Seed Phrases Explained: How They Work, How to Store Them, and What They Can't Recover

Imagine a single master key that opens every door in a building: the front door, the office, the safe. Now imagine that key is irreplaceable. No locksmith can cut a copy and no building manager holds a spare. That is what a seed phrase is in crypto. Lose it and you lose everything it protects. Let someone else hold it and they own everything.

This guide covers the whole subject in one place: what the 12 or 24 words actually encode, how they become keys for dozens of blockchains, how to store them, what they can and cannot recover, and the failure modes that only show up on the day you restore. If you only read one article about wallet security, make it this one.

In plain English

A seed phrase (also called a mnemonic or recovery phrase) is a list of 12 or 24 ordinary English words, something like correct horse battery staple, that together encode the master secret behind your entire crypto wallet. It is not a password you chose. It is a human-readable form of a random number so large that guessing it is computationally impossible.

When you restore a wallet on a new device, you enter the words in order and every address and private key that wallet ever created comes back. No account recovery, no support ticket, no waiting period. That is the whole point, and also the whole risk.

What a seed phrase actually is

The process is standardised by BIP-39 (Bitcoin Improvement Proposal 39), which defines how wallet software turns raw randomness into a word list.

1. The wallet generates a random number, called entropy: 128 bits for a 12-word phrase, 256 bits for a 24-word phrase. Five lengths are defined in total (128 bits gives 12 words, 160 gives 15, 192 gives 18, 224 gives 21, 256 gives 24).
2. A short checksum is appended. The wallet hashes the entropy with SHA-256 and takes the first few bits of the result: 4 bits for 128-bit entropy, 8 bits for 256-bit.
3. Entropy plus checksum is split into 11-bit chunks. Each chunk is an index into a fixed list of 2,048 English words, so every word encodes exactly 11 bits. This is why seed phrases always land on dictionary words, never arbitrary strings.
4. The result is 12 words for 128 bits of entropy, or 24 words for 256 bits.

Two design details matter in practice. The first four letters of every word in the list are unique, so abbreviated entry works without ambiguity. And the checksum makes typos detectable: when a wallet rejects a phrase on import, it is telling you the checksum does not match, which usually means a word is wrong or out of order, not that the funds are gone.

The word list is the same across every BIP-39 wallet. That is what makes a Zelcore seed phrase restorable in other compatible wallets, and vice versa.

For what a restored seed phrase brings back on a new device, read the guide to syncing Zelcore across devices.

A 12-word phrase gives 128 bits of security, the same level as a single Bitcoin private key. A 24-word phrase gives 256 bits. Both are infeasible to brute-force with current or foreseeable hardware, so the choice between them is about your threat model and your tolerance for writing down more words, not about one being "unsafe".

From words to a master seed: PBKDF2 and the passphrase

The words are not used directly as a key. They are the input to a key-stretching function.

PBKDF2 takes the mnemonic as a string and runs HMAC-SHA512 over it 2,048 times. The salt is the word mnemonic followed by an optional passphrase, sometimes called the 25th word. The output is a 512-bit value called the master seed. The stretching step makes brute-force attempts expensive even if an attacker has most of the phrase.

The passphrase is where a lot of people get hurt, so it deserves precision:

• It is not stored anywhere. Not on a hardware wallet, not in the app, not in the backup. It exists only in your memory or a separate written record.
• A different passphrase, including an empty one, produces a completely different master seed and therefore a completely different wallet. Two wallets from the same words and two different passphrases are cryptographically unrelated.
• A blank passphrase is valid and produces the standard wallet most users interact with.

The security model is two-factor: someone who steals the words but not the passphrase lands on the default wallet, which can be a decoy with a small balance. The trade-off is severe. Forgetting the passphrase is irreversible. There is no reset and no support path. The 25th Word covers when this feature is worth it; the short version is that beginners should master plain seed-phrase hygiene first.

