01 / SCOPE & SYSTEM MODEL
A backup is a recovery system.
A wallet can be replaced. The information needed to recover it may not be. A durable record is useful only if it remains intact, can be found, and can be decoded correctly.
PENGER v1.0 records BIP39 word positions as punched marks on a titanium plate. It is a passive storage medium: it does not generate keys, sign transactions, connect to a network or encrypt the recorded information. The objective is to reduce dependence on combustible writing materials and powered storage devices.
Availability means the record can be retrieved. Confidentiality means recovery information stays private. Correctness means the recorded words and wallet settings restore the intended wallet. A physical backup needs all three.
The scope is a correctly generated BIP39 mnemonic of up to 24 words. Other recovery formats are not automatically compatible. A BIP39 passphrase, derivation path, network, account selection or multisignature policy may also be required. The phrase is not always the entire recovery package. BIP39 specification ↗
02 / ENCODING SPECIFICATION
Words → numbers → marks.
BIP39 uses a list of 2,048 words. Its zero-based word index runs from 0 to 2,047 and fits into 11 bits. PENGER’s physical convention uses the human-readable position 1 to 2,048, so the plate has 12 weighted positions per row. These are different representations of the same word, not different entropy levels.
Why use numbers?
A fixed grid turns recording into a sequence of marked or unmarked positions. The reader sums known weights instead of interpreting handwritten letters. This trades direct word readability for a repeatable encoding process and a dependency on the correct dictionary. It does not eliminate mistakes: a missed mark changes the number, and a correct number in the wrong row changes the phrase.
Decode by summing the weights.
Read each row in its original order. Add the weights of the punched cells, then look up that numbered position in the exact wordlist used for encoding. For software arrays, subtract one before indexing. An English wordlist position must not be decoded with a different language’s list.
| Word | BIP39 index | Plate position | 12-position pattern |
|---|---|---|---|
| abandon | 0 | 1 | |
| night | 1196 | 1197 | |
| zoo | 2047 | 2048 |
Dark dot = punched (1). Light dot = unpunched (0). Positions run from weight 2048 on the left to 1 on the right.
A blank row sums to zero and is not a valid encoded word. Values above 2,048 are invalid. The extra physical position is needed to represent 2,048; it is not a parity bit and adds no error correction. Preserve the phrase length and never interpret unused rows as words.
Checksum is detection, not repair.
BIP39 appends a checksum before dividing the mnemonic into 11-bit groups: 128 bits of entropy plus 4 checksum bits yield 12 words; 256 plus 8 yield 24 words. Of uniformly random word sequences of those lengths, approximately 1 in 16 and 1 in 256 respectively passes the checksum. This is not a guaranteed error-detection rate for particular punching mistakes. A valid checksum does not prove that the intended wallet has been recovered. BIP39 algorithm ↗
The optional BIP39 passphrase changes the derived seed. A mistyped passphrase can produce a different, valid wallet. Verify recovery using the intended wallet’s receive address or another independently recorded identifier, not merely a “valid phrase” message.
Inspect the wordlist and index convention ↗03 / MATERIAL & LIMITS
A durable medium.
A bounded claim.
The product is specified as a Grade 2 commercially pure titanium plate. Mechanically punched marks remove the dependency on ink adhesion or a powered display. The sleeve is an accessory; it is not a fire-rated enclosure.
- Recording medium
- Grade 2 titanium, as specified by PENGER
- Record structure
- Up to 24 word rows × 12 weighted positions
- Encoding
- One-based BIP39 word positions, 1–2048
- Reading dependencies
- Legible marks, row order, exact wordlist & encoding instructions
- Electronics
- No battery, firmware, radio or network interface in the plate
Melting point is not a fire rating.
The Royal Society of Chemistry lists elemental titanium’s melting point as 1,670°C. This does not establish the temperature at which a finished backup remains readable. Exposure duration, oxygen, contaminants, applied load, cooling and the depth of each mark all matter. A claim of successful recovery after fire requires evidence for the finished, marked product under stated conditions. RSC material reference ↗
Corrosion resistance has a mechanism.
