How do you back up a seed phrase without losing it or leaking it?

What the phrase is

Many wallets give you a recovery phrase when you create them. It is a random list of words that can restore your wallet if you lose it, or if its hardware or software is damaged.¹ ethereum.org calls it the only way you'll be able to recover your wallet.³

In 2023, Mastering Bitcoin, a book about how Bitcoin works, called BIP-39 the most popular way to make these phrases.⁵ It turns random data into 12 to 24 words, taken from a list of 2,048.^6,5 Part of the phrase is a checksum, which lets wallet software warn about a phrase that doesn't add up.⁶

The phrase is also the master key. Anyone who has it can drain every asset in your wallet.² No real service, support agent or website will ever ask you for it.²

Paper, not pixels

ethereum.org's advice is short: don't store the phrase on a computer, write it down and keep it safe.³ It also warns against screenshots. A screenshot might sync to a cloud service, and stealing keys from the cloud is a common attack.²

Bitcoin.org adds that any backup stored online is highly vulnerable to theft. It suggests encrypting any backup that is exposed to the internet.⁴

What about just remembering it? Mastering Bitcoin calls relying on memory alone dangerous. If you forget the phrase and lose the wallet, the coins are gone. If you die and your heirs can't get into the wallet, they can't inherit the coins.⁵

More than one place

Bitcoin.org warns that a single point of failure is bad for security. A backup kept in more than one physical place is less likely to be wiped out by one event.⁴ It suggests durable storage materials.⁴

There is a catch. The authors of a standard called SLIP-39 note that the usual answer is extra copies. But when the coins are worth a lot, whoever holds a copy might run off with them.⁷

Split backups

SLIP-39 offers a different kind of backup. It splits the secret into a number of shares, and sets how many are needed to rebuild it.⁷ For example, you might make five shares and need any three.⁵ Holding fewer shares than needed reveals nothing about the secret.⁷

The shares can be kept in different places, or by different people.⁵ Each share is a list of words: 20 words for the smaller standard size, 33 for the larger.⁷ For the most part, SLIP-39 and BIP-39 are not compatible.⁷

The optional passphrase

BIP-39 lets you add an optional passphrase to the phrase.⁶ Every passphrase opens a valid wallet, but only the right one opens the wallet with your coins.⁶

That has a cost. A wallet can't warn you about a wrong passphrase. A small typo just opens a different, empty-looking wallet.⁵ And if you made a typo when you first set the passphrase, then funded that wallet, the coins are gone unless you can work out the typo.⁵

Checking the backup

One maker's devices can check a backup without using it. You type in the words, and the device compares them with what it holds, without saving them.⁸ The same maker suggests doing this before wiping the device and before every firmware update.⁸