When setting up a self-custody wallet, the first step is often to write down a set of English words. Many people just take a screenshot and move on, without realizing that these words are the wallet’s real key.
Related asset: $BTC Quote 73,684 (24h -2.18%).
■ What is a recovery phrase?
A recovery phrase usually consists of 12 or 24 English words, generated according to the BIP-39 standard from a list of 2,048 words. Using words instead of a long string of random numbers makes it easier to write down and verify by hand.
A recovery phrase can be used to derive the private keys for all the addresses in a wallet. That’s why it’s more important than any individual private key: if someone gets your recovery phrase, they effectively get your entire wallet.
■ A password is not a recovery phrase
The unlock password you set in your wallet is only used to open it on this device. If you switch phones or uninstall and reinstall the app, you’ll need your recovery phrase—not that password—to restore your wallet.
Self-custody wallets don’t have a “forgot password” option: there’s no central authority holding your keys for you. If you lose your recovery phrase and have no other backup, the assets in your wallet are basically unrecoverable.
■ The most common ways recovery phrases get exposed
Taking a screenshot and saving it in your photo library, uploading it to a cloud drive or notes app, or sending it to your own chat account as a “backup” all amount to storing your keys somewhere connected to the internet.
Another common risk is scams: fake customer service reps, counterfeit wallet websites, or pop-ups may ask you to enter your recovery phrase under the pretext of “verification,” “synchronization,” or “claiming an airdrop.”
■ How to store it more securely
Write your recovery phrase by hand on paper and store it offline. For extra security, make another copy and keep it somewhere else. After copying it, test restoring your wallet with a small amount of assets to make sure you copied it correctly.
Customer support at legitimate wallets and trading platforms will never ask for your recovery phrase. Remember this, and you can avoid most scams that target recovery phrases.
■ In a nutshell
Wallet security ultimately comes down to good habits: keep your recovery phrase offline, never share it with anyone, and make sure your backup works. Do these three things, and you’ll avoid most risks. Treat any “technical support” that contacts you out of the blue as a scammer. Official support will never ask for your recovery phrase.
Have you ever fallen for a similar trap? Share your experience so others can avoid the same mistake.