Passphrase: What is it & when to use it (or not to)

[Cleanshit]

I get where you're coming from man, but I don't agree. If the goal's an extra security layer against coldcard-like situations though, then why not also take the opportunity to protect it physically yea the chance's low but what if...? It's really just 2 things to hide instead of 1, not like 100, it's not such a big deal imo

Exactly, physical protection is very important. As an extra layer is useful so a passphrase also, most importantly if the seed phrase is being ever exposed but this introduce things that will be backup correctly. Personally I don’t see passphrase as the important thing only, but also making sure you have a proper backup abd a recovery plan for both passphrase abd seed. The risks of theft should be reduce by security, without having to create any risk or even losing access

[DYING_S0UL]

It should be noted that some HW device wallets have limits in Passphrase, and that if a Passphrase is created with strong entropy, it is better than a Passphrase with long word characters, as the probability of forgetting it or writing one of the characters incorrectly is high, and then you will not be able to know which character is incorrect since there is no checksum.

What kind of limitations exactly? Like not supporting additional passphrase importation?

I never got curious about passphrase before, but now i am. I know we can add an additional passphrase when creating a wallet, but I was thinking like, can a passphrase contain multiple words separated by a space? Or will the whitespace still counts as part of a single passphrase? I only ever tried adding one additional phrase/string but never multiple words (separately). Or are the rules like either 12 or 13 or either 24 or 25? Just a curious question (or maybe two )..
 

[Pumpsta]

Thx guys, I learned something new now I tried to make the electrum passphrase longer than just a few chars.... +15k characters later it still lets me to write more

My tested passphrase:

Code:

123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890

But I found out Trezor & Ledger has a character limit (50 for trezor, 100 for ledger). That's not cool I'll add these to my thread & if anyone knows more HWs with limits I'd appreciate if u share it here!

[satscraper]

~

No sense ^{and even dangerous}in using 155-character-long passphrase consisting entirely of digits.

Make it shorter, but have it consist of the mix of uppercase, lowercase, digits, and special characters. What really matters is entropy. Read here for details.

P.S. Entropy is roughly the size of the search space, and you might want to learn about Gibson's trick to increase this space without adding complexity to the passphrase itself.

[Pumpsta]

No sense ^{and even dangerous}in using 155-character-long passphrase consisting entirely of digits.

Make it shorter, but have it consist of the mix of uppercase, lowercase, digits, and special characters. What really matters is entropy. Read here for details.

P.S. Entropy is roughly the size of the search space, and you might want to learn about Gibson's trick to increase this space without adding complexity to the passphrase itself.

You're right, electrum being unlimited is still cool imo though & that makes HWs not as cool!
I'd say it's like really easy to mess up after about 20-25 chars speaking from my own mishappenings with veery long passwords in the past. I added all this stuff to OP, I need to remove the orange color from trezor & ledger's name tho, makes it look like it's better to have 100 characters minimum

[Coyster]

I would be interested to hear how experienced users balance these two risks.

It is really not rocket science, you back up your passphrase, just like you do your seed phrase and then store both of them in different locations. There is a risk of storing them together, which you must avoid, and so they must be stored separately. Because if they are both exposed at the same tme, the attacker would easily steal your funds. Though, what's most important about a passphrase is that you understand it well before using it, so you don lose your funds from your own error.

[Stalker22]

I never got curious about passphrase before, but now i am. I know we can add an additional passphrase when creating a wallet, but I was thinking like, can a passphrase contain multiple words separated by a space? Or will the whitespace still counts as part of a single passphrase? I only ever tried adding one additional phrase/string but never multiple words (separately). Or are the rules like either 12 or 13 or either 24 or 25? Just a curious question (or maybe two )..

Yes, a passphrase can definitely be multiple words separated by spaces, and every single space counts as an actual character.  (I think that is why it is called passphrase and not password.)  That means spaces, special characters, capital letters, and numbers are all valid.  Just keep in mind: because spaces count, spacing matters too.  For example, "blue sky" (one space) and "blue  sky" (two spaces) will generate two completely different, unrelated wallets.

[arwin100]

I would be interested to hear how experienced users balance these two risks.

