Bitcoin wallet seed phrase with an optional (extended) passphrase

[joniboini]

I think the biggest take here is that fact that as much as hard wallets are open source and are cold wallets, they are not 100% safe. People like to treat them like they are very secure and can't be hacked.

I always think enthusiasts will never claim that open source software is 100% safe. If someone boldly say that, they probably don't know what they're talking about. Even the most popular software used regularly by most people, like Electrum, have been attacked through various ways. The key is how much can we verify. If the code is open source it'd be easier to check every single thing, which is why most people prefer them.

[Dogedegen]

~snip~
Yeah that would be about the range that I think is enough. Remembering is not good at all, but sometimes people get lazy and create their backups without checking things and that can also lead to problems.

Let's say you have a two-digit number of BTC in your wallet, would it be excessive to protect them with a passphrase of more than 20 characters? Of course, it would not be excessive, but it would also not make sense for me to use any hardware device, but I would only use an old laptop in airgapped mode, on which I would generate a seed that would be additionally protected with an extra strong passphrase.

Yes, most people are very lazy and think that nothing bad can happen to them, and that was the case with coldcard - when you least expect it, something very bad happens.

Well it depends also what perspective are you talking about with excessive. If a person is talking about the security side in relation to the value like you are, then yes it is not excessive. But security is not linear like that, a longer passphrase increases complexity and risk of a failed backup. There is some point after which each character added gives more risk to the user than it does the benefit, that was the point that I was trying to aim at. I do not know if literature has established this exact point, but I know that they have established this direction of the effect, This is one of the reasons why we need to be careful when we give advice to people. The passphrase length should be long enough to provide good security, but also related to the value that is being protected and be reasonable in the total length to avoid creating other issues.

[Darker45]

~snip~

Let's say you have a two-digit number of BTC in your wallet, would it be excessive to protect them with a passphrase of more than 20 characters?

I remember when I created a long passphrase with my hardware wallet, complete with small and big letter, numbers, special characters, space. My goodness, it indeed felt excessive!

I felt like my Trezor would fall apart. Imagine pushing those small fragile buttons countless of times just to finish half of it only to reenter them all over again because you're provided with a wallet with zero balance, and it's next to impossible to get it right after only a single attempt despite double-checking it.

But, yeah, I got your point. I was just reminded of the big difference between the ideal and the practical.

[Taskford]

~snip~

Let's say you have a two-digit number of BTC in your wallet, would it be excessive to protect them with a passphrase of more than 20 characters?

I remember when I created a long passphrase with my hardware wallet, complete with small and big letter, numbers, special characters, space. My goodness, it indeed felt excessive!

I felt like my Trezor would fall apart. Imagine pushing those small fragile buttons countless of times just to finish half of it only to reenter them all over again because you're provided with a wallet with zero balance, and it's next to impossible to get it right after only a single attempt despite double-checking it.

But, yeah, I got your point. I was just reminded of the big difference between the ideal and the practical.

Once of common reason on why there are people choose to use those manageable wallets and try to use strong passphrase.

Those wallet could actually handle those complex actions, but somehow the true cost of this is there are several people can't handle the changes and also the stress that might get.

So somehow a great lesson to get from them. Also best set up is the one they mentioned. but they should consider to use those things which they can able to operate then handle consistently, since its not good to look only cool in papers.

[Comeacross]

I saw one guy was doing some testing with generating several passphrase on stupid c0ldcard crap devices, and they all got drained right after they were generated.
That proves that it doesn't really matter if you used optional passphrases if you had weak entropy for generation seed words.

You mean you actually saw the wallet get drained right in front of him just after he generated it on the ColdCard? There's possibility the device was tempered with or probably a fake device or maybe the seed was already compromised? Perhaps, he was testing on already compromised old seeds but applying different passphrase. Of course, if your seeds were generated with a weak entropy, adding a passphrase doesn't change much and might be just useless.

[notocactus]

You mean you actually saw the wallet get drained right in front of him just after he generated it on the ColdCard? There's possibility the device was tempered with or probably a fake device or maybe the seed was already compromised?

Some cases reported in 2022 and in 2026 even with 2 word passphrase - I could not find that post but it was discussed somewhere perhaps in another thread.

In 2022, a brand new Coldcard user was drained after transferring funds to it.

https://www.reddit.com/r/Bitcoin/s/NJXFF7hI0a





This definitely makes it a scandal now, given that the victim was blocked for reporting this, and this could possibly see Coinkite employees getting put on trial for this.

