }\n    mount.innerHTML = ''; mount.appendChild(clone);\n    setup(mount, 'test');\n    startBtn.hidden = true;\n    track('quiz_open', { mode: 'test' });\n    mount.scrollIntoView({ behavior: 'smooth', block: 'start' });\n    var first = qs(mount, '.msq-opt'); if (first) { first.focus({ preventScroll: true }); }\n  });\n  \/* Shared tool behaviour: checklists remember their ticks on this device, and a chooser\n     shows the result for the option picked. Calculators carry their own small script. *\/\n  function initTools(){\n    qsa(document, '.msq-check').forEach(function(box){\n      var key = 'msq-check-' + meta.slug + '-' + (box.getAttribute('data-id') || 'x');\n      var boxes = qsa(box, 'input[type=checkbox]'), count = qs(box, '.msq-check-count');\n      var yes = qs(box, '.msq-verdict-yes'), no = qs(box, '.msq-verdict-no');\n      var saved = {};\n      try { saved = JSON.parse(localStorage.getItem(key) || '{}'); } catch (e) {}\n      boxes.forEach(function(cb, i){ if (saved[i]) { cb.checked = true; } });\n      function refresh(){\n        var n = boxes.filter(function(cb){ return cb.checked; }).length, state = {};\n        boxes.forEach(function(cb, i){ if (cb.checked) { state[i] = 1; } });\n        try { localStorage.setItem(key, JSON.stringify(state)); } catch (e) {}\n        if (count) { count.textContent = n + ' of ' + boxes.length + (box.getAttribute('data-verb') || ' done'); }\n        if (yes && no) { yes.hidden = n === 0; no.hidden = n !== 0; }\n      }\n      boxes.forEach(function(cb){ cb.addEventListener('change', function(){ refresh(); track('tool_check', { tool: box.getAttribute('data-id') }); }); });\n      refresh();\n    });\n    qsa(document, '.msq-choose').forEach(function(box){\n      var results = qsa(box, '.msq-choice-result');\n      qsa(box, 'input[type=radio]').forEach(function(r){\n        r.addEventListener('change', function(){\n          results.forEach(function(el){ el.hidden = el.getAttribute('data-for') !== r.value; });\n          track('tool_choose', { tool: box.getAttribute('data-id'), choice: r.value });\n        });\n      });\n    });\n  }\n  \/\/ read progress: how far down the article the reader has scrolled, fired once per quarter\n  (function(){\n    var art = root.closest('article') || root.parentNode, fired = {};\n    function check(){\n      var top = art.getBoundingClientRect().top + window.pageYOffset, h = art.offsetHeight || 1;\n      var seen = (window.pageYOffset + window.innerHeight - top) \/ h * 100;\n      [25, 50, 75, 100].forEach(function(m){ if (seen >= m && !fired[m]) { fired[m] = true; track('read_progress', { percent: m }); } });\n    }\n    window.addEventListener('scroll', check, { passive: true }); window.addEventListener('load', check);\n  })();\n  if (document.readyState === 'loading') { document.addEventListener('DOMContentLoaded', initTools); } else { initTools(); }\n})();<\/script>\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Most pages on this subject were written by people selling steel plates, and they love the spy film part: the decoy wallet, the burglar leaving with pocket money. The way people actually lose coins to a passphrase is duller. They type it slightly differently one day and see an empty wallet. So this page reads what five device makers say, on 18 October 2026, and what owners report.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-does-a-wallet-passphrase-actually-do\">What does a wallet passphrase actually do?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The rules come from <a href=\"https:\/\/github.com\/bitcoin\/bips\/blob\/master\/bip-0039.mediawiki\" target=\"_blank\" rel=\"noopener\">BIP39, the Bitcoin standard behind recovery words<\/a>. Your words and your passphrase are mixed together to make the seed that every key in the wallet comes from. Change one character of the passphrase and you get a completely different seed. The standard says it plainly: \u201cevery passphrase generates a valid seed\u201d, but only the right one opens the wallet you funded.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That one design choice explains everything else on this page. There is nothing to check a passphrase against, so no device can say \u201cwrong passphrase\u201d. The blank passphrase opens your standard wallet. Every other string, including your real one with a stray space on the end, opens its own wallet. That is the hidden wallet, and it is also the trap.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"how-do-trezor-ledger-coldcard-jade-and-keepkey-handle-a-pass\">How do Trezor, Ledger, Coldcard, Jade and KeepKey handle a passphrase?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The idea is shared. The details are not, and the details decide where the passphrase can be seen, by whom, and how easily you can mistype it. Every row below was read from the maker\u2019s own documentation on 18 October 2026.