Titanium forms an adherent oxide layer in air that contributes to its corrosion resistance. This material property does not guarantee legibility after arbitrary chemical exposure. Abrasion and contamination can also make an intact surface harder to interpret. Storage conditions and post-exposure readability belong in qualification testing. Grade 2 material reference ↗
This paper does not establish a certified fire, immersion, impact or service-life rating for PENGER. Material selection is the design rationale; a published test protocol and results are needed to substantiate product-level survival claims.
04 / VERIFICATION PROTOCOL
Test the recovery, not the promise.
Rehearse with public sample data.
Practise the index convention, tool handling and decoding before recording a real secret. Never enter a real recovery phrase into this website or send it to support.
Read back the finished record.
Decode independently, row by row, and compare every word and its order with the original. Inspect marks and labels under more than one lighting angle.
Verify the intended wallet.
Use the recovery-check process of a trusted wallet in a controlled environment. Check the passphrase and account settings where applicable. Do not erase the only known-good copy before verification.
Keep the recovery plan current.
Review access, location hazards and instructions periodically and after a significant event. Avoid unnecessary handling or copying of the secret.
Qualification work that can support stronger claims
A meaningful product test should disclose the sample count and lot, material traceability, geometry, marking depth, exposure profile and acceptance criteria. Fire testing should report time and temperature, atmosphere and cooling. Wet exposure should specify chemistry, temperature and duration. Mechanical testing should specify loads, supports and impact orientation.
The relevant endpoint is correct recovery of every word in order by an independent reader after the test, including row and weight labels. Record failures and unreadable samples as well as successes. A photograph of an intact plate is not, by itself, a recovery result.
05 / THREAT MODEL
What the plate changes.
What it does not.
| Threat | Design response | Residual risk |
|---|---|---|
| Fire & heat | Information is punched into metal instead of relying on paper or ink. | Oxidation, deformation, debris and loss of access. Readability after exposure requires testing. |
| Flood & moisture | A passive record does not require functioning electronics or soluble ink. | Loss in moving water; deposits, contamination and chemical attack; unsafe retrieval. |
| Collapse & impact | A one-piece plate avoids loose character tiles. | Bending, crushing or abrasion can obscure marks and row labels. |
| Theft & photography | No built-in protection. The record must be physically secured. | Anyone who can read the dots can reconstruct the words. Binary is not encryption. |
| Malware & phishing | The stored plate has no network interface. | Key generation, cameras, online transcription and compromised recovery devices remain attack paths. |
| Human error & inheritance | A documented wordlist and weighted grid support manual decoding. | Wrong word order, shallow marks, forgotten passphrases or missing recovery instructions. |
A hardware wallet and a physical backup perform complementary jobs: one controls everyday signing, the other preserves recovery information. Durable storage cannot undo a compromised phrase or authorise recovery without all required credentials.
06 / ENVIRONMENTAL EVIDENCE
The home is part of the threat model.
Fire, flood, displacement and structural damage can destroy a device and its nearby backup in the same event. These examples establish that the hazards are real; they do not measure cryptocurrency losses or predict an individual household’s risk.
Paper can burn or tear, and water can damage its fibres or make some inks run. Its useful life depends on the paper, ink and storage environment. A paper copy stored with the original device may share the same exposure. A marked metal record addresses some of these material weaknesses, while secure storage and independent access remain essential.
Estimated residential building fires
The U.S. Fire Administration reports an estimated $11.27 billion in dollar loss for this category in 2023. A backup kept beside a wallet can share its exposure to heat, smoke, suppression water and debris.
Source: U.S. Fire Administration ↗Residential units affected
The assessment of the Kakhovka dam disaster reports more than 37,000 affected residential units, with 15% damaged beyond repair. Water can also transport or bury an intact backup, making retrieval impossible.
Source: Government of Ukraine / UN assessment ↗Districts affected
WHO reports that seven districts were severely affected and more than 50 health facilities were damaged. Flooding and landslides can isolate communities and interrupt the infrastructure on which recovery depends.
Source: World Health Organization ↗Nepal: multiple hazards in one region.