Crazy to see the sweeps just need 10 seconds after the deposit.


https://x.com/we_satoshis/status/2085034468935450918

[Monetarium]

I saw one guy was doing some testing with generating several passphrase on stupid c0ldcard crap devices, and they all got drained right after they were generated.
That proves that it doesn't really matter if you used optional passphrases if you had weak entropy for generation seed words.

What does that mean? I made a thread on passphrases like a day before op & I genuinely thought I had it all right after all my prior research....but now I'm worried I don't have it all?! How can a rlly strong passphrase still get the btc swept?

On the swept wallets question, one thing worth separating out: the passphrase is not a password that gets checked anywhere. In BIP39 the seed comes out of PBKDF2 with the mnemonic as the password and the string "mnemonic" plus your passphrase as the salt, so there is nothing stored to compare your input against. The BIP says it outright, that every passphrase generates a valid seed and only the correct one makes the wallet you wanted available. A typo does not throw an error, it opens a different wallet that happens to be empty.

That is also why a strong passphrase does not really answer the sweep. It covers one case, the one where someone has your seed words and not the phrase. If the entropy was bad when the seed was generated then nobody is guessing anything, the same keys get derived and the passphrase never comes into it. And 2048 iterations is not much work per candidate if it does come down to guessing, so a memorable phrase buys less than its length suggests.

Coins moving seconds after a deposit reads more like that than like a search. If someone had to brute force their way in, the timing would not be that tight.

[Cookdata]

I think the biggest take here is that fact that as much as hard wallets are open source and are cold wallets, they are not 100% safe. People like to treat them like they are very secure and can't be hacked.

I always think enthusiasts will never claim that open source software is 100% safe. If someone boldly say that, they probably don't know what they're talking about. Even the most popular software used regularly by most people, like Electrum, have been attacked through various ways. The key is how much can we verify. If the code is open source it'd be easier to check every single thing, which is why most people prefer them.

An open source gives you protection, but it is limited to things that are hidden and the building components that create a project. However, being open source again does not fully protect you from what is hidden because just because it is public does not mean everyone can even verify it. Not everyone is a tech bro to run through everything on GitHub. I'm sure that if everyone knew how to verify firmware, the MK3 exploit wouldn't have happened in the first place.

Another thing is that if something is open source, you don't have to worry about the integrity of the software, but you still need to play your own part for security. Let's say you use a Trust Wallet app, and you get hack, your coins are drained, if you do everything right the first thing that will come to your mind is perhaps there is something wrong with the app that you don't know, only a closed source makes you doubt an app. An open source most often they are transparent unless something went wrong just like in the case of Coldcard firmware.

[Dogedegen]

An open source gives you protection, but it is limited to things that are hidden and the building components that create a project. However, being open source again does not fully protect you from what is hidden because just because it is public does not mean everyone can even verify it. Not everyone is a tech bro to run through everything on GitHub. I'm sure that if everyone knew how to verify firmware, the MK3 exploit wouldn't have happened in the first place.

Another thing is that if something is open source, you don't have to worry about the integrity of the software, but you still need to play your own part for security. Let's say you use a Trust Wallet app, and you get hack, your coins are drained, if you do everything right the first thing that will come to your mind is perhaps there is something wrong with the app that you don't know, only a closed source makes you doubt an app. An open source most often they are transparent unless something went wrong just like in the case of Coldcard firmware.

I think that you are mixing up a bit the concepts with small distinctions. When you talk about the word verify and process of verifying firmware, that is not the same as being able to understand or audit some big code online. When you talk about verification you are talking about making sure that the firmware on the device matches what you have downloaded or the original code. Knowing how to verify firmware or downloads would not prevent the MK3 exploit. The case of MK3 is clear, firmware verification would not prevent anything because the exploit comes from an error in the software implementation because an error made it use the wrong RNG implementation.

Teaching people to verify firmware is not that hard, we sometimes teach people to verify wallet software downloads with hashes and that. To learn that you don't need to be any kind of tech bro, it can be part of basic computer use. But to be able to read code and understand it is very hard, and to be able to find security bugs in code is even harder. So the issue that we had here is that there was a big code error that was overlooked by everyone for a long time, knowing how to verify firmware would not have prevented that.