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Device<\/th><th>Where you type it<\/th><th>Stored on the device?<\/th><th>Length limit<\/th><th>How you confirm it is right<\/th><th>Source<\/th><\/tr><\/thead><tbody><tr><td>Trezor<\/td><td>On the device (Safe 7, Safe 5, Safe 3, Model T) or in Trezor Suite (all models)<\/td><td>No<\/td><td>128 characters, 50 on Model One<\/td><td>Device shows what you typed; Suite asks for it twice<\/td><td><a href=\"https:\/\/trezor.io\/guides\/backups-recovery\/advanced-wallets\/what-is-a-passphrase\" target=\"_blank\" rel=\"noopener\">Trezor guide<\/a><\/td><\/tr><tr><td>Ledger<\/td><td>On the device<\/td><td>Only if you attach it to a second PIN; a temporary one is not stored<\/td><td>100 characters<\/td><td>Not described<\/td><td><a href=\"https:\/\/www.ledger.com\/academy\/passphrase-an-advanced-security-feature\" target=\"_blank\" rel=\"noopener\">Ledger Academy, updated 5 Aug 2026<\/a><\/td><\/tr><tr><td>Coldcard<\/td><td>On the device (Q has a keyboard and can scan a QR code)<\/td><td>No, but it can be saved encrypted to one specific MicroSD card<\/td><td>100 ASCII characters<\/td><td>An 8 digit fingerprint (XFP) to write down and compare<\/td><td><a href=\"https:\/\/coldcard.com\/docs\/passphrase\/\" target=\"_blank\" rel=\"noopener\">Coldcard docs, updated 1 Oct 2026<\/a><\/td><\/tr><tr><td>Blockstream Jade<\/td><td>On the device, letter by letter or by word list<\/td><td>No<\/td><td>Not stated<\/td><td>Wallet fingerprint in the lower right corner<\/td><td><a href=\"https:\/\/help.blockstream.com\/blockstream-jade\/add-more-security-functionality\/add-a-bip39-passphrase-for-jade\" target=\"_blank\" rel=\"noopener\">Blockstream help<\/a><\/td><\/tr><tr><td>KeepKey<\/td><td>Prompted by the KeepKey Desktop app on your computer<\/td><td>No<\/td><td>Not stated<\/td><td>Note an address, reconnect, re-enter, compare<\/td><td><a href=\"https:\/\/docs.keepkey.com\/docs\/desktop\/passphrase\" target=\"_blank\" rel=\"noopener\">KeepKey docs<\/a><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Three differences matter more than they look. First, Ledger is the only one of the five that will remember a passphrase for you, through <a href=\"https:\/\/www.ledger.com\/academy\/passphrase-an-advanced-security-feature\" target=\"_blank\" rel=\"noopener\">its second PIN option<\/a>. Outside the five, a Classic 1S owner reported the same trick in <a href=\"https:\/\/getbitcoin.guide\/articles\/onekey-wallet-review\/\">our OneKey wallet review<\/a>, binding a passphrase to a PIN so that Sparrow never asked for it. That removes typos from daily use, but Ledger also warns that three wrong attempts at that second PIN reset the device, after which only the written recovery phrase and the written passphrase will restore it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Second, the fingerprint. <a href=\"https:\/\/coldcard.com\/docs\/passphrase\/\" target=\"_blank\" rel=\"noopener\">Coldcard\u2019s documentation<\/a> says the device shows \u201can 8-digit hexadecimal number when you apply a passphrase\u201d and tells you to write it down so you can check it every time. <a href=\"https:\/\/help.blockstream.com\/blockstream-jade\/add-more-security-functionality\/add-a-bip39-passphrase-for-jade\" target=\"_blank\" rel=\"noopener\">Jade does the same<\/a> in the corner of its screen. A fingerprint is the only honest answer to \u201cis this the right wallet?\u201d that a device can give without storing the passphrase. Our <a href=\"https:\/\/getbitcoin.guide\/articles\/blockstream-jade-review\/\">Blockstream Jade review<\/a> covers the rest of that device.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Third, where the typing happens. KeepKey has a single button and no keyboard, so its passphrase is typed into the desktop app on the computer. Trezor lets you choose. That choice became a live argument this month, for reasons covered below.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"why-does-a-wrong-passphrase-open-an-empty-wallet-instead-of\">Why does a wrong passphrase open an empty wallet instead of an error?<\/h2>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1376\" height=\"768\" src=\"https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/entering-incorrect-wallet-passphrase-on-device.jpg\" alt=\"Close up of hands entering a wallet passphrase on a hardware wallet at a kitchen table.\" class=\"wp-image-652\" srcset=\"https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/entering-incorrect-wallet-passphrase-on-device.jpg 1376w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/entering-incorrect-wallet-passphrase-on-device-300x167.jpg 300w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/entering-incorrect-wallet-passphrase-on-device-1024x572.jpg 1024w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/entering-incorrect-wallet-passphrase-on-device-768x429.jpg 768w\" sizes=\"auto, (max-width: 1376px) 100vw, 1376px\" \/><figcaption class=\"wp-block-image__caption\">A single incorrect character will quietly lead to an entirely different empty wallet.