Security

Whoever controls the private keys controls the coins. Good security therefore means keeping those keys away from thieves, while making sure you can still reach them yourself. Most losses come from scams, from malware, or from a backup that was lost or never made. They rarely come from breaking bitcoin's cryptography.

What is the biggest risk?

For most people, the biggest risk is not a hacker who breaks the code. It is a fake website that collects a seed phrase, a computer infected with malware, or a backup that cannot be found. Guard against those three first, then add the extra layers described below.

Should you use a hardware wallet?

Yes, once you hold an amount that you would not want to lose. A hardware wallet keeps the private keys on a separate device. It signs each transaction on the device, so the keys never reach your computer or the internet.

A computer infected with malware can ask the device to sign a payment. The device shows the details on its own screen, and you approve them there. So check the address and the amount on the device before you confirm.

Buy a hardware wallet only from the manufacturer or an authorized seller. A device that arrives with a seed phrase already set, or a box that looks opened, is a warning sign. The device protects the keys from online attacks, but it cannot protect you from someone who holds the device and knows your PIN.

How do you back up your seed phrase?

Write the seed phrase on paper when the wallet shows it. Paper keeps the seed offline, away from attacks on your computer. But paper burns, rots and fades over time.

For a sturdier backup, stamp the words onto steel. Metal plates are sold for this purpose, and you can also stamp the words yourself. Steel resists fire and water better than paper does.

A useful guide is the 3-2-1 rule: keep three copies, on two different types of material, with one copy in another place.

Keep the seed separate from the device, because a thief who finds both can take everything. Do not store the seed in a photo, a text file, a cloud drive or a password manager. Each of these can be copied, synced or hacked.

What is a passphrase?

A passphrase is an optional extra word, or phrase, that you add to the seed. Some people call it the 25th word. With a passphrase, the seed opens a different wallet. Without one, the seed opens the default wallet. A wrong passphrase opens another wallet that looks empty, so a typing mistake is easy to miss.

Back up the passphrase as carefully as the seed, and store it apart from the seed. A passphrase should be long and hard to guess, because someone who has the seed can try to guess it. A passphrase is optional. It adds protection, and it also adds a way to lose everything.

How long should the seed phrase be?

A 12-word seed phrase holds 128 bits of randomness, and a 24-word phrase holds 256 bits. No attacker can search either range. A 12-word phrase is therefore fine, and it is easier to write down and remember. The real risk is the seed being exposed, not its length.

How do you avoid scams?

• Never type or paste your seed phrase into a website, an app, a chat or a form.
• Never use a seed phrase that a website generated for you, because the site can keep a copy.
• Nobody from support needs your seed phrase. Anyone who asks for it is a thief.
• Download wallets only from the developer's website. Type the address yourself or use a bookmark.
• Be wary of unexpected messages, calls and "help" offers, especially after you post about a problem.
• Ignore offers that promise to double your coins or guarantee returns. They are scams.
• Be careful with links and QR codes that come from people you do not know.

Scammers copy wallet names, icons and support pages, so check the web address carefully before you enter anything.

What about malware and swapped addresses?

Malware can replace an address you copy with one that it controls. Check the first and last characters after you paste an address. On a hardware wallet, compare the address on its screen with the address you meant to use. Keep your operating system and wallet software updated, and avoid software from unknown sources.

Should you keep your holdings private?

Be careful about who knows what you hold. Physical attacks happen, and they target people whom others believe hold bitcoin. Do not share how much you hold, and do not post photos that show your backups or your setup.

What is a simple setup for most people?

• A hardware wallet for most of your coins, and a software wallet with a small amount for everyday spending.
• Three copies of the seed phrase, on at least two kinds of material, with one copy in another place. Steel is a good choice for one of them.
• A passphrase, if you use one, backed up separately from the seed.
• A small amount in the same wallet without a passphrase. If that amount ever moves, someone may have found your seed.
• Written instructions that explain how to restore the wallet, stored with your backups.

Memory is a useful extra, but it is not a backup. A passphrase you use rarely is easy to forget.

What next?

Revisit the wallets page to check your setup. Read sending before you move a large amount, so you know how fees and confirmations work.