Hardware wallet maker Trezor has increased the maximum length of optional wallet passphrases from 50 to 128 characters.
On Sunday, Trezor said the change is available in Trezor Suite with updated device firmware. Older firmware versions still limit passphrases to 50 characters.
According to Trezor, a passphrase acts as an additional password that users set alongside their wallet’s recovery phrase. An attacker who obtains the recovery phrase would still need the correct passphrase to access the funds in that wallet.
Trezor cited July attacks on Coldcard, when a firmware vulnerability caused some devices to generate recovery phrases with insufficient randomness, allowing attackers to recover them. According to Trezor, strong, unique passphrases protected some affected users.
The update followed a separate warning involving Trezor’s own devices.
On Friday, the company advised customers who had bought wallets from former authorized reseller CryptoBilis since March to transfer their funds to new wallets.
An Indonesian customer reported a suspected implant inside a Trezor Safe 5 that could read information from the screen, including recovery phrases, and transmit it over a cellular network. On Friday, Trezor said it had not examined the device and had received no reports of related losses.
