"Why not simply encrypt it?" is a natural question. It can work, but it is easy to get wrong. This advanced guide is part of our guide to advanced setups.
What people mean by encrypting a seed
| Method | How it works | Main risk |
|---|---|---|
| Encrypted file | Phrase in a password-protected archive | Exposed on a computer |
| Encrypted USB | Stored on a secure drive | Hardware fails, software changes |
| Hand ciphers | Words transformed by a personal rule | Weak, or forgotten |
| Hardware wallet encrypted backup | Backup encrypted by the device | Tied to the vendor |
| BIP39 passphrase | Built into the standard | Forgetting it |
| Paper + password in a manager | Split between paper and digital | Complexity |
Risks to think about
Exposure. To encrypt a phrase on a computer, you need to type it there. If that computer has malware, your phrase is gone. See storing a seed phrase digitally.
Long-term access. Will the software, file format and hardware work in 20 years? Will your family know how?
A new secret. The encryption password becomes as important as the phrase. Forget it, and the backup is useless.
Weak passwords. A stolen encrypted file can be attacked offline.
Home-made methods. Personal ciphers rarely stand up to scrutiny, and often cannot be followed later. See hiding a seed phrase.
Safer ways to get the same result
| Goal | Better option |
|---|---|
| A found backup is useless | BIP39 passphrase |
| No single piece reveals your secret | Shamir |
| No single key can spend | Multisig |
| Survive disasters | Metal backup in two places |
If you still want to encrypt
- Use well-known tools with open formats.
- Work on an air-gapped computer that never goes online again.
- Use a strong passphrase of random words.
- Keep the password separate from the file.
- Test decryption, and repeat the test every year.
- Keep a clear note on how to decrypt it.
- Still keep at least one offline, non-digital copy.
Our view
For nearly all readers, encrypting a seed is the wrong tool. Paper or steel, kept in the right places, is simpler and has a much longer track record. If you need more, standards exist for it.