Learn › Chapter 3 of 11

Chapter 3 · The recovery words

These 12 Words ARE Your Bitcoin (Treat Them That Way)

Prefer to watch? This chapter is also a short video (about 4½ minutes). The full text is below.

In one minute: When you set up a wallet, it shows you 12 or 24 words. Those words are the key from Chapter 2, written in a form a person can copy down. Anyone who has them can take your bitcoin, from anywhere, without your device. If you lose them and the device, the bitcoin is gone, and nobody can reset them. This chapter is about treating a short list of ordinary words like the most valuable thing in your house, because it is.

The first time you set up a hardware wallet, the screen shows you a list of plain words. Garden. Pilot. Ribbon. Twelve of them, or twenty-four. It asks you to write them down, and then it asks you to type a few back to prove you did.

Most people treat this like writing down a Wi-Fi password: a chore to get through before the real setup starts.

It's the opposite. That list is the real setup. Everything else is a convenience.

Your key, written as words

In Chapter 2 we said that what you own is a key: a secret, very long number that lets you move your bitcoin on the shared list.

A long number is easy to copy wrong. So since 2013, almost every wallet turns that number into words instead. ¹ Each word comes from the same fixed list of 2,048 everyday English words, and the list was designed so that the first four letters of every word are enough to tell it apart from the others. ¹

Because the list is a shared standard, your words aren't tied to the device that made them. Write them down from one brand of wallet, and a different brand can read them back.

That's the good news, and it's also the warning.

The words are the money

Anyone who has your words can type them into any compatible wallet, anywhere in the world, and move your bitcoin.

They don't need your device. They don't need your PIN. They don't need to be in your house, or even your country. The words alone are enough.

That's exactly what thieves count on. In 2020, a database of about 270,000 hardware wallet customers' names and home addresses was stolen and posted online. In June 2021, some of those customers received a package in the mail: a real-looking replacement device and a letter telling them to "switch to a new device to stay safe." The device had been tampered with. When people typed in their recovery words as the letter instructed, the words went to the thieves, who used them to empty the wallets on devices of their own. ²

The thieves never touched the victims' original devices. They didn't need to.

What happens when something goes missing

Notice what matters in every row: the words. The device is replaceable. The words are not.

Nobody can reset them

There's no "forgot my words" button. There's no support line, no bank manager, no court that can issue new ones. The words aren't stored by any company. They exist only where you wrote them.

People sometimes ask whether a thief, or a very powerful computer, could simply guess them. No. A 12-word list is drawn from a number of possibilities that is 39 digits long. ¹ Guessing isn't the danger.

The danger is a person seeing them, or a person losing them. Both are about how you handle a piece of paper.

How to handle your words

• Write them by hand, in order, with each word numbered. Use the card that came with the device for now; Chapter 6 covers backups that survive fire and flood.
• Check the spelling of every word against the screen. If you're unsure, the first four letters are what count.
• Never type them into a phone, computer, or website. Not into a notes app, not into an email, not into a "wallet checker." The only place your words should ever be typed is the hardware wallet itself, and only when you're restoring it.
• Never photograph them and never save them to a cloud account or a password manager.
• Never read them out loud on a phone or video call, to anyone, for any reason.

And the rule this whole guide comes back to: no real person or company will ever ask for your recovery words. Not support, not your exchange, not the maker of your device, not us. Anyone who asks is trying to steal from you.

Some families add one more secret on top of the words, called a passphrase, so that the words alone aren't enough. That's the Intermediate level, and it has its own trade-offs; we'll get there.

Talk about it

1. Do we know where our recovery words are right now? Could the other one find them without help?
2. Who else could find them? Is that okay?
3. Have our words ever been typed into a phone or computer, or photographed? If so, that's worth fixing, and Chapter 6 shows how.

If any answer makes you uneasy, that's normal. The rest of this guide is about turning that unease into a plan.

Sources