By Kirsty Moreland
Jul 3, 2020 | Updated May 15, 2023
Read 6 min
Medium
| KEY TAKEAWAYS: |
| — The Passphrase is an advanced feature that adds a 25th word of your choosing of max 100 characters to your recovery phrase. -— Using a Passphrase will cause an entirely different set of addresses to be created which cannot be accessed via the 24-word recovery phrase alone. — Aside of adding another layer, the Passphrase grants you plausible deniability when under duress. — If using a Passphrase, it’s key to store it securely and remember it perfectly, character for character. |
The passphrase is an advanced security feature that hardware wallets like the Ledger Nano X or Ledger Nano S can use. It adds an extra word of your own choosing to your already existing recovery phrase to unlock a brand-new set of accounts. Let’s take a closer look at how passphrases work, what they do, and some best practices for using one.
Introducing the Passphrase
As you might be aware, your 24-word recovery phrase is the backup to all of your crypto assets. It’s absolutely key to store your 24 words securely and to never enter it into a smartphone, computer or other device that can connect to the internet. If someone manages to get a hold of your set of 24 words, they can steal all of your cryptocurrencies. Unless… What if we told you that there’s a way to add an additional layer on top of your 24-word recovery phrase?
This can be done through the Passphrase.
The passphrase is an advanced feature that allows you to add an additional word to your recovery phrase. For this reason, it’s also commonly referred to as the 25th word. Unlike the regular recovery phrase, you would choose the 25th word. There are no limitations for which word you’d like to choose. As a matter of fact, the only limitation is using a maximum of 100 characters. The passphrase is also sensitive to caps and can be composed of numbers and signs as well.
When you use a passphrase on top of your usual settings, it will open a brand-new set of accounts. It’s similar to having two completely different recovery phrases.
Why would you want to use a passphrase and have a brand-new set of cryptocurrency addresses, however?
Why would I consider using a Passphrase
Now firstly, as the passphrase adds an additional layer, using it would mean that someone having your 24-word recovery phrase would still simply not have enough information to get access to your precious cryptocurrencies. One would need your 24 words and your self-created 25th word to access your crypto assets. If they’d only have your 24 words, they can only access your regular accounts instead. This is why the accounts managed with a passphrase are often called hidden accounts.
Not only does it create another layer, it also adds more randomness to your backup. Now, the standard 24-word recovery phrase is already extremely random, with a massive total of 115.792.089.237.316.195.423.570.985.008.687.907.853.269.984.665.640.564.039.457.584.007.913.129.639.936 possible combinations. These words are, however, from a set list known as the BIP39 word list.
With a 25th word, you’d be cranking this humongous number of potential combinations to a whole new level. Also this introduces a human element to the mix as well. Rather than relying on a set of 24 words you’ve received by a device, you’d be adding a random word that you personally thought of and have created. We would like to add though that only using a recovery phrase created by a Ledger device is highly secure as well. Ledger devices have the highest certificate when it comes to the quality of our True Random Number Generator (TRNG) used to create your recovery phrase. Lastly, using a passphrase would grant you Plausible Deniability. Let’s take a closer look at why that could be important.
What’s plausible deniability?
Much like with anything of value, there will always be people trying to steal it by any means possible. Unfortunately in the world of crypto, we have seen rare occasions where individuals known to have some wealth in crypto to be the target of physical robbery and threats. The Passphrase could offer a limited amount of protection for your cryptocurrencies in such an event.
For the passphrase, Plausible Deniability comes down to being able to make someone else think they now have access to your crypto fortune. For example, someone could be putting you under duress to hand out your recovery phrase or unlock your Ledger device. With its usual settings, it would only give access to your regular accounts, not your hidden ones. Especially if there is a bit of a balance on your regular accounts while the majority of your crypto rests on hidden accounts, this could be pretty convincing. You could even use multiple hidden accounts with different passphrases. This can be useful if the attacker is aware of the passphrase feature.
Plausible Deniability doesn’t give any certainties, but it could give you a fighting chance to save your crypto fortune under extreme circ*mstances.
Can I use a passphrase on my Ledger device?
Yes, you can! Quite a few other hardware wallets do allow for a passphrase, but would have you enter it on a computer. This would lead to your passphrase being vulnerable to online attacks. With Ledger, you can enter your passphrase directly on your Ledger device to enable a hidden account. This would prevent your passphrase falling into the wrong hands.
You actually have two options for setting up a Passphrase with Ledger. The first is entering it into your device every single time you want to use your passphrase. We refer to this as the “Set temporary passphrase” option. With this, once your Ledger device is turned off it would grant access to your regular accounts again.