From master seed to every key: BIP-32 and BIP-44

The 512-bit master seed is fed into HMAC-SHA512 with the fixed key string Bitcoin seed. The output splits in two: the left 256 bits become the master private key, and the right 256 bits become the chain code, a piece of entropy used in every later derivation step. Together they form the root of a hierarchical deterministic (HD) wallet as defined by BIP-32.

From that root the wallet derives an effectively unlimited tree of child keys. Each step mixes the parent key, the chain code and an index number through another HMAC-SHA512 run. Two modes exist:

• Hardened derivation uses the parent private key. Child keys derived this way cannot be computed even by someone holding the parent's extended public key (xpub). This is what stops a leaked xpub from cascading into private-key exposure.
• Normal derivation uses the parent public key, which lets watch-only wallets and exchanges generate deposit addresses without ever touching a private key.

BIP-44 standardises the path layout across coins:

m / 44' / coin_type' / account' / change / address_index

The coin_type differs per blockchain: Bitcoin is 0, Ethereum is 60, and so on across hundreds of registered coins. The apostrophes on the first three levels mean hardened derivation, protecting account-level keys even if an address-level xpub leaks. This is the mechanism that lets one seed phrase back up a whole multi-chain wallet: each chain lives at a different path under the same root, which is how Zelcore derives accounts for 80+ chains from a single phrase. The Multi-Chain Custody Problem goes deeper on that.

Because every step is deterministic, the same seed always produces the same keys. Knowing the master private key alone does not expose all child keys, because each derivation also needs the chain code. But the seed phrase gives you both. Whoever has the seed phrase has everything.

Why losing it is terminal

Blockchains have no password reset. No company holds a copy of your keys and no support form can retrieve lost funds. When you sign a blockchain transaction, you sign with a private key derived from your seed. If the seed is gone, so are the keys, and the funds at those addresses are locked permanently.

Researchers estimate that between 2.3 and 3.7 million BTC are permanently inaccessible, much of it lost because seed phrases and private keys were never backed up properly in Bitcoin's early years.

A hardware wallet PIN does not protect you here. After too many wrong PIN attempts a hardware wallet wipes itself. The device is gone, but your seed phrase, stored offline, restores it to a new device in minutes. Without the phrase, owning the physical device is not enough.

This is why every serious wallet setup asks you to write the phrase down immediately and verify it before you deposit a single coin.

What the seed phrase recovers, and what it does not

"I have my seed phrase, so I'm fine" is true for standard accounts and false for several things people assume are covered.

Recoverable from the seed alone:

• On-chain balances and transaction history for every standard BIP-44 account
• All derived addresses across all supported chains
• The ability to spend from any of them

Not recoverable from the seed:

• Hardware wallet PINs, custom account labels and address-book entries. These are device-local metadata.
• Lightning Network channel state. Lightning is off-chain; open channel balances need a static channel backup (SCB) file in addition to the seed.
• Watch-only configurations that used non-standard derivation paths.
• App-specific data such as portfolio tags, price alerts and custom RPC endpoints. In Zelcore, contacts and settings are re-created after a restore; your balances are not affected.

A hardware wallet reset is fully recoverable if the seed is intact and only the PIN was forgotten. If the seed is gone too, the device is a brick.

How to store your seed phrase

Once you understand what the phrase is, the rules become obvious.

Do:

• Write it down on paper, in order, the moment it appears during setup.
• Complete the verification step your wallet asks for, then do a real test restore before depositing meaningful funds.
• Keep at least two copies in physically separate, secure places: a fireproof safe, a safety deposit box, a trusted off-site location.
• For long-term holdings, engrave it on a metal backup plate. Steel or titanium survives the temperatures of a typical house fire and flooding. Paper does not.

Never:

• Photograph it. Photos sync to cloud services automatically on most phones.
• Type it into any app, extension or website unless you are deliberately restoring a wallet, and even then verify the software source.
• Email it or save it in a notes app, cloud document or online password manager.
• Share it with anyone. No wallet provider, exchange or support agent will ever ask for it. Anyone who does is trying to steal your funds. Zelcore support will never ask for your seed phrase.

