Key facts
- A passphrase is a word or text you choose yourself, combined with your recovery phrase to create an entirely separate wallet. It is often called the "25th word". It is part of the BIP39 standard, not a feature belonging to any one brand.
- It is not stored on the device. Unlike a PIN, which lives on the chip, a passphrase must be entered every time. Even if somebody obtains your 24-word recovery phrase, they cannot reach a passphrase-protected wallet.
- There is no "wrong" passphrase. Every entry opens a different wallet. One mistyped character opens a new, empty one, with no warning of any kind.
- Forget it and the funds are gone permanently. Trezor states plainly that a passphrase cannot be changed, removed or recovered. No manufacturer can help, because nobody stored it in the first place.
- Case always matters. `Bitcoin` and `bitcoin` produce different wallets, as does every space and special character.
- Maximum length differs by brand. Trezor allows up to 50 ASCII characters; Ledger allows up to 100.
- Back the passphrase up separately from the recovery phrase, and store the two in different places. Keeping them together removes the entire benefit.
What a passphrase is
A passphrase is a word, a sentence or a set of characters that you choose yourself and use together with the recovery phrase your hardware wallet generated. The result is a new wallet, completely separate from the original one.
It is commonly called the "25th word", because it behaves like an extra word appended to a 24-word recovery phrase. A passphrase is part of the BIP39 standard rather than any single manufacturer's feature, so most hardware wallets on the market support it, though the details of how they implement it differ.
What makes it unlike an ordinary password system is that the device does not store the passphrase anywhere. Nothing checks whether you entered it correctly. Whatever you type is used to calculate a wallet.
How it works
When you enter a passphrase, the device combines your existing recovery phrase with the text you typed and derives a fresh set of private keys. That produces a wallet with its own addresses, its own balance and its own transaction history, entirely separate from the original.
Three consequences follow, and they need to be understood together.
One recovery phrase can produce unlimited wallets. Passphrases differing by a single character give completely different wallets, so you can separate holdings by purpose however you like.
There is no wrong passphrase. The system has no concept of incorrect, because it never compares your entry against a stored value. Trezor puts it plainly: if it is a new or mistyped passphrase, a different wallet opens, and it will most likely be empty. People who do not understand this often believe their funds have been stolen, when in fact they have opened the wrong wallet.
Case matters. `Bitcoin`, `bitcoin` and `BitCoin` are three unrelated wallets. Spaces, punctuation and special characters all count too.
How it differs from a PIN
These are two separate layers doing entirely different jobs.
A PIN protects the device. It is stored on the chip and stops somebody who physically has your wallet from using it immediately. It can be changed later, and if the device is lost the PIN is beside the point, because you would restore from the recovery phrase onto a new device anyway.
A passphrase protects the wallet. It is stored nowhere at all, neither on the device nor on any manufacturer's server, so it is the layer that still works in the worst case: when somebody else already has your 24 words.
That is the main reason experienced holders use one. A recovery phrase written on paper or stamped into steel can always be found — through a burglary, a house move, or a family member. Whoever finds it without the passphrase can only open the original wallet.
The risks to understand first
This section matters more than all the advantages combined, and it is why beginners should not rush into enabling it.
Forget it and it is gone permanently, with no exceptions. Trezor's documentation states directly that a passphrase cannot be changed, removed or recovered. No manufacturer, no retailer and no tool can restore it, because the value was never stored anywhere to begin with.
A typo produces no warning. Unlike an ordinary password prompt telling you the entry was incorrect, you simply see an empty wallet. People who mistype a passphrase without realizing it routinely assume they have been robbed.
Your heirs may never reach it. If a passphrase exists only in your memory, the assets in that wallet disappear with you. Family who find the 24 words will open the original wallet, and will have no way of even knowing another one exists.
It adds nothing if stored in the same place. Writing the passphrase on the same piece of paper as the recovery phrase removes the entire benefit immediately — whoever finds that paper has both.
Being forced to open a wallet
A frequently cited reason for using a passphrase is coercion. The idea is to keep a certain amount in the original wallet, opened normally with a PIN, and the bulk in a passphrase-protected wallet. Under duress you open the original, and the other party has no way of knowing another wallet exists.
The idea works technically, but it comes with conditions worth stating honestly.
The original wallet has to hold a plausible amount — an empty one is not convincing. And you have to answer naturally under pressure, which is a situation nobody has rehearsed.
For most people in Thailand, the benefit that actually materializes is the far more common one: somebody finding a written recovery phrase by accident, through a household theft, a move, or building work at home, rather than direct coercion.
Choosing and backing up a passphrase
Do not use anything guessable. Names, birthdays, phone numbers, or a password you already use elsewhere are the first things an attacker will try — particularly since an attacker holding your recovery phrase can test unlimited guesses without needing your device at all.
Length matters more than complexity. A long passphrase you can actually remember is usually safer than a short tangle of symbols you cannot. Blockstream Jade offers a WordList entry mode that lets you build a passphrase from BIP39 words, designed precisely for this.
Check your device's maximum length first. Trezor accepts up to 50 ASCII characters, Ledger up to 100. Setting a passphrase longer than the device you plan to restore onto will cause problems later.
