Passphrase
SECURITYDEFINITION
An extra word (or phrase) you memorize on top of your seed phrase — the "25th word" — a second factor a thief cannot find on your backup plate alone.
A seed phrase (per BIP 39) runs through a one-way function to derive your wallet's private keys. Add a passphrase, and that same seed phrase derives an entirely different, unrelated wallet — a different set of keys and addresses. Anyone who finds only your seed words, whether on a backup plate, in a photo, or through a device flaw, lands in a wallet holding none of your coins, because they're missing the passphrase.
That's the property that made a Coldcard wallet-flaw incident less severe for passphrase users: even with a way to reconstruct a device's seed, an attacker still can't reach funds sitting behind a passphrase they don't know.
The tradeoff is unforgiving. There's no password reset — forget the passphrase, and the funds behind it are gone forever, even with the seed phrase in hand. A typo doesn't error out either; it silently derives a different, valid-looking empty wallet. Test your exact passphrase with a small amount before trusting it with real savings.
IN A SENTENCE
"The 25th word turns your seed phrase into a decoy for anyone who doesn't also have it."
Key facts
Common questions
Is a passphrase the same as a device PIN?
No. A PIN protects local access to the device itself. A passphrase changes which wallet your seed phrase derives — a completely separate protection layer.
What happens if I forget my passphrase?
The funds behind it are unrecoverable — there is no reset mechanism, even with the seed phrase. Store it as carefully as the seed phrase itself.