The 25th Word (Passphrase)

The BIP39 passphrase is integrated into the key derivation process at the PBKDF2 layer. Understanding the exact mechanism reveals why it is so effective:

Key Properties

• No validation — any passphrase produces a valid seed. There is no checksum or error detection for the passphrase itself. A typo does not produce an error — it produces a different (empty) wallet.
• Deterministic — the same mnemonic + passphrase always produces the same seed, on any device, with any compatible software.
• Salt-based — the passphrase modifies the salt, not the password. This means pre-computed rainbow tables for common mnemonics are useless because the salt space is effectively infinite.
• NFKD normalization — per BIP39, both the mnemonic and the passphrase are Unicode NFKD-normalized before processing. This ensures consistent behavior across platforms for non-ASCII characters.

The security benefit of a passphrase depends on its entropy. A weak passphrase can be brute-forced by an attacker who already has the seed phrase.

Attack Scenario

If an attacker obtains your 24 seed words but not your passphrase, they must brute-force the passphrase to access your funds. The cost of this attack depends on:

1. The entropy of the passphrase (search space)
2. The cost of each guess (PBKDF2 with 2,048 iterations of HMAC-SHA512, followed by BIP32 derivation and address checking)

Passphrase Entropy Guidelines

• 4-character PIN — ~13 bits of entropy. Crackable in seconds. Not recommended.
• Common English word — ~11 bits. Dictionary attack trivial.
• 3-word Diceware passphrase — ~39 bits. Resistant to casual attackers but vulnerable to determined, well-funded adversaries.
• 5-word Diceware passphrase — ~65 bits. Provides strong protection even against well-resourced attackers.
• 8+ random alphanumeric characters — ~48 bits. Adequate for most threat models.

PBKDF2 Brute-Force Cost

The 2,048 PBKDF2 iterations provide a modest computational barrier. On modern GPU hardware, an attacker can test approximately 100,000-500,000 passphrases per second per GPU. With a cluster of 10 GPUs:

While the BIP39 passphrase is a standard, its implementation varies across wallet software and hardware devices:

Hardware Wallets

• Ledger — supports passphrase entry via the device itself (temporary or attached to a PIN). Temporary passphrases must be re-entered each session. PIN-attached passphrases create a persistent second "hidden" account.
• Trezor — passphrase entered on the host computer or on the Trezor touchscreen (Model T / Safe 3). Host-entry is less secure (keylogger risk); on-device entry is preferred.
• Coldcard — supports on-device passphrase entry with the option to save an encrypted version on the device. Also supports multiple passphrase slots.
• Keystone — passphrase entered via the device's touchscreen, fully air-gapped from the host.

Software Wallets

• Sparrow — supports passphrase during wallet creation and restore. Displays the passphrase-derived fingerprint so you can verify you entered it correctly.
• Electrum — supports BIP39 passphrase during seed import (must enable BIP39 mode).
• BlueWallet — supports passphrase for BIP39 wallets during creation.

Beyond the basic hidden wallet use case, the passphrase enables several advanced security configurations:

Multi-Tier Wallet Architecture

Use multiple passphrases with the same seed to create a tiered structure:

• No passphrase — decoy wallet with minimal funds
• Passphrase A — medium-security wallet for regular transactions
• Passphrase B — high-security cold storage for long-term holdings

Each tier has its own addresses, keys, and balances. Compromise of one passphrase does not affect the others.

Passphrase + Multi-Sig

For maximum security, combine the passphrase with a multi-sig setup. Each cosigner's key can be passphrase-protected independently, creating a layered defense: an attacker must obtain M seed phrases and their corresponding passphrases to sign a transaction.

Geographic Separation Pattern

• Location A (home safe) — Seed phrase backup on metal plate
• Location B (bank safety deposit box) — Passphrase backup on metal plate
• Location C (trusted family member) — Second copy of seed phrase (for disaster recovery)

An attacker must compromise two separate secure locations to access funds. A natural disaster destroying Location A still allows recovery using Locations B + C.

The passphrase protects against specific threat scenarios and is ineffective against others. Understanding its place in your threat model is essential:

Effective Against

• Physical seed compromise — if someone finds or photographs your seed phrase, they still cannot access passphrase-protected funds
• Coercion (with decoy) — you can surrender the seed phrase and demonstrate a plausible decoy wallet
• Insider threats — a family member or roommate who discovers your seed backup cannot access the passphrase wallet
• Supply chain attacks — even if a hardware wallet ships pre-compromised, the passphrase is entered separately and the attacker cannot predict it

Not Effective Against

• Malware on the passphrase-entry device — a keylogger captures the passphrase as you type it
• Compromised wallet software — malicious software can exfiltrate both the seed and passphrase during entry
• Camera surveillance — if your passphrase is captured on video during entry
• Repeated coercion — an attacker who suspects a hidden wallet may not accept the decoy and escalate threats