It is really not rocket science, you back up your passphrase, just like you do your seed phrase and then store both of them in different locations. There is a risk of storing them together, which you must avoid, and so they must be stored separately. Because if they are both exposed at the same tme, the attacker would easily steal your funds. Though, what's most important about a passphrase is that you understand it well before using it, so you don lose your funds from your own error.

Correct on that because the passphrase is not something that they add then forget. By the time they use that, then basically they are just creating another key in their wallet. So same with their seed phrase it also need to be protected.

People often overlook the risk and they didn't notice that mistakes usually happen the way how they handle those things and not on the passphrase itself. If they used it without trying to understand how this thing work. There's a chance that they might lost it and cannot retrieve the funds inside on their wallet. So best prioritize to learn the basic and try to secure those important things to avoid losing their money.

If they master those basic way to make their wallet safe. Adding passphrase will became their strong extra layer of protection.

[DYING_S0UL]

Yes, a passphrase can definitely be multiple words separated by spaces, and every single space counts as an actual character.  (I think that is why it is called passphrase and not password.)  That means spaces, special characters, capital letters, and numbers are all valid.  Just keep in mind: because spaces count, spacing matters too.  For example, "blue sky" (one space) and "blue  sky" (two spaces) will generate two completely different, unrelated wallets.

So if i got everything properly, multiple words, strings, character, with spaces in between them can be used for a passphrase, but the whole thing still counts as one single phrase, right? Right?
Yeah thanks I understood your blue sky reference! Now i just have to test it inside electrum then

P.S. Entropy is roughly the size of the search space, and you might want to learn about Gibson's trick to increase this space without adding complexity to the passphrase itself.

This GRC seems like an interesting site. I wonder what kind of super computer can make one hundred trillion guesses per seconds!  

[Pumpsta]

Guys I'm trying to understand something, most of my thread's replies are like corrections, suggestions or other stuff, does anyone think my info's helpful or is my thread really shitty?

[YellowSwap]

It should be noted that some HW device wallets have limits in Passphrase, and that if a Passphrase is created with strong entropy, it is better than a Passphrase with long word characters, as the probability of forgetting it or writing one of the characters incorrectly is high, and then you will not be able to know which character is incorrect since there is no checksum.

What kind of limitations exactly? Like not supporting additional passphrase importation?

I never got curious about passphrase before, but now i am. I know we can add an additional passphrase when creating a wallet, but I was thinking like, can a passphrase contain multiple words separated by a space? Or will the whitespace still counts as part of a single passphrase? I only ever tried adding one additional phrase/string but never multiple words (separately). Or are the rules like either 12 or 13 or either 24 or 25? Just a curious question (or maybe two )..
 

This is not a safe way of using Passphrase and I want you to know that every extra words you add makes it more stronger, even a single space matters too.

The more the words you add the stronger it becomes, I add extra words with some quotation marks and space, where you don't want to go wrong is writing down the wrong Passphrase, if you miss a simple space or something you will lost access to your coins.

Better write the passphrase down in a book and test it out before making your first deposit into the wallet with passphrase enabled, I hope this isn't too complicated to understand.

[Emjay24]

if you setup this wallet in an unsafe environment/device, the result will be the same, it's catastrophic. So be responsible enough to do scan your device regularly, avoid downloading and installing stuff from random website to avoid malware stealing info.

I think the best way to deal with your bitcoin is separating it from a regular device that you use for daily activities, If you have a seed phrase + Passphrase for your major holding and you still use it on a hot device, it is a point of failure. Your main holding should be in an air gapped device. If you have a spending wallet, it shouldn't be in your regular device, you should have a second one that you use only for financial dealings and ensure you never connect it to a public wifi. When you separate these concerns, you further slim down the chances of social engineering affecting you.

[Berry2d]

if you setup this wallet in an unsafe environment/device, the result will be the same, it's catastrophic. So be responsible enough to do scan your device regularly, avoid downloading and installing stuff from random website to avoid malware stealing info.

I think the best way to deal with your bitcoin is separating it from a regular device that you use for daily activities, If you have a seed phrase + Passphrase for your major holding and you still use it on a hot device, it is a point of failure. Your main holding should be in an air gapped device. If you have a spending wallet, it shouldn't be in your regular device, you should have a second one that you use only for financial dealings and ensure you never connect it to a public wifi. When you separate these concerns, you further slim down the chances of social engineering affecting you.

