Ledger Passphrase Wallets: Hidden Accounts, Secondary PIN and Recovery Risks

A Ledger passphrase creates a completely separate set of wallet accounts from the same Secret Recovery Phrase. Access requires both the original recovery words and the exact passphrase, including its capitalization, spaces and symbols. This can protect a separate portfolio if the recovery phrase is exposed, but one forgotten or mistyped character can make the correct accounts appear empty and can permanently remove access if no accurate backup exists.

Last reviewed: September 29, 2026. Ledger device names, firmware, Ledger Wallet interfaces and passphrase setup screens can change. Confirm each critical step through current official Ledger instructions before moving assets. This independent guide is educational and is not financial, legal or professional security advice.

What is a Ledger passphrase?

A Ledger passphrase is an optional secret used together with the device’s Secret Recovery Phrase. The recovery phrase supplies the mnemonic backup; the passphrase modifies the cryptographic seed from which accounts and private keys are derived.

The result is not a locked folder inside the ordinary wallet. It is a different deterministic wallet with different private keys, public addresses and balances. Opening Ledger Wallet with the standard accounts does not reveal which passphrase wallets exist.

Ledger describes the feature as advanced because the user, not Ledger, is responsible for selecting, entering, backing up and recovering the passphrase. Ledger does not keep a copy that support can retrieve.

Why it is called the “25th word”

A Ledger Secret Recovery Phrase traditionally contains 24 BIP39 words, so the additional passphrase is often called the “25th word.” That nickname is convenient but technically misleading. The passphrase does not need to be a word from the BIP39 list. It can contain several words, spaces, numbers and supported symbols, subject to the device’s current limits.

Thinking of it as only one ordinary word can encourage a weak choice. Thinking of it as a conventional account password can create a different mistake: expecting a reset email or support recovery. No reset mechanism can reconstruct a forgotten wallet passphrase.

Recovery phrase, passphrase and PIN are different

Changing one of these does not automatically change the others. A new device PIN does not create new blockchain accounts, while a different passphrase does.

How a passphrase creates hidden accounts

BIP39 wallet derivation combines mnemonic-derived material with the passphrase through a defined key-stretching process. The resulting seed is then used to derive accounts according to the relevant blockchain paths.

Conceptually:

Secret Recovery Phrase + exact passphrase → wallet seed → private keys → public addresses

A different passphrase produces a different seed. It does not return a warning saying the text is wrong because every input can produce a mathematically valid wallet. A typo therefore usually opens an empty but valid set of accounts.

Passphrase accounts do not contain existing funds automatically

Enabling a passphrase does not place a protection layer around existing standard accounts. The original accounts remain derived from the recovery phrase with the ordinary empty BIP39 passphrase. The new passphrase accounts begin with their own addresses and normally show no balance.

To protect assets with the passphrase wallet, the owner must deliberately add and verify its accounts, then send assets to those new addresses. This is an onchain transfer and can involve network fees, confirmation time and tax or recordkeeping considerations.

Exact characters matter

A passphrase must be reproduced exactly. Relevant differences can include:

• uppercase versus lowercase letters;
• one space versus two spaces;
• a leading or trailing space;
• similar-looking letters and numbers;
• punctuation and special characters;
• the exact word order;
• character normalization and supported input behavior.

HiddenWallet2026, hiddenwallet2026 and HiddenWallet2026 derive different wallets. None is inherently identified as incorrect by the device.

Temporary passphrase versus secondary PIN

Both methods derive accounts from the same recovery phrase and passphrase. The difference is how the device activates that state for daily use.

How a temporary passphrase works

The temporary option asks the user to enter the passphrase on the Ledger device. It remains active for that session under the current device behavior. After the device is turned off or the session ends, the ordinary wallet state returns and the passphrase must be entered again for access.

This reduces persistent attachment to a second PIN, but repeated entry increases the chance of using a typo and adding accounts from an unintended wallet. Compare a previously recorded public address before receiving or signing.

How the secondary PIN option works

A passphrase can be attached to a secondary PIN through the Ledger device’s passphrase settings. When the device starts, the primary PIN opens the standard accounts and the secondary PIN opens the passphrase-derived accounts.

