How to Keep a Crypto Wallet Secure: Seed Phrases and Hardware Wallets
Your seed phrase is the master key to your crypto. Learn how to store it safely, when to use a hardware wallet, and the habits that prevent common losses.
Cryptocurrency has no password reset button. Whoever holds the private keys controls the funds, and a lost or stolen key usually cannot be recovered. That makes wallet security a matter of habits rather than trust in a company. This guide covers the essentials, and it is general information, not financial advice.
What a seed phrase is
Most modern wallets create a seed phrase, also called a recovery phrase, when you set them up. It is a list of 12 or 24 common words that encodes the master secret from which all your private keys and addresses are derived. The format is based on a widely used standard known as BIP-39. If your phone breaks or your hardware wallet is lost, you can restore your accounts on a new device by entering the phrase.
This also means anyone who learns the phrase can take everything, from any device, and without your knowledge. Treat it like the keys to a safe.
Storing a seed phrase safely
- Write it down offline. Use paper or, for longer-term protection against fire and water, a metal backup plate made for the purpose.
- Do not store it digitally. Avoid photographs, screenshots, cloud notes, email drafts and password managers that sync online. Malware and account breaches can expose these.
- Never type it into a website. Legitimate wallet makers and support teams do not ask for it. Anyone who does is attempting theft.
- Keep two copies in separate locations. A single copy can be destroyed or lost.
- Plan for the worst. Think about how a trusted person could recover your funds if something happened to you, without giving them access today.
Types of wallet
| Type | How it works | Best for | Main risk |
|---|---|---|---|
| Exchange account | The exchange holds the keys for you | Convenience, trading | Exchange failure or account takeover |
| Software wallet | App on a phone or computer holds the keys | Small amounts, daily use | Malware and a compromised device |
| Hardware wallet | Dedicated device keeps keys offline and signs transactions | Larger or long-term holdings | Lost seed phrase, fake or tampered devices |
| Multi-signature wallet | Several keys must approve a transaction | Businesses and large holdings | Complexity and key management |
How hardware wallets help
A hardware wallet generates and stores private keys inside a small device. When you send a transaction, your computer prepares it and the device signs it internally, so the key never touches the computer. Even if your computer has malware, the attacker cannot extract the key, and the screen on the device lets you check the amount and address before approving.
To use one safely:
- Buy directly from the manufacturer or an authorised reseller, never from a second-hand listing.
- Check that the packaging is sealed, and generate a new seed yourself. Never use a pre-filled recovery card.
- Write down the phrase on the offline card, and test your backup with a small amount before moving much.
- Keep the firmware updated through the official app.
- Compare the address on the device screen with the intended one before approving a transaction.
A passphrase for extra protection
Many wallets support an optional passphrase, sometimes called the 25th word. It creates a separate hidden wallet from the same seed. If someone finds your written phrase, they still cannot reach funds protected by the passphrase. The risk is that forgetting the passphrase makes those funds unrecoverable, so it needs its own careful backup.
Everyday habits that prevent losses
- Send a small test transaction before a large transfer to a new address.
- Beware of address poisoning. Attackers send tiny transactions from lookalike addresses so that they appear in your history. Do not copy addresses from history; always verify the full address.
- Check website addresses. Bookmark your wallet and exchange sites. Fake sites and fake apps are common.
- Review token approvals. Decentralised apps ask for permission to spend your tokens. Revoke approvals you no longer need.
- Use two-factor authentication on exchange and email accounts, with an authenticator app rather than SMS where possible.
- Separate funds. Keep a small balance in a daily-use wallet and the rest in more protected storage.
Multi-signature and planning for the unexpected
For larger holdings, some people use a multi-signature wallet that needs, for example, two of three keys to approve a payment. The keys are stored in different places, so losing one is not fatal and stealing one is not enough. This adds complexity, so the setup should be tested with a small amount first. Keep clear, written instructions for a trusted person to follow if you cannot access your wallet, and do not put the seed phrase itself in them. Also remember that a padlock in the browser does not prove a website is genuine, because fake sites can have valid certificates too; check the domain name carefully, as explained on our SSL page.
What to do if you suspect a compromise
If you think your seed phrase has been exposed, create a new wallet on a clean device and move your funds there straight away. Do not reuse the old phrase. Change passwords for related accounts and report the incident to the relevant platforms.
A practical lesson for site owners
If your business receives crypto, apply the same discipline to your hosting and payment accounts: strong unique passwords, two-factor sign-in and restricted access. Zebra Hosting accepts payment through Cryptomus, and you can find our protections on the security page.
