A seed phrase backup method should be judged by more than its resistance to fire. Paper, steel, device-specific microSD backups and SLIP39 multi-share recovery solve different problems and introduce different dependencies. A durable plate can still be stolen, a convenient electronic backup can depend on compatible recovery tooling, and a multi-share system can fail if too many shares disappear. This guide compares the methods through the same practical questions: what must survive, what an attacker needs, how recovery works and whether another authorized person could complete it years later.
Last reviewed: October 13, 2026. Wallet backup formats, device support and recovery procedures can change. Follow the current instructions for the exact wallet and backup standard you use. This independent guide is educational and does not endorse a particular product. Never enter a real recovery phrase or recovery share into a website, cloud document, chat, AI tool or unsolicited support form.
1. First separate the backup format from the storage medium
A backup format describes how recovery information is represented. BIP39 commonly represents entropy as an ordered mnemonic of 12, 15, 18, 21 or 24 words. SLIP39 represents a master secret through one or more recovery shares and can require a chosen threshold of shares. A device-specific backup file may encode wallet recovery information in another structured format.
The medium is where that information lives: paper, card, steel, microSD or another physical object. Stamping BIP39 words into steel changes their resistance to fire and water; it does not create a new cryptographic wallet. Conversely, writing SLIP39 shares on paper preserves the multi-share format but leaves every sheet exposed to paper’s physical weaknesses.
2. Know exactly what is being backed up
Wallet terminology is inconsistent. “Seed phrase,” “recovery phrase,” “wallet backup” and “mnemonic” are sometimes used interchangeably, even though a standard can define them more precisely. Before choosing media, identify the exact recovery format generated by the wallet and the information needed in addition to the words.
A recovery phrase may restore the underlying key material while the wallet still needs the correct coin type, account, derivation path or application to display expected addresses. An optional passphrase creates a different wallet and must be reproduced exactly. A multisig wallet may additionally require information about the other keys, threshold and wallet configuration. Record non-secret context without placing every sensitive component together.
3. A hardware wallet is not the backup
A hardware wallet is a signing device that protects key use during normal operation. It can be lost, damaged, reset or become unsupported. The recovery backup is what allows control to be restored when the original device is unavailable. Keeping only the device and its PIN is therefore not a complete recovery strategy.
Do not store the only backup beside the device merely for convenience. One burglary, fire or accidental disposal could remove both. At the same time, every additional full copy creates another route to the wallet, so redundancy must be planned rather than improvised.
4. Compare methods against the same threats
A fair comparison asks what each method does when facing loss, physical damage, unauthorized discovery, transcription error, forgotten procedures, obsolete tools and owner incapacity. No medium solves all of these. A method that excels against fire can perform poorly against theft; a sophisticated threshold system can resist one compromised location yet be difficult for an unprepared heir.
| Threat | Question to ask | Common false assumption |
|---|---|---|
| Fire, water or corrosion | Will the chosen medium remain legible? | Every metal product survives every disaster |
| Theft or copying | Can one discovered item restore the wallet? | Hidden means access-controlled |
| Loss | Can the remaining components still meet recovery requirements? | More copies are always safer |
| Human error | Can order, spelling, threshold and format be verified? | A valid checksum proves the intended wallet |
| Tool failure | Which devices or applications support recovery? | Every word-based format is interchangeable |
| Time | Will instructions still make sense years later? | The owner will remember every detail |
5. BIP39 recovery words: the common baseline
BIP39 defines a way to encode generated entropy plus a checksum as a mnemonic sentence and derive a seed from the mnemonic and optional passphrase. Many hardware and software wallets support BIP39, which can make recovery less dependent on one manufacturer. Compatibility is still not unlimited: wallets may use different derivation paths, supported networks or account discovery behavior.
The words must remain in exact order. A checksum can detect many transcription errors, but passing a checksum does not prove that the phrase belongs to the intended wallet. The final recovery check should confirm known public addresses or account history through a trusted process.
6. Paper backup: the simplest physical method
Paper requires no electronics, is inexpensive and is easy to understand. A correctly written BIP39 phrase can be restored with compatible software or hardware without depending on the original sheet’s manufacturer. This transparency is valuable in an emergency because the secret is human-readable.