Another option is to link a passphrase of your choosing to a secondary PIN code. When choosing this option, you would first create a passphrase directly on your Ledger device. After having done so, you would be able to choose a secondary PIN code for your Ledger device. After this, each time you turn on your device, you could choose between entering your normal PIN code or your secondary PIN code. If you would enter your secondary PIN code, your accounts hidden behind a passphrase would be accessible.
For example:
Regular PIN code: 1653 → Normal accounts
Secondary PIN code: 8530 → Hidden accounts
You can read more about using a Passphrase for your Ledger device in this article as well.
Best practices
Now we must add that a passphrase is considered an advanced feature for a few simple reasons. Firstly, you must remember your passphrase perfectly. A single character being mixed up would cause a completely different set of accounts to be accessed. Even a character being capitalized or not would result in this.
If you don’t remember your passphrase character for character, you cannot gain access to the crypto you managed with it. As such, it’s key that you 1. Enter it correctly the first time you’d set it up and 2. Remember it perfectly.
Also, one Passphrase is not as secure as the other. It can be as long as 100 characters and you can choose whether you want to use capitalized characters, numbers and/or signs. The longer the passphrase and the more different types of characters you use, the more complex and secure it becomes. Ideally, you would treat it like a password where you try to make it as complex as possible and not use words directly.
For example:
Passphrase 1: password → Very insecure due to short length, no random characters or caps.
Passphrase 2: IReallyLikeMyBitcoins → A bit more secure: longer and uses caps, but still uses common English words and no numbers or signs.
Passphrase 3: H05!xp4e2i6dAnV?esRjfap953nxZprsi495nAASF5n,!f01.?d → Even more secure: lengthy, wide mix of caps, numbers and signs and doesn’t use actual words.
While Passphrase 3 can be seen as the most secure of the bunch, it’s also extremely hard to remember. You could make it a form of cryptographic puzzle. For example: Iret3LNS’tuBgm! concerns the first letters and special characters / numbers of the sentence “I really enjoy the 3 Ledger Nano S’s that uncle Bob gave me!”.
We would like to stress that your Passphrase is sensitive information. As such, we recommend treating it with the same kind of care as you would treat your Recovery Phrase:
– Never share your Passphrase with anyone – Ledger will never ask for this
– Never enter your Passphrase on a computer, smartphone or other internet-connected device
You can read more on these best practices here.
Keep learning! If you enjoy getting to grips with crypto and blockchain, check out our School of Block video 3 Ways to Earn Passive Income from Crypto.
I'm an expert in cryptocurrency security, particularly in the realm of hardware wallets, and I've been closely following developments in this field up to my last knowledge update in January 2022. My expertise extends to advanced features such as passphrases, as evidenced by my in-depth understanding of the concepts and practices associated with them.
The article you've mentioned, dated July 3, 2020, and updated on May 15, 2023, delves into the use of a Passphrase as an advanced security feature for hardware wallets like the Ledger Nano X or Ledger Nano S. Let's break down the key concepts discussed in the article:
-
Passphrase Overview:
- The passphrase is an advanced feature that adds a 25th word of the user's choice (up to 100 characters) to the standard 24-word recovery phrase.
- When using a passphrase, a completely different set of cryptocurrency addresses is generated, which cannot be accessed with the 24-word recovery phrase alone.
-
Purpose of Using a Passphrase:
- Adds an extra layer of security to the standard 24-word recovery phrase.
- Grants plausible deniability in situations of duress, where an attacker may demand access to crypto assets.
-
Plausible Deniability:
- Passphrase introduces the concept of plausible deniability, allowing users to create hidden accounts that are not accessible with the regular 24-word recovery phrase.
- In the event of coercion or threat, a user can reveal access to a set of regular accounts while keeping the hidden ones secure.
-
Setting Up a Passphrase on Ledger Devices:
- Ledger devices provide a secure way to use a passphrase. Users can enter it directly on the Ledger device, preventing it from being exposed to online attacks.
- Two options for setting up a passphrase: a temporary passphrase that needs to be entered each time or linking a passphrase to a secondary PIN code for convenience.
-
Best Practices for Using a Passphrase:
- A passphrase is considered an advanced feature, and users must remember it perfectly, character for character.
- Passphrase security is enhanced by its length, the use of capitalized characters, numbers, and signs.
- Longer and more complex passphrases are generally more secure but may be harder to remember. Users are advised to treat passphrases like complex passwords.
- Passphrase is sensitive information, and best practices include not sharing it with anyone, not entering it on internet-connected devices, and treating it with the same care as the recovery phrase.
In summary, the article provides a comprehensive guide to understanding, implementing, and securing cryptocurrency assets using a passphrase, particularly on Ledger hardware wallets. The detailed insights and best practices emphasize the importance of this advanced security feature in protecting digital assets.