The secondary PIN is a convenience pointer on that device. It is not the backup of the passphrase. If the device is lost, wiped or replaced, the PIN alone cannot reproduce the wallet. Recovery still requires the original recovery phrase and the exact passphrase.

Use distinct PINs and do not store a label such as “hidden-wallet PIN” beside the device. Confirm current limits and behavior for the exact model.

Three incorrect PIN attempts

Ledger devices are designed to reset after three consecutive incorrect PIN attempts. This protects against repeated guessing, but it also means the owner must have verified recovery information before relying on the device.

A reset does not destroy blockchain assets. It removes the device’s ability to access them until the correct recovery phrase—and, for passphrase accounts, the exact passphrase—recreates the keys. An inaccurate backup turns a routine reset into permanent loss.

How to choose a Ledger passphrase

A useful passphrase must be difficult for an attacker to guess yet possible for the owner or recovery plan to reproduce exactly. Length and unpredictability matter more than decorative substitutions in a familiar phrase.

Avoid:

• a name, birthday, address or phone number;
• one dictionary word;
• a phrase already used as an online password;
• a well-known quotation or song line;
• a value saved only in memory;
• ambiguous handwriting or unsupported characters;
• an unnecessarily complex input that cannot be verified reliably on the device.

The objective is not maximum inconvenience. It is a strong, reproducible secret with a durable offline recovery method.

A safe setup sequence

1. Verify the Ledger device. Complete official Genuine Check and confirm that the standard wallet backup is correct.
2. Update through the official application. Start firmware and application management inside Ledger Wallet, not from an email link.
3. Choose the operating method. Decide between temporary passphrase and secondary PIN based on the threat model.
4. Create the passphrase privately. Enter it on the Ledger device using the official settings workflow.
5. Record it securely. Preserve the exact characters offline without photographing or typing them into an internet-connected device.
6. Add one passphrase account. Give it a clear local name that does not expose sensitive information unnecessarily.
7. Verify the receive address. Display it on the Ledger and compare every relevant character.
8. Record a public checkpoint. Preserve one receive address or account fingerprint separately; this is not a spending secret.
9. Send a small test. Wait for confirmation and verify that the balance appears under the expected wallet state.
10. Test recovery. Use a safe second-device or carefully planned restoration method before meaningful funds depend on it.

Why a public checkpoint is valuable

A recorded public receive address lets the owner confirm that a restored passphrase derives the expected wallet without first moving funds. If the displayed address differs, stop. The recovery phrase, passphrase, account number, network or derivation path may not match.

A public address cannot spend the assets, but it can reveal balances and transactions. Store it where it aids recovery without unnecessarily connecting identity to the portfolio.

How to move assets into a passphrase wallet

1. Unlock the Ledger in the passphrase state.
2. Open the relevant account in the official wallet interface.
3. Generate a receive address.
4. Verify that address on the Ledger screen.
5. Copy it only after on-device confirmation.
6. Return to the standard account or sending platform.
7. Verify the network and token contract.
8. Send a small test amount.
9. Reopen the passphrase state and confirm receipt.
10. Repeat address verification before a larger transfer.

For account-based chains, tokens may share one account address but still require correct networks and contracts. For UTXO chains, address-management behavior differs. Follow the current instructions for the asset involved.

Account labels can be misleading

Ledger Wallet can retain account information after the hardware device is disconnected or opened in another wallet state. A label such as “Hidden BTC” is only local metadata. It does not prove that the currently connected Ledger can sign for that account.

Before receiving or sending, use the device verification flow. A mismatched passphrase may let the application display an old account while the hardware cannot authorize its transactions.

How to recover a Ledger passphrase wallet

Recovery requires two independent pieces:

1. restore the correct Secret Recovery Phrase on a genuine compatible device through its on-device recovery workflow;
2. activate the exact original passphrase, either temporarily or by attaching it to a new secondary PIN.

Then install the needed blockchain applications and add accounts again. The applications and local account list are not the wallet backup; the recovery phrase, passphrase and appropriate derivation rules recreate access.