Choose the medium for the threat you actually face

The question is not "which backup is best" but "what am I defending against". For most people the realistic threats are not targeted attackers. They are house fires, floods, burglary, and forgetting where the backup is.

• Paper is cheap and readable but degrades over years and does not survive fire or water.
• Metal survives both, costs more and takes longer to make. Once a holding would hurt to lose, metal is the practical choice.
• Digital copies (photos, cloud storage, password-manager notes) put the seed one account breach away from total loss. Not recommended for the seed itself.

Splitting the phrase is a trap

Storing half the words in one place and half in another is widely practised and weakens security. Finding half of a 12-word phrase collapses the search space enough for brute force. If you need to spread risk across locations, keep separate full copies, or use Shamir's Secret Sharing (SLIP-39), which splits the secret into N shares of which any M can rebuild it without weakening any single share. Trezor supports SLIP-39; support elsewhere is not universal.

Recovery failure modes nobody warns you about

These only appear at restore time, when the stakes are highest.

Forgotten passphrase. The words go in correctly. The wallet derives addresses with no balance. There is no error message. The funds sit in the passphrase-protected wallet, which is unreachable. This is the most common irrecoverable failure among people who enabled a passphrase and kept it only in memory.

Wrong derivation path. A wallet that used BIP-49 (wrapped SegWit) or BIP-84 (native SegWit) restored into an app defaulting to BIP-44 shows a different address set from the same seed. Balances look missing. Changing the derivation path in the new app's advanced settings fixes it, if you know to look.

Wallet incompatibility. Not every wallet supports every BIP-39 language or every coin type. Restoring into software that lacks the original chain's path shows nothing. The funds are not gone, only invisible until you use software that supports that chain.

Lightning channels without an SCB. The seed restores the on-chain balance. Open channels need the SCB file to close cooperatively. Without it, channels may be force-closed, and a stale backup can let the counterparty claim a penalty transaction.

Camera-readable storage. A QR code of the seed, or a photo in a cloud-synced gallery, is one account breach from total loss. The seed should never exist in a form a camera or screen capture can send to a server.

Top mistakes

• Digital storage. Screenshots, notes apps, drafts and cloud docs are reachable by malware and data breaches. The seed lives offline.
• Social engineering. "Support" asking for your phrase to "verify" or "restore" your account is always fraud. Your Attack Surface catalogues the variants.
• A single copy. One paper in one place is one fire, flood or burglary from permanent loss.
• Skipping the test restore. Five minutes now versus everything later.
• Confusing seed phrase with private key. A private key controls one address. The seed derives all of them. Losing one key is painful; losing the seed is total.

What to do next

• Verify your backup today. Find the phrase and confirm every word is legible.
• Record your derivation path if your wallet uses anything non-standard. Plain BIP-44 can stay implicit.
• Keep the passphrase separate and tested. If you use one, do at least one full restore with both.
• Store a static channel backup if you run Lightning, in a different place from the seed, updated after every channel open or close.
• Match the medium to the money. Paper for small amounts in low-risk settings; metal once the holding is significant.
• Write a custody plan. Your Personal Custody Plan turns these rules into thresholds you can actually follow, and the Backing Up and Recovering Your Wallet walkthrough shows the exact steps in Zelcore.

Key takeaways

• A seed phrase is a human-readable encoding of the master entropy that generates every key in your wallet, standardised by BIP-39, BIP-32 and BIP-44.
• 12 words equal 128 bits of entropy, 24 words equal 256 bits. Both are infeasible to guess.
• Losing the phrase means permanent, irreversible loss. So does forgetting a passphrase.
• The seed restores balances and addresses. It does not restore PINs, labels, Lightning channels or non-standard paths.
• Keep at least two offline copies in separate secure places, prefer metal for serious holdings, never split the words, and never put them anywhere a camera or the internet can reach.