Passphrases and multisig

A single seed phrase is a single point of failure. Whoever finds it has everything. Passphrases and multisig are the two standard ways to fix that. Both add safety and both add ways to lock yourself out.

The passphrase

The seed phrase standard, BIP39, includes an optional extra: a passphrase you choose yourself. It is sometimes called the 25th word, though it can be any text.

The wallet combines your seed phrase and your passphrase to produce its keys. A different passphrase gives a completely different wallet.

• Seed phrase alone → wallet A
• Seed phrase + your passphrase → wallet B

What it protects against. Someone who finds your written seed phrase can open only wallet A. If your savings are in wallet B, they are still safe.

What can go wrong. Every passphrase is valid. The wallet cannot tell you that you mistyped it. A wrong passphrase simply opens another, empty wallet with no error message. Capital letters and spaces count.

If you forget the passphrase, the coins are gone. Nobody can reset it.

Using one safely

• Write the passphrase down. Do not rely on memory.
• Store it separately from the seed phrase. Together they are no better than a seed phrase alone.
• Make it long. In one tampered-device case, attackers cut the protection down to a single character.
• Test a full recovery with both parts before moving funds.

Multisig

A multisignature wallet needs more than one key to approve a transaction. The usual notation is M-of-N: any M keys out of N.

In a 2-of-3 wallet there are three keys, and any two can spend.

• One key stolen: the thief cannot spend.
• One key lost: you can still spend with the other two.

The Bitcoin Wiki describes this as removing any single device "as a single point of failure".

Common uses

• One person spreading three keys across devices and locations
• A couple or business partners who must both approve
• A family or company treasury

The costs

• More devices to buy, set up and keep track of
• Every transaction takes more steps
• You must back up each key, and usually a wallet configuration file as well
• More parts mean more to get wrong

On Bitcoin, multisig is built into the network. On Ethereum, it is done with a smart contract wallet. Smart contract wallets can add other rules too, such as trusted contacts who can help you recover access.

Which, if either?

For most beginners, one hardware wallet with a well-stored seed phrase is the right setup. Complexity is itself a risk, and people lose coins to arrangements they did not fully understand.

Consider these tools when your holdings are large enough that a single stolen phrase would be a disaster. Practise with small amounts first.