Simplicity also exposes weaknesses. Handwriting can be ambiguous, words can be reordered, a line can be skipped and ink can fade. Paper can burn, tear, absorb water, grow mold or be discarded as an unrecognized note. A paper backup is only as dependable as its transcription, protection and storage conditions.
7. When paper may be sufficient
Paper can be a reasonable method for a small wallet, a temporary setup or a user with controlled storage and a tested recovery process. It may also serve as a separate secondary copy when another medium protects against a different failure. The decision should reflect asset value, household access, environmental risk and the ability to maintain storage.
Use durable paper or a purpose-made card, permanent legible ink and an unambiguous numbered layout. Do not laminate or seal it until the writing has been checked for smearing and accuracy. Store it privately, and never photograph it as a convenience copy.
8. Paper failure modes to plan for
- Ink becomes unreadable through fading, moisture or abrasion.
- Similar handwriting makes one valid word look like another.
- The word order is unclear because numbers are missing.
- A fold, tear or stain destroys one portion of the phrase.
- The sheet is thrown away because its purpose is not understood.
- A finder photographs it and returns it without visible evidence.
- Both device and paper are stored in the same vulnerable location.
A sealed envelope can reveal casual opening but does not guarantee secrecy. Tamper evidence is useful only if someone checks it and knows what action to take after a seal is disturbed.
9. Steel backup: durability rather than encryption
A steel backup records recovery information on a medium intended to resist hazards that destroy paper. Depending on the alloy, thickness, marking depth and construction, it may offer better resistance to heat, water, impact, corrosion and long-term deterioration. This can reduce the chance that a building event makes the words unreadable.
Steel does not encrypt the phrase. Anyone who can read or copy a complete BIP39 record can normally restore the wallet without the hardware device. Physical durability makes location security more important because the secret may remain usable after an attacker finds it.
10. Plate, tile, washer and capsule designs
Metal backups use different layouts: flat plates with stamped letters, punched character grids, stacked washers, tiles inserted into frames and capsules holding letter components. The important comparison is not appearance but whether the completed record unambiguously preserves the required information under foreseeable conditions.
Check the supported word count, language, character capacity and whether the design stores full words or prefixes. Determine which tools are required and whether pieces can move, mix or fall out. A sealed product that cannot be inspected may hide a setup error for years.
11. Full words versus four-letter BIP39 prefixes
Within a given BIP39 word list, the first four letters uniquely identify each word. Some metal systems use those prefixes to save space. This can work when the backup is definitely BIP39 in the expected language and the characters remain clear.
Do not apply the rule blindly to SLIP39 shares, another mnemonic standard or a wallet-specific backup. Record the backup format separately from the secret. If a future helper sees only abbreviated text without context, the compact design can become a recovery obstacle.
12. Steel setup creates its own human-error risk
Hammering stamps into metal, arranging tiles or punching a grid is less forgiving than writing on paper. Characters can be reversed, positions skipped and words recorded in the wrong order. Noise, fatigue and poor lighting can increase errors, while repeated handling exposes the phrase for longer.
Plan the layout with a dummy phrase first. Work privately, keep phones and cameras away, and compare the completed record through a device-native backup check where supported. The separate steel stamping guide explains layout and error checks in detail.
13. Steel does not automatically mean fireproof
“Fireproof” can be an imprecise marketing term. Performance depends on material, temperature, duration, deformation, debris, corrosion after exposure and whether the marks remain identifiable. A home fire can also make a location inaccessible even when the plate itself survives.
Read manufacturer specifications as product claims, not universal guarantees. Consider the storage container and retrieval plan as part of the system. A plate trapped inside a damaged safe or discarded during cleanup is not useful merely because the words remain intact.
14. The true cost of steel is the complete system
The retail plate is only one cost. Tools, practice material, duplicate copies, secure storage, shipping, taxes and replacement after an error all affect the total. A premium mechanism can reduce setup effort but does not remove the need for verification and controlled locations.
Compare cost with the value and time horizon of the wallet, not with marketing status. Our separate steel seed backup cost guide covers tools, duplicates, storage and replacement expenses.
15. microSD backup: an electronic physical object
Some hardware wallets can create a structured backup on a microSD card. This may avoid manual word transcription and provide a quick supported restoration flow. The card is removed from the device and stored physically, so normal recovery does not require a cloud account.
A microSD backup is not merely “the seed phrase saved as a text file.” Its format, encryption choices and restoration process are product-specific. For example, BitBox documents that its normal microSD restoration uses a BitBox02 and that physical access to the unencrypted backup card must be treated as access to the wallet. Always follow the instructions for the exact device.