A safer recovery test

The safest test avoids wiping the only working device. A compatible spare hardware wallet can be initialized with the recovery phrase in a private environment, then the passphrase can be entered and a known public address compared.

If no second device is available, plan carefully. Confirm the standard recovery phrase with Ledger’s supported recovery-check process where available, verify the passphrase backup and ensure all dependent accounts are documented. Do not reset a device merely to satisfy curiosity when significant funds depend on untested notes.

Never enter the recovery phrase into Ledger Wallet on the computer, a browser, mobile note or “recovery checker” website.

Why an empty wallet appears after recovery

An empty result does not mean the blockchain deleted the assets. It normally means the restored wallet is deriving different addresses or the relevant accounts have not been added.

Check, without exposing secrets:

• whether the recovery phrase is the correct one;
• whether the passphrase is exact;
• capitalization and spaces;
• whether temporary or attached mode is active;
• the correct blockchain application;
• account number and derivation path;
• whether Ledger Wallet has completed account discovery;
• whether a third-party wallet originally used a different path or account type.

A wrong passphrase does not show an error

This behavior is central to troubleshooting. There is no stored “correct passphrase” for the device to compare. Each passphrase creates a valid seed. The device cannot know whether the owner intended the empty wallet or another one.

Do not create transactions or add similarly named accounts until a known public address matches. Repeated guessing can produce many valid but irrelevant wallets and make the recovery process more confusing.

Passphrase and derivation paths

After the seed is derived, wallet software follows blockchain-specific derivation paths to locate accounts. Two interfaces can use the same seed but initially scan different account types or paths. This can make assets appear missing even when the passphrase is correct.

Record the wallet software, blockchain, account type and public address used. When connecting Ledger to a third-party interface, use its hardware-wallet connection flow. Do not import the Ledger recovery phrase as a shortcut.

Using a Ledger passphrase with third-party wallets

A compatible software interface can prepare transactions and ask the connected Ledger to sign them. The hardware wallet remains the signer, while the interface may control account discovery, derivation path, contract interaction and transaction presentation.

Confirm that the Ledger is in the correct passphrase state before connecting. Verify addresses and transaction details on the hardware display. A malicious or compromised interface can show false information on the computer, request a dangerous transaction or use an unexpected derivation path.

Does Ledger Recover back up the passphrase?

Do not assume that a recovery service, recovery card or backup of the main wallet also preserves a separately chosen BIP39 passphrase. Ledger states that it does not store or back up the user’s passphrase. The passphrase therefore needs its own independent recovery plan.

Our separate guide to Ledger Recover explains that optional service and its trade-offs. Its recovery workflow should not be conflated with a user-created passphrase.

Passphrase versus Ledger Recovery Key

Ledger Recovery Key is a separate PIN-protected physical backup product for compatible devices. It is not a passphrase, hidden wallet or transaction-signing hardware wallet. A backup product covering the device’s master secret should not be assumed to contain a user-selected passphrase.

Document which component protects which secret. A recovery phrase backup, Recovery Key, passphrase record and device PIN perform different jobs.

How to store the passphrase

Storing the passphrase directly beside the recovery phrase makes recovery simple but reduces the additional protection if that location is compromised. Separating them can reduce joint theft risk but increases the chance that one component is lost.

Possible designs include:

• recovery phrase in one secure location and passphrase in another;
• durable offline records held by separate trusted custodians;
• a documented inheritance process where no one person gains premature access;
• a tested threshold or legal-custody arrangement appropriate to the owner.

Do not invent complexity that the owner cannot operate during stress. Every storage plan should be tested using public address verification.

Should the passphrase exist only in memory?

Memory-only storage avoids a physical record, but creates a severe single point of failure. Injury, illness, time, stress or death can remove access permanently. A phrase remembered for months is not guaranteed to be available years later.

For assets intended to survive long-term, create a secure offline backup or recovery arrangement. Do not weaken the passphrase into a personal fact simply to make memorization easier.

Passphrase inheritance planning

An heir who receives only the 24 recovery words may restore the standard wallet and conclude that the portfolio is missing. The plan must explain that a passphrase wallet exists, how the additional secret is obtained and which public address confirms successful recovery.

A practical plan can separate:

• a non-secret inventory of networks and public addresses;
• instructions describing the recovery sequence;
• the recovery phrase;
• the passphrase;
• the conditions under which each component is released.

Do not place every secret and complete instruction in an ordinary will that may become accessible to multiple parties or part of a public record. Obtain qualified legal advice for the applicable jurisdiction.

Plausible deniability and decoy accounts

A passphrase wallet can support a structure in which the standard wallet contains a limited balance while another wallet requires an additional secret. This is often described as plausible deniability or a decoy wallet.

It is not a guarantee against coercion. An attacker may know that Ledger supports passphrases, observe onchain transfers, find backup evidence or continue applying pressure. Physical safety should take priority over a theoretical wallet design.

A decoy balance also creates tax, privacy and operational records. Avoid public statements that reveal ownership, wallet structure or exact holdings.

Can multiple passphrases be used?

Every distinct passphrase creates another valid wallet. A temporary passphrase workflow can therefore access multiple sets of accounts. A device’s attached secondary-PIN behavior and limits must be confirmed for the current model.

Multiple wallets increase compartmentalization but multiply backups, account discovery and inheritance risk. Maintain a private inventory of public checkpoints without exposing the secrets themselves.

Security benefits

• Protection after recovery-phrase exposure: passphrase accounts still require the additional secret.
• Separate wallet domains: one recovery phrase can derive isolated account sets.
• Optional secondary access state: a secondary PIN can make regular use practical.
• Limited plausible deniability: standard accounts do not reveal passphrase accounts directly.
• Compatibility with the BIP39 model: supported wallets can derive the same seed when all inputs and paths match.

Risks and trade-offs

• Permanent loss: there is no passphrase reset or support recovery.
• Silent typo risk: every typo produces another valid wallet rather than an error.
• Operational complexity: accounts can appear missing after device replacement.
• Inheritance failure: heirs may not know the extra secret exists.
• Backup fragmentation: separately stored components can be lost independently.
• Physical-device risk: an attached secondary PIN exposes the wallet to anyone who gets both device and PIN.
• False confidence: passphrases do not protect against approving malicious transactions.
• Privacy leakage: onchain transfers can link standard and hidden accounts.

What a passphrase does not protect

A passphrase does not prevent:

• blind signing of a malicious smart-contract transaction;
• sending assets to the wrong address or network;
• approval of an unlimited token allowance;
• clipboard malware changing an address shown only on the computer;
• physical coercion;
• loss of both recovery components;
• exposure caused by typing secrets into a compromised computer;
• blockchain analysis linking transfers.

Continue verifying every important address and transaction on the Ledger’s trusted display. Passphrase protection addresses recovery-secret compromise, not every wallet threat.

What to do if the passphrase is forgotten

If the original Ledger still opens the passphrase wallet through an attached secondary PIN, do not reset it. Verify the accounts, create a new secure wallet whose recovery information is known and transfer assets carefully while access remains.

If only the recovery phrase remains and the exact passphrase is unknown, Ledger cannot retrieve it. Avoid services claiming guaranteed recovery. Sharing the 24 words with such a service exposes the standard wallet and enables offline guessing attempts against the passphrase.

Check legitimate offline records and documented character conventions. Do not test guesses by entering the recovery phrase into websites or ordinary software.

What to do if the passphrase may be exposed

An exposed passphrase alone is insufficient without the matching recovery phrase, but treat the separation as weakened. If both may be exposed, create a new wallet from a newly generated recovery phrase in a safe environment and transfer assets after verifying its backup.

Moving assets only to another passphrase under the same compromised recovery phrase can leave them vulnerable to an attacker who has that phrase and can guess or obtain the new passphrase.

Passphrase troubleshooting checklist

1. Stop sending funds or changing accounts.
2. Check a known public address on a block explorer.
3. Confirm the correct Ledger and recovery-phrase origin.
4. Verify whether the intended state uses the primary PIN, secondary PIN or temporary entry.
5. Compare the passphrase offline, character for character.
6. Check for leading, trailing or repeated spaces.
7. Confirm letter case and punctuation.
8. Open the correct blockchain application.
9. Add the expected account type and number.
10. Check the derivation path used by any original third-party wallet.
11. Do not disclose secrets to support or a recovery website.

Common Ledger passphrase mistakes

• Calling it a “25th word” and choosing one weak dictionary word.
• Assuming it encrypts the existing standard accounts.
• Moving the complete balance before a recovery test.
• Storing the only copy in memory.
• Recording ambiguous capitalization or spaces.
• Confusing a secondary PIN with the passphrase backup.
• Resetting the only device while access still works.
• Assuming Ledger Recover or another backup automatically includes the passphrase.
• Entering recovery words into software to troubleshoot missing accounts.
• Trusting an account label rather than verifying an address on-device.
• Forgetting to tell an inheritance plan that passphrase accounts exist.
• Using the passphrase wallet while approving transactions blindly.

Pre-funding checklist

• The Ledger passed official Genuine Check.
• The recovery phrase has been verified offline.
• The passphrase is strong and recorded exactly.
• The storage plan separates secrets appropriately.
• The chosen temporary or attached-PIN method is understood.
• A known public address has been recorded.
• A small transfer was received successfully.
• Recovery was tested without exposing the recovery phrase.
• The intended blockchain and account path are documented.
• Inheritance or emergency recovery is addressed.

Frequently asked questions

What is a Ledger passphrase?

It is an optional BIP39 secret combined with the Secret Recovery Phrase to derive a separate wallet. Both components are required to reproduce its accounts.

Is a Ledger passphrase the same as a 25th word?

“25th word” is an informal name. The value can be a longer string containing multiple words, spaces, numbers or supported symbols rather than one BIP39 word.

Is the Ledger passphrase case-sensitive?

Yes. Capitalization and exact characters matter. A change creates a different valid wallet rather than an invalid-password message.

Does enabling a passphrase move my existing crypto?

No. It creates different addresses. Assets must be transferred deliberately from the standard accounts to verified passphrase-account addresses.

Can Ledger recover a forgotten passphrase?

No. Ledger states that it does not store or back up passphrases. Without the exact value, the associated wallet cannot be deterministically restored.

What is a Ledger secondary PIN?

It is an additional device PIN associated with one attached passphrase state. It makes routine access easier but is not a backup of the passphrase.

What is a temporary passphrase?

It is entered manually for a session and is not retained as an attached passphrase after the relevant device session ends. Current behavior should be confirmed for the device model.

Why is my Ledger passphrase wallet empty?

The passphrase may differ by a character, the ordinary wallet may be active or the correct account path has not been added. Compare a known public address before changing anything.

Can I use more than one Ledger passphrase?

Yes. Every distinct passphrase derives another wallet, although managing several substantially increases backup and inheritance complexity.

Does Ledger Recover include my passphrase?

Do not assume it does. Ledger says user passphrases are not stored or backed up by Ledger. Maintain an independent passphrase recovery plan.

Can I enter my Ledger passphrase into MetaMask?

Use MetaMask’s supported hardware-wallet connection instead. Do not type the Ledger recovery phrase or passphrase into a browser extension or website, because that removes the hardware security boundary.

Can a passphrase protect me if someone finds my 24 words?

A strong unknown passphrase prevents the recovery phrase alone from deriving those separate accounts. The attacker can still access standard accounts and attempt to guess weak passphrases offline.

Final perspective

A Ledger passphrase can provide meaningful separation when the recovery phrase is exposed and can create independent account sets for a deliberate security plan. Its strength comes with an unforgiving recovery model: the system cannot distinguish a typo from an intentional new wallet, and support cannot reset the value.

Build the recovery process before funding the accounts. Record the passphrase accurately, verify a public address, send a test amount and confirm restoration. The feature is useful only when the owner can reproduce the same wallet years later under stressful conditions.

Official sources and further reading

• Ledger Academy — Passphrase: an advanced security feature
• Ledger Support — Set up a passphrase
• Ledger Academy — Secret Recovery Phrase
• Ledger Academy — Hardware wallet security practices