<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Because there is no stored answer to compare against. <a href=\"https:\/\/docs.keepkey.com\/docs\/desktop\/passphrase\" target=\"_blank\" rel=\"noopener\">KeepKey\u2019s documentation<\/a> says there is no list of passphrases kept \u201cnot on the device, not on your computer, not anywhere.\u201d <a href=\"https:\/\/trezor.io\/guides\/backups-recovery\/advanced-wallets\/what-is-a-passphrase\" target=\"_blank\" rel=\"noopener\">Trezor\u2019s guide<\/a> says a mistyped one opens \u201ca different wallet\u201d that is \u201cmost likely empty.\u201d <a href=\"https:\/\/coldcard.com\/docs\/passphrase\/\" target=\"_blank\" rel=\"noopener\">Coldcard<\/a> is blunter: \u201cThere is no validation performed on your passphrase.\u201d<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Your coins are not gone when this happens. They are sitting in the wallet your real passphrase opens. But every difference counts: capital letters, a trailing space, and quote marks. A curly apostrophe and a straight one are different characters, and a phone keyboard will happily swap one for the other. Coldcard accepts ASCII only, which removes the curly version entirely. On the other devices, it is your problem.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-do-people-who-use-a-passphrase-actually-report\">What do people who use a passphrase actually report?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">We read five public threads from r\/TREZOR and r\/ledgerwallet, dated November 2025 to October 2026, and roughly a hundred replies under them. These are what people report, not findings, and none of them is proof of a device fault.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In <a href=\"https:\/\/www.reddit.com\/r\/TREZOR\/comments\/1omq4op\/passphrases_not_working_reliably_what_could_this\/\" target=\"_blank\" rel=\"noopener\">a November 2025 r\/TREZOR thread<\/a>, an owner with two Safe 3 devices on the same seed described a passphrase wallet showing as empty on one device and opening on the other, then the reverse days later, while checking the written passphrase letter by letter. A Trezor support account said it would pass the report to the Suite team, and two other users said they had seen something similar, one after firmware updates. Others pointed at typos and curly apostrophes.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In <a href=\"https:\/\/www.reddit.com\/r\/TREZOR\/comments\/1u6pqdm\/unable_to_access_funds_in_passphraseprotected\/\" target=\"_blank\" rel=\"noopener\">a June 2026 thread<\/a>, an owner said that after a Trezor Suite update their passphrase wallet opened as new and empty, although a block explorer showed the coins still at the address. The replies ranged from a missed second prompt to a typo to a fake app. As read on 18 October 2026, the thread showed no resolution.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In <a href=\"https:\/\/www.reddit.com\/r\/TREZOR\/comments\/1wr9y1o\/forgotten_passphrase\/\" target=\"_blank\" rel=\"noopener\">a September 2026 thread<\/a>, an owner who still had the PIN and the recovery words had forgotten the passphrase. The replies agreed on one point: nobody, the maker included, can recover it. The only route anyone offered was guessing by computer, and only if the owner remembers much of its shape.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Two October 2026 threads came from the Ledger implant case below. <a href=\"https:\/\/www.reddit.com\/r\/ledgerwallet\/comments\/1x2re5z\/would_a_trezor_passphrase_have_mitigated_the\/\" target=\"_blank\" rel=\"noopener\">One on r\/ledgerwallet<\/a> argued that a passphrase typed on the computer would have survived an implant that read the device screen. Its opening post claimed the Safe 3 cannot take a passphrase on the device, which <a href=\"https:\/\/trezor.io\/guides\/backups-recovery\/advanced-wallets\/what-is-a-passphrase\" target=\"_blank\" rel=\"noopener\">Trezor\u2019s own guide<\/a> contradicts, and a reply corrected it. <a href=\"https:\/\/www.reddit.com\/r\/TREZOR\/comments\/1x4ooy9\/please_do_not_show_passphrase_on_trezor_screen\/\" target=\"_blank\" rel=\"noopener\">The other, on r\/TREZOR<\/a>, asked Trezor to stop showing the passphrase on screen; a reply explained the display exists so malware on the computer cannot quietly swap in a passphrase you never chose.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Where the accounts agree with the documentation: there is no recovery without the passphrase, and a single character changes the wallet. Where they go further: two owners describe an empty wallet with a passphrase they believe was typed correctly, which the documentation does not explain and which the threads never settled. The fingerprint check in the table is the fastest way to tell those two cases apart.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"does-a-passphrase-protect-against-a-tampered-device-or-a-wea\">Does a passphrase protect against a tampered device or a weak seed?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Sometimes, and the limits are worth knowing exactly. In a statement dated 15 October 2026, <a href=\"https:\/\/www.ledger.com\/blog-response-hardware-implant-attack\" target=\"_blank\" rel=\"noopener\">Ledger said<\/a> a criminal group fitted hidden components to genuine devices \u201cdesigned to capture the recovery phrase during setup\u201d and fed them back through resellers in Southeast Asia, and that it asked resellers there and in Hong Kong to suspend sales. The statement does not mention passphrases at all. Our <a href=\"https:\/\/getbitcoin.guide\/articles\/ledger-device-comparison\/\">Ledger device comparison<\/a> covers the reseller side of the case.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here is the reasoning, ours and not Ledger\u2019s. A passphrase typed on a device whose hardware has been tampered with is typed into the same hardware that leaked the words. Typing it on a computer moves it out of reach of that implant, and into reach of malware on the computer. Neither choice is safe against everything. That is the trade the October r\/TREZOR thread argued over.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Coldcard owners face a different version of the question. Coinkite\u2019s <a href=\"https:\/\/coldcard.com\/security\/\" target=\"_blank\" rel=\"noopener\">security status page<\/a>, verified on 1 October 2026, says seeds made on affected firmware need migrating, and that a passphrase \u201ccan add a barrier\u201d but \u201cdoes not repair a seed generated on affected firmware.\u201d It also says \u201cpassphrase users should migrate as soon as practical.\u201d The same page lists 5.6.3 for the Mk4 and Mk5 and 1.5.3Q for the Q as the current standard firmware. Our <a href=\"https:\/\/getbitcoin.guide\/articles\/coldcard-mk3\/\">Coldcard Mk3 seed flaw explainer<\/a> covers which devices are affected.<\/p>\n\n\n\n<div class=\"msq-tool msq-choose\" data-id=\"pp-where-typed\">\n<h3>Where to type a passphrase: the trade off by threat<\/h3>\n<p>Pick the threat that worries you most to see what the documentation and this page say about it. It describes a trade off; it does not make the decision for you.<\/p>\n<label><input type=\"radio\" name=\"pp-where-typed\" value=\"malware\">Malware on my computer<\/label>\n<label><input type=\"radio\" name=\"pp-where-typed\" value=\"tampered\">A tampered or implanted device<\/label>\n<label><input type=\"radio\" name=\"pp-where-typed\" value=\"typo\">Locking myself out with a typo<\/label>\n<label><input type=\"radio\" name=\"pp-where-typed\" value=\"theft\">Someone finding my recovery words<\/label>\n<div class=\"msq-choice-result\" data-for=\"malware\" hidden><strong>Typing on the device keeps it off the computer.<\/strong> Ledger, Coldcard and Jade take it on the device, and Trezor&#8217;s touchscreen and Safe 3 models can. Trezor shows a passphrase typed in Suite on the device so the computer cannot swap it.<\/div>\n<div class=\"msq-choice-result\" data-for=\"tampered\" hidden><strong>A passphrase typed on that device is typed into the same hardware.<\/strong> Typing it on the computer moves it away from an implant but toward computer malware. Buying directly from the maker avoids the reseller route described in Ledger&#8217;s 15 October 2026 statement.<\/div>\n<div class=\"msq-choice-result\" data-for=\"typo\" hidden><strong>Write down the fingerprint or first address.<\/strong> Coldcard and Jade show a fingerprint; with the others, note an address. A wrong passphrase opens an empty wallet, not an error.<\/div>\n<div class=\"msq-choice-result\" data-for=\"theft\" hidden><strong>This is the threat a passphrase is built for,<\/strong> provided it is not stored with the words and is not a guessable word.<\/div>\n<p class=\"msq-note\">General information only, not personal financial advice.<\/p>\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"how-do-you-test-a-passphrase-before-trusting-it-with-real-mo\">How do you test a passphrase before trusting it with real money?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Of the makers whose pages address testing, <a href=\"https:\/\/coldcard.com\/docs\/passphrase\/\" target=\"_blank\" rel=\"noopener\">Coldcard<\/a> puts it most directly: test the recovery plan before funding the wallet. <a href=\"https:\/\/docs.keepkey.com\/docs\/desktop\/passphrase\" target=\"_blank\" rel=\"noopener\">KeepKey\u2019s version<\/a> is the lightest: enable it, note an address, unplug, reconnect, enter it again, confirm the same address. Do that first. It catches a passphrase you typed differently from the one you wrote down.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The full test goes one step further and proves the written backup works on its own. Do it once, while the wallet holds only a small test amount:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">1. Open the passphrase wallet and write down its fingerprint, or its first receiving address. 2. Send a small amount to it. 3. Wipe or reset the device through its own settings. 4. Restore it on the device itself, using its own recovery screen, from your written words, then enter your written passphrase. Never type either into a computer, phone or website for this. 5. Check the fingerprint or address matches and the small amount is there. If anything differs, stop and find out why before adding more.<\/p>\n\n\n\n<div class=\"msq-tool msq-check\" data-id=\"pp-restore-test\" data-verb=\" done\">\n<h3>Passphrase restore test<\/h3>\n<p>Run once while the passphrase wallet holds only a small test amount. Steps drawn from the Coldcard and KeepKey documentation. This page stores nothing and never asks you to type your words or passphrase.<\/p>\n<label><input type=\"checkbox\">My recovery words and my passphrase are both written down, exactly, character for character<\/label>\n<label><input type=\"checkbox\">I opened the passphrase wallet and wrote down its fingerprint or first receiving address<\/label>\n<label><input type=\"checkbox\">I sent only a small test amount to it<\/label>\n<label><input type=\"checkbox\">I reset the device through its own settings<\/label>\n<label><input type=\"checkbox\">I restored it on the device itself, from my written words and written passphrase, never on a computer, phone or website<\/label>\n<label><input type=\"checkbox\">The fingerprint or address matches what I wrote down, and the test amount is there<\/label>\n<label><input type=\"checkbox\">My words and my passphrase are stored in two different places<\/label>\n<p class=\"msq-check-count\"><\/p>\n<p class=\"msq-note\">General information only, not personal financial advice. If any step gives a different result, stop and find out why before adding more.<\/p>\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"where-should-the-passphrase-backup-live\">Where should the passphrase backup live?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Not with the recovery words. <a href=\"https:\/\/keepkey.com\/blog\/bip39_passphrase_and_securing_your_keepkey_from_physical_attacks\" target=\"_blank\" rel=\"noopener\">KeepKey\u2019s own blog<\/a> says that if you lose either one, the funds are \u201cgenuinely unrecoverable\u201d, and its docs warn that storing the two together is as good as having no passphrase at all. <a href=\"https:\/\/trezor.io\/guides\/backups-recovery\/advanced-wallets\/what-is-a-passphrase\" target=\"_blank\" rel=\"noopener\">Trezor\u2019s guide<\/a> adds that passphrases \u201ccannot be changed, removed, or recovered\u201d, so the only way to change one is to move the coins to a wallet with a new passphrase.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1376\" height=\"768\" src=\"https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/storing-metal-backup-for-wallet-passphrase.jpg\" alt=\"A thoughtful man holding a metal backup plate to store a wallet passphrase securely.\" class=\"wp-image-653\" srcset=\"https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/storing-metal-backup-for-wallet-passphrase.jpg 1376w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/storing-metal-backup-for-wallet-passphrase-300x167.jpg 300w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/storing-metal-backup-for-wallet-passphrase-1024x572.jpg 1024w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/storing-metal-backup-for-wallet-passphrase-768x429.jpg 768w\" sizes=\"auto, (max-width: 1376px) 100vw, 1376px\" \/><figcaption class=\"wp-block-image__caption\">Keeping your backup physical and separate is crucial for long term safety.<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The pattern that follows from the documentation is two backups in two places, each useless alone: the words in one, the passphrase in another, both written exactly, character for character. Our guide to <a href=\"https:\/\/getbitcoin.guide\/articles\/your-recovery-phrase\/\">the ways people actually lose a recovery phrase<\/a> covers the first half. For the devices themselves, see our <a href=\"https:\/\/getbitcoin.guide\/articles\/trezor-hardware-wallet\/\">Trezor hardware wallet guide<\/a> and <a href=\"https:\/\/getbitcoin.guide\/articles\/keepkey-wallet-review\/\">KeepKey firmware review<\/a>. Trezor itself calls the passphrase \u201cnot recommended unless you fully understand the risks.\u201d It is the most accurate sentence any vendor wrote on the subject.