The use of different devices for our bitcoin investment activities and normal activities is a very good idea, most times our devices are given out to others without knowing most of this said people never have genuine intentions towards us and giving our devices to such people is same as digging our graves ourselves indirectly.
If separate devices are used for both activities,  it will be very difficult giving people access to that private device because it will only be used by the person except the bearer decides to release that information to someone else maybe for a reason beat known to him or her.

[knowngunman]

Guys I'm trying to understand something, most of my thread's replies are like corrections, suggestions or other stuff, does anyone think my info's helpful or is my thread really shitty?

Of course, your thread is helpful and educative which is the reason you received some merits.

The forum is called Bitcointalk for a reason. Different people share different opinions and ideas here but that doesn't mean your thread is a shitty one. It'd have been moved to trashcan or deleted if it's not useful. The primary purpose of every thread is to generate genuine, helpful and educative discussion. Corrections and suggestions is necessary to make sure everything works fine for all.

[elda34b]

most times our devices are given out to others without knowing most of this said people never have genuine intentions towards us and giving our devices to such people is same as digging our graves ourselves indirectly.

I can't remember the last time I lend my phone to my friend. Maybe back when I was in uni, but even at that point I don't think we'll let people use our devices without any security in place. Stuff like folder with password, separate account, and so on are quite common. Maybe it's a different of environment, but most of my peers seems to have a degree of awareness about data leak or malwares even if they don't touch crypto at all.

I still support separating devices for hot/cold wallet purpose though. It's easier to contain them if you got hit with malwares and stuff.

[promise444c5]

electrum being unlimited is still cool imo though & that makes HWs not as cool!
I'd say it's like really easy to mess up after about 20-25 chars speaking from my own mishappenings with veery long passwords in the past.

Well.. it really depends on why you need that much character in the first place.. but of course, Electrum got you covered. 11~12 Combinations is already enough, longer characters are prone to mistakes when you are backing it up  or even importing [as test or not].. unless you’re considering encoding it into a QRcode which is going to be accurate when trying to import .

I prefer what I can write down anyway without making mistakes.

[BlackBoss_]

Well.. it really depends on why you need that much character in the first place.. but of course, Electrum got you covered. 11~12 Combinations is already enough, longer characters are prone to mistakes when you are backing it up  or even importing [as test or not].. unless you’re considering encoding it into a QRcode which is going to be accurate when trying to import .

I prefer what I can write down anyway without making mistakes.

You can use both, writing down wallet seed phrase and printing the QR code as your wallet backups but backup itself must be made for multiple backups. It's very important to test your wallet backups for wallet recovery, then comparing the original wallet and the recovered wallet from backup before you start to fund that wallet.

After another testing step with small funding, you can check both wallets again to confirm that everything was backed up accurately and can be used for wallet recovery in the future.

Many people ignored testing steps and when they used backup to recover wallet, it's too late to fix mistake.
How to back up a seed phrase?

Seed Backup Threat Model
We already know why we are creating seed backups - to protect against loss of whatever devices (if any) we are storing the keys on for regular use. But what do we need to worry about protecting the backups themselves against?
    Loss due to destruction
    Loss due to complexity / not being able to restore from backup
    Loss to an attacker

Test Your Backup
Regardless of which backup scheme you choose, if you don't actually do a test run of restoring a wallet from it, you can't be confident that it will work when you actually need it.

How should you go about testing your backup?
    Create a new wallet.
    Create your seed phrase backups.
    Deposit a small amount of funds into the wallet, like $10 or $20 worth.
    If possible, create a new wallet with a different name, otherwise delete your current wallet.
    Initialize the new wallet using your seed phrase backup, make sure the funds appear in the wallet, and that you can spend them.

[promise444c5]

You can use both, writing down wallet seed phrase and printing the QR code as your wallet backups but backup itself must be made for multiple backups. It's very important to test your wallet backups for wallet recovery, then comparing the original wallet and the recovered wallet from backup before you start to fund that wallet.

Yes that’s right

The point of my post is basically on long characters though .. the longer the character the higher the chance of making a mistake [like typos , omission , replacement…] so I wasn’t really sure why OP think it’s really cool.  

A smaller character length beyond >10 with appropriate combinations is usually going to have a good entropy already but if OP still think it’s really cool to try out then they should use a qrcode which is easier to recover without making mistakes.