How twelve words can hold a wallet
The words come from a fixed list of 2048, standardised as BIP-39 and shared across almost every wallet made in the last decade. Each word encodes a piece of a large random number, and that number is the seed from which every private key in the wallet is derived mathematically.
Because the derivation is deterministic, the same phrase always produces the same keys in the same order. That is why recovery works and why the phrase is enough on its own: it needs no account, no server and no permission from anyone.
The word order matters as much as the words. Write them numbered.
Why this is not a password
A password protects access to something stored elsewhere. Lose it and support resets it, because the data still sits on a server that someone controls.
A seed phrase is the thing itself. There is no server, no account and no support desk with the authority to help, because nobody else ever had a copy. Lose the phrase with no other access to the wallet and the funds stay on the blockchain permanently, visible to everyone and reachable by nobody.
That asymmetry is the whole reason the storage advice below is worth following literally.
Where to keep it and where not to
Write it on paper or stamp it into metal. Metal survives fire and flooding; paper does not, and people who learned this learned it expensively.
Keep at least two copies in separate physical locations. One copy is a single point of failure against fire, theft and simple loss.
Never photograph it, type it into a note app, email it to yourself or store it in cloud backup. Any of these turns an offline secret into an online one, and it is the single most common way self-custodied funds disappear.
Never enter it into a website. A legitimate wallet asks for the phrase only inside its own application during recovery. Every site that requests it is a theft attempt, without exception.
The scam worth naming explicitly
Nobody legitimate will ever ask for your seed phrase. Not wallet support, not an exchange, not a payment provider, not a person in a chat who is helping you with a stuck transaction.
The request itself is the fraud. There is no scenario in which a genuine service needs those words, because a genuine service never had them and cannot use them for anything except taking the funds.
This becomes especially frequent during platform migrations, when fake pages appear asking users to “verify” wallets by entering the phrase. It happened at scale during the Coinbase Commerce shutdown in March 2026.
What this means for a business
A merchant accepting payments through a gateway does not manage seed phrases for incoming funds, because the gateway handles receipt and settlement.
Where it does matter is reserves. Any balance a business chooses to hold in cold storage sits behind a phrase, and that phrase needs a procedure: who has access, where the copies are, and what happens if the person who set it up leaves. A single phrase in one person’s desk drawer is how companies lose treasuries.