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"frequently-asked-questions\">Frequently asked questions<\/h2>\n\n\n<div id=\"rank-math-faq\" class=\"rank-math-block\">\n<div class=\"rank-math-list \">\n<div id=\"faq-q-1\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Is a wallet passphrase the same as my PIN?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>No. The PIN only unlocks the device and is not part of the backup. The passphrase changes which wallet opens and must be backed up as carefully as the recovery words.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-q-2\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Can I add a passphrase to a wallet that already holds coins?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>You can turn it on, but it opens a new, empty wallet. The coins stay in the standard wallet until you send them to the passphrase wallet yourself.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-q-3\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Can I change my passphrase later?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Not in place. Trezor says passphrases cannot be changed or removed. Changing one means opening a wallet with the new passphrase and moving the coins to it.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-q-4\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Will my passphrase work on a different brand of device?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Usually, because BIP39 is shared, but character rules differ. Coldcard accepts ASCII only, so a passphrase with accented letters or curly quotes may not be typeable there.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-q-5\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Does Ledger Recover or any cloud backup include the passphrase?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>None of the five makers here says its passphrase is included in a recovery phrase backup. KeepKey states outright that the recovery phrase backup does not include it.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-q-6\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Is a single word enough as a passphrase?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>A common dictionary word can be guessed by computer if someone has your recovery words. Longer and less predictable resists guessing better, but it also gets harder to type exactly.<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n<div class=\"msq-end\" id=\"ms-quiz-end\">\n<p><strong>Finished the page?<\/strong> The same five questions from the top, to see what stuck.<\/p>\n<button type=\"button\" class=\"msq-btn msq-start-test\">Test Your Understanding of This Article<\/button>\n<div class=\"msq-mount\"><\/div>\n<\/div>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\"><em>This article is general information, not financial advice, and nothing here is a recommendation to buy, sell or hold anything. Vendor documentation was read on 18 October 2026 and can change. Speak to a qualified professional about your own situation, and you remain responsible for your own security decisions.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>How Trezor, Ledger, Coldcard, Blockstream Jade and KeepKey each handle a wallet passphrase, read from their own documentation on 18 October 2026, what five public threads report going wrong, and a restore test to run before any real money sits behind one.<\/p>\n","protected":false},"author":1,"featured_media":651,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","rank_math_title":"Wallet Passphrase: How Five Devices Handle the 25th Word","rank_math_description":"A wallet passphrase opens a separate wallet from the same recovery words. How Trezor, Ledger, Coldcard, Jade and KeepKey handle it, read on 18 October.","rank_math_focus_keyword":"wallet passphrase","rank_math_canonical_url":"","rank_math_breadcrumb_title":"","rank_math_facebook_title":"","rank_math_facebook_description":"","rank_math_facebook_image":"","rank_math_twitter_title":"","rank_math_twitter_description":"","rank_math_twitter_image":"","rank_math_pillar_content":"","rank_math_robots":[],"rank_math_advanced_robots":[]},"categories":[3],"tags":[],"class_list":["post-654","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-self-custody"],"_links":{"self":[{"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/posts\/654","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/comments?post=654"}],"version-history":[{"count":5,"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/posts\/654\/revisions"}],"predecessor-version":[{"id":681,"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/posts\/654\/revisions\/681"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/media\/651"}],"wp:attachment":[{"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/media?parent=654"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/categories?post=654"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/tags?post=654"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}