The BIP39 passphrase ("25th word"): what it does and how people lose coins with it

A BIP39 passphrase is an optional extra string added to your seed words. It is often called the 25th word, but it can be any text of any length. How it works The wallet turns your words into a binary seed with PBKDF2-HMAC-SHA512, 2,048 iterations, using the string "mnemonic" plus your passphrase as the salt. Change the passphrase by one character and you get a completely different seed, so a completely different wallet. The property that matters There is no wrong passphrase. Every passphrase opens a valid wallet. Type it wrong and the wallet does not complain; it shows you an empty wallet. That is the feature (someone who finds your words alone gets nothing, or a decoy wallet you funded with a little) and it is the danger (a typo or a forgotten capital letter looks exactly like "my coins are gone"). Rules that keep it safe - It is case-sensitive and space-sensitive. Decide on all lower case with no trailing spaces, or be very deliberate. - Do the restore test with the passphrase too: restore words plus passphrase on a second device and check the first receive address matches. - Store the passphrase separately from the words. Each alone should be useless; together they open the wallet. - Make sure whoever inherits your coins knows a passphrase exists and where it is. A seed found after your death with no note about a passphrase opens an empty wallet, and nobody will know to look further. Who it is for It protects against someone who finds or photographs your words. It does not protect against malware on the machine you type it into. If you are not prepared to keep two secrets in two places for years, the plain seed with good physical storage may be the safer choice for you. Spec: https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki