Seed Phrase Security: How Australians Should Actually Store and Back Up Their Recovery Words

If you own cryptocurrency, the most important thing in your possession is not the wallet, the exchange password or the Ledger device — it is the 12 or 24 word seed phrase that the wallet generated when you set it up. Lose the seed and you lose the funds permanently. Have someone read the seed and they take the funds instantly. Despite this, Australian crypto investors routinely back up their seed phrases in ways that are unsafe and recoverable. This guide explains how Australians should actually back up and store their recovery words, what to never do, and the trade-offs between paper, metal and split backup methods.

What a seed phrase actually is

A seed phrase (also called a recovery phrase, mnemonic seed or BIP-39 seed) is a 12 or 24 word sequence drawn from a fixed list of 2,048 English words. The seed is a human-readable representation of the entropy used to derive every private key in the wallet. If you have the seed, you can recover the wallet on any compatible hardware or software wallet. If someone else has the seed, they can do exactly the same thing — instantly, from anywhere in the world, without ever needing physical access to your device.

The seed is not encrypted. It is not a password. It does not require a PIN. Anyone who reads the 12 or 24 words has full control of the wallet.

What never to do with a seed phrase

Never type the seed into a computer or phone keyboard for any reason. Never photograph it. Never paste it into a phone note, a password manager, an email draft, a cloud document, a screenshot folder, an iMessage, a WhatsApp message, a Signal message, or any digital surface. Modern phones aggressively back up notes, photos and clipboard history to iCloud and Google — the moment the seed phrase touches a phone, it is on a cloud account whose security is now load-bearing for your crypto holdings.

Never enter the seed into a website, even one that looks legitimate. No legitimate wallet recovery process requires you to type your seed into a website. Ledger, Trezor, MetaMask, Phantom and every other reputable wallet will never ask. Any prompt that asks for your seed words on a website is, with very high probability, a phishing attack.

Never share the seed with customer support, an exchange employee, a wallet developer or anyone claiming to help recover funds. Legitimate support never needs your seed.

Paper backup — the baseline

Out of the box, both Ledger and Trezor ship with paper recovery cards. Writing the seed clearly in ink on the supplied card is the baseline backup. This is acceptable for small holdings and works well for most retail Australian investors. The weaknesses of paper are fire, water and gradual paper degradation — if your home is destroyed in a fire or flood, paper backup may not survive.

Metal backup — the upgrade

Metal seed backup plates are stainless-steel or titanium plates designed to survive fire, water, corrosion and most other environmental hazards. There are two main styles. Stamped plates use a punch or stamp set to imprint the first four letters of each word into the steel — the four-letter prefix is enough to uniquely identify any BIP-39 word. Tile or letter-strip systems use individual character pieces locked into a frame.

Brands available in Australia include Cryptosteel, Cryptotag, Blockplate, Coldti and Billfodl. Most cost AUD $80–$200. For any Australian holding more than a few thousand dollars in crypto, a metal backup pays for itself the moment anything happens to your paper backup.

Where to store the backup

The seed backup should be physically separate from the hardware wallet itself. Storing the device and the backup in the same drawer defeats the purpose — a single home break-in compromises both. Reasonable separation options include a fireproof safe in your home plus a backup at a parent’s or sibling’s house; a bank safe deposit box; or a friend’s safe with a trust agreement. For Australian SMSF holdings, the storage arrangement may need to be documented for the fund auditor.

Splitting the seed (SSS and Shamir)

Trezor Safe 3 and Safe 5 support Shamir’s Secret Sharing — splitting the seed into multiple shares where any K-of-N reconstitute the wallet, but fewer than K reveal nothing. For example, you could split the seed into 5 shares with a 3-of-5 threshold, store them in 5 different locations, and require any 3 to reconstruct the seed. This is a meaningful security improvement for larger holdings, but adds operational complexity that has cost real users real money when shares were lost.

For most Australian retail investors, a single metal backup in a physically separate location is the right balance. SSS is appropriate when the operational sophistication is genuinely there.

Passphrases — the optional 25th word

Hardware wallets support an optional passphrase that, combined with the seed, generates an entirely separate hidden wallet. The passphrase adds protection against an attacker who reads the seed (because they still need the passphrase to access the hidden wallet). The risk is that forgetting the passphrase makes the hidden wallet unrecoverable — there is no recovery process for the passphrase itself.

Passphrases are an advanced feature. They should only be used if you have a robust way to remember or store the passphrase that does not undermine the security benefit. A passphrase written next to the seed plate provides zero benefit. For most Australian users, a strong PIN plus a metal-stored seed plus physical separation is the right answer.

Testing the backup

Once a year, prove your backup actually works. Power off the hardware wallet. Reset it. Recover the wallet using the seed words from your backup. Verify the wallet shows the correct addresses and balances. Then put the device back to its normal state. This is the single most overlooked seed-security practice — Australian users discover their backup is wrong (a misspelled word, a missing word, a wrong order) only when they actually need it, by which point it is too late.

Verdict

Paper backup is the baseline. Metal backup is the right upgrade for any meaningful holding. Physical separation between device and backup is non-negotiable. Test the backup at least once a year. Avoid Shamir splits, passphrases and other advanced features unless the operational sophistication is genuinely there. Most Australian seed-loss cases come from violating one of these basic rules, not from clever attacker techniques.

Related guides

Frequently asked questions

Can I store my seed phrase in a password manager?

No. Password managers are designed to be conveniently accessible, which is exactly the property you do not want for a seed phrase. A breach of your password manager would expose your seed and drain the wallet immediately.

Should I take a photo of my seed phrase?

No. Phone photos are routinely backed up to iCloud or Google Photos. A breach of your cloud account would expose the seed. Always write the seed by hand and never digitise it.

What is a metal seed backup?

A stainless-steel or titanium plate that stores the seed words by stamping or letter tiles. Designed to survive fire, water and corrosion. Recommended for any Australian holding more than a few thousand dollars in crypto.

Where should I store my seed backup?

Physically separate from the hardware wallet itself — a fireproof safe at home plus a backup at a trusted relative’s place, a bank safe deposit box, or a friend’s safe with a documented arrangement.

What is a seed passphrase?

An optional 25th word that combines with the seed to derive a separate hidden wallet. Adds protection against an attacker who has the seed alone, but forgetting the passphrase makes the hidden wallet unrecoverable. Advanced feature — only use if you have robust passphrase storage.

Important Australian disclosure — The information in this article is general and educational only. It does not constitute personal financial product advice and should not be relied on as such. Cryptocurrency products are highly volatile and many crypto exchanges or platforms operating in Australia are not licensed by ASIC. You should consider whether crypto suits your objectives, financial situation and needs before making any decision. Tax treatment varies by individual circumstance — consult a registered tax agent or financial adviser, and refer to the official guidance at ato.gov.au and moneysmart.gov.au.