Nepal’s Department of Hydrology and Meteorology recorded 239.7 mm of rain in 24 hours at Kathmandu Airport during the September 2024 event, exceeding that station’s previous 177.0 mm record from July 2002. Separately, NASA observed widespread fire hotspots and smoke across Nepal on 28 April 2016. These observations illustrate different exposures; the satellite image alone does not establish a count of destroyed homes or climate attribution. Nepal DHM report ↗ NASA observation ↗
A water-resistant record that cannot be retrieved is still unavailable. Material selection and geographic separation address different parts of the problem.
Climate changes the exposure, not the encoding.
At the global scale, the IPCC projects heavy precipitation to intensify at about 7% per 1°C of global warming, with high confidence and regional variation. Higher warming also increases compound hot, dry and windy fire-weather conditions in some regions. This is not a 7% increase in any individual home’s flood probability. Local exposure also depends on drainage, land use, ignition sources, building practices and preparedness. IPCC AR6, Chapter 11 ↗
A single disaster cannot be attributed to climate change merely because it involved fire or rain. The Kakhovka case concerns dam destruction during war. For a record intended to last decades, reassess storage after changes to flood exposure, building condition or access. The aim is a plan that tolerates a lost location.
07 / STORAGE ARCHITECTURE
Separate the failure domains.
Two copies in the same house may share the same fire, flood, burglary or access restriction. Geographic separation can reduce this common exposure, while increasing the number of places from which the secret could be stolen. The design decision must consider both loss and disclosure.
- LOCATION APrimary record
- Controlled physical access.
- LOCATION BRecovery copy
- A separate location and retrieval route.
Separation should account for shared flood zones, buildings and access restrictions. Two rooms in one property may still share the same loss event.
As a simplified model, if each location has loss probability p over the same interval and the losses are independent, joint loss is p2. If the loss events are fully correlated, joint loss can remain p. These are mathematical assumptions, not measured failure rates for PENGER. Regional floods, conflict and shared access arrangements can invalidate independence.
Document recovery without publishing the secret.
Record the wallet type, relevant network and account settings, wordlist language and the existence of any passphrase in a recovery plan. Decide who may locate it and under what conditions. Review this plan when moving, changing wallet software or changing trusted contacts.
Do not improvise security by splitting the words into arbitrary fragments. A multisignature or standardised secret-sharing design has different recovery requirements and should be tested as a complete system. Multiple plates alone do not create either scheme.
08 / SOURCES & METHODOLOGY
Evidence you can inspect.
Statistics are dated observations, not forecasts. The cases use different units and populations and should not be combined into a single risk score. Engineering implications in this paper are PENGER’s analysis; the organisations cited do not endorse the product.
- Bitcoin Improvement Proposal 39 — Mnemonic code for generating deterministic keysPrimary specification: entropy, checksum, word indices and passphrase derivation.
- BIP39 English wordlistPrimary reference for the worked example and boundary cases.
- U.S. Fire Administration — Residential building fire estimates2023 estimates; U.S. residential buildings. Not a measure of crypto losses.
- Government of Ukraine & United Nations — Kakhovka Dam Post-Disaster Needs AssessmentOctober 2023 assessment of the June 2023 disaster; affected housing units.
- WHO Nepal — September 2024 floods and landslidesReported geographic and health-system impacts of the event.
- Nepal DHM — Extreme precipitation and flooding, 27–29 September 2024Station-specific rainfall observations, including Kathmandu Airport.
- NASA Earth Observatory — Fires and Smoke in NepalSatellite observations from 28 April 2016; published 29 April 2016.
- IPCC AR6 WGI, Chapter 11 — Weather and Climate Extreme EventsExtreme precipitation and compound fire-weather assessments, with geographic caveats.
- Royal Society of Chemistry — TitaniumElemental material reference; not a product certification.
- voestalpine Specialty Metals — Titanium Grade 2Material supplier reference on the protective oxide layer; not a PENGER test report.
Clarifies the 12-position plate convention, adds environmental evidence and separates material properties from product qualification. This edition supersedes the earlier whitepaper’s unqualified survival claims.