Always write it down, and store it separately from the recovery phrase. Memory alone is not a backup — recall fades, and you may not use the wallet for a year. Record it on something durable and keep it in a different location from your recovery phrase.
CryptoSafe
฿1,990
- Takes any printable ASCII character, not only BIP39 words
- Holds up to 123 characters — covers both Trezor's 50 and Ledger's 100
- Engraved tiles on a rod inside a sealed steel tube, 102 mm long, around 90 g
The reason this one suits a passphrase specifically: most steel backups are built around the BIP39 word list, but a passphrase is free text with capitals, digits and symbols, so it needs a product that takes every character. And because a metal tube does not look like anything to do with crypto, it is easier to store in a separate location than a flat plate.
Which devices support it
Because a passphrase is part of the BIP39 standard, most hardware wallets support one. The practical details differ.
| Brand | Maximum length | Details |
|---|---|---|
| Trezor | 50 ASCII characters | Can be entered on the device itself, without typing through a computer |
| Ledger | 100 characters | Can be attached to a second PIN, so a different PIN opens the passphrase-protected wallet |
| Blockstream Jade | BIP39 standard | Two entry modes: character by character, or selecting words from the BIP39 list |
| Tangem | About 100 bytes | Supports importing a wallet created elsewhere with a passphrase; cannot create one on the cards |
One note for Ledger owners: attaching a passphrase to a second PIN is far more convenient day to day, but it does mean the device stores that association. Anyone who wants the passphrase recorded nowhere at all should choose to enter it manually each time instead.
Trezor
฿3,890 ฿4,590-15%
- Passphrase entered directly on the device, never through the computer
- EAL6+ certified secure element, open-source firmware
- Backup as 12, 20 or 24 words; setup through Trezor Suite
Adding: Cosmic Black. Three other colors on the product page.
Trezor is the brand most people in Thailand associate with passphrases: it has supported the feature for a long time, documents it thoroughly, and allows entry on the device itself rather than through a computer keyboard, which removes the risk of a keylogger seeing it.
Ledger
฿2,060
- Passphrase up to 100 characters, attachable to a second PIN
- CC EAL6+ certified secure element — a higher grade than the pricier Nano X
- Computer and Android only. It does not work with iPhone
Adding: Matte Black. Four other colors on the product page.
The lowest-cost route to using a passphrase on a device with a certified chip. The thing to confirm before ordering is that this model does not support iPhone — anyone managing crypto on one should check which models support iPhone first.
Common questions
How is a passphrase different from a recovery phrase?
A recovery phrase is the set of 12 to 24 words the device generates at random during first setup — you do not choose it. A passphrase is text you choose yourself and add afterwards. The recovery phrase restores your original wallet; the passphrase creates a new wallet from that same recovery phrase.
Do I need to use one?
No, and most beginners should not. A correctly set up hardware wallet with a well-stored recovery phrase is already secure enough for most people. A passphrase genuinely adds security, but it also adds a way to lose your own assets. Start using one when you fully understand the mechanism and have a backup plan ready.
Can a forgotten passphrase be recovered?
No. Trezor states clearly that a passphrase cannot be changed, removed or recovered. Because the value is never stored anywhere, there is nothing to recover. Manufacturers and retailers cannot help in any circumstance.
How many passphrase wallets can I create?
There is no limit — every different text gives a different wallet. In practice though, each one is something more to remember and back up, so having many increases risk rather than security.
Can I use a passphrase with a different brand of wallet?
Yes. Because it is a BIP39 standard, you can restore a recovery phrase plus passphrase onto another device supporting the same standard. Check that the destination device accepts the length of passphrase you are using.
How is it different from a PIN?
A PIN protects the device and is stored on the chip, and it can be changed later. A passphrase protects the wallet and is stored nowhere. Someone with your device but no PIN cannot use it; someone with your recovery phrase but no passphrase reaches only the original wallet.
Someone claiming to be support asked me to confirm my passphrase or recovery phrase. Is that normal?
It is not, and it is fraudulent in every case without exception. Neither SIAMBC nor any manufacturer has any policy of asking customers for a passphrase or a recovery phrase, whatever reason is given.
Buying in Thailand
Every passphrase-capable hardware wallet mentioned here is in stock at our shop in Thawi Watthana, Bangkok, with free delivery nationwide within one to two business days. Within Bangkok, same-day delivery is available by Grab or LINEMAN, arranged through LINE.
If you are considering enabling a passphrase, come and talk it through at the shop. Our team will explain the mechanism and check that your backup plan is solid before you start using one in earnest — which matters more than which device you choose. The shop is open Monday to Saturday, 9:00 to 17:00.
See all hardware wallets or contact us before deciding.
One rule to remember
Anyone who asks for your 24-word recovery phrase or your passphrase is a scammer. No exceptions.
Neither SIAMBC nor any manufacturer will ever ask for either, whatever reason is given — warranty claims, identity verification, system updates or account recovery. Those 24 words and that passphrase are the keys to your funds. Whoever has them owns your crypto, and it can never be recovered.
Share:
Microsoft warns of Cryware, malware targeting hot wallets
Which Hardware Wallets Work With iPhone (And Which Don't)