16. Advantages of a device-generated microSD backup
Automatic creation can reduce spelling and word-order errors. Recovery can be faster because the device reads the structured file instead of asking the user to enter many words. A small card is easy to place in a physical security container and can coexist with an independent analog backup.
The benefit depends on a successful device-native creation and verification process. A card copied or reformatted on an ordinary computer may not preserve the intended security model. Remove it after setup and do not use the backup card for photos, documents or everyday data.
17. microSD limitations and dependencies
Electronic media can be lost, damaged, corrupted or accidentally overwritten. The card’s backup format may not restore directly on another manufacturer’s wallet. A future owner may need compatible hardware, documentation or a special emergency process. These dependencies should be understood while the original device still works.
Do not insert the backup card into a phone, camera or general computer merely to inspect it. That can expose or alter the contents. Use the wallet’s documented backup verification function. If emergency extraction exposes recovery words on a computer, official guidance may require treating those words as compromised and moving funds to a fresh wallet.
18. A digital backup is not safe merely because it is encrypted
An encrypted file adds a password, software, format and decryption procedure that must all remain available. A weak password can fail against offline guessing; a strong forgotten password can make the backup useless. Cloud synchronization, malware, backups of the backup and temporary plaintext files can expand exposure.
Do not create an improvised photo, note, PDF or password-protected archive of recovery words as a default strategy. If a wallet officially supports a digital backup format, assess its documented recovery and encryption model rather than assuming that general-purpose file encryption reproduces it safely.
19. SLIP39 multi-share recovery: threshold instead of full copies
SLIP39 defines mnemonic shares for backing up a hierarchical deterministic wallet master secret. A user can create several unique shares and choose how many are needed to recover. In a 2-of-3 design, any two valid shares can reconstruct the required secret; one share alone is insufficient, and losing one share still leaves a recovery path.
This changes the consequences of one discovered location. It does not make storage unimportant. If an attacker reaches the threshold, the wallet can be recovered. If the owner loses enough shares to fall below the threshold, recovery fails.
20. Threshold choice changes both security and availability
A lower threshold makes recovery more tolerant of lost shares but means an attacker needs fewer shares. A higher threshold requires more compromise but creates greater risk that unavailable participants or locations prevent recovery. The total number of shares also changes the number of items that must be inventoried and maintained.
| Example | Can tolerate | Attacker needs | Main concern |
|---|---|---|---|
| 2-of-3 | One unavailable share | Any two shares | Two locations must never be easily compromised together |
| 3-of-5 | Two unavailable shares | Any three shares | More distribution and coordination to maintain |
| 3-of-3 | No unavailable share | All three shares | One lost share can make recovery impossible |
These examples explain structure, not a recommendation. Choose a threshold from a realistic threat and recovery model, not because a larger number looks more advanced.
21. SLIP39 and BIP39 are not interchangeable word lists
SLIP39 is designed as a separate standard, and its shares are not ordinary fragments of a BIP39 sentence. A set of SLIP39 words cannot generally be concatenated into a BIP39 phrase. A wallet must support the relevant format and threshold recovery.
Label non-secret instructions with the standard, share count, threshold and compatible recovery workflow without placing all shares together. Never enter shares into an online “converter.” Moving an existing wallet to a different backup standard may require generating a new wallet and transferring assets through verified transactions.
22. Single-share SLIP39 versus multi-share SLIP39
A single-share SLIP39 backup uses the SLIP39 format without distributing recovery across several shares. It can offer format-specific capabilities, but one complete share remains a single recovery object. Multi-share mode introduces threshold recovery and distribution.
Do not assume that “20 words” identifies a familiar BIP39 backup. Trezor documentation distinguishes 20-word SLIP39 backups from 12- or 24-word BIP39 backups. Preserve the format context so a future recovery does not start with the wrong wallet workflow.
23. Recovery compatibility matters more than word count
A backup is useful only if trusted recovery tooling can interpret it. BIP39 is broadly implemented, but address discovery can still depend on wallet support and derivation details. SLIP39 support is narrower and should be confirmed for the intended backup device and fallback tools. Device-specific files can have the narrowest normal recovery path.
Document official recovery sources and retain non-secret device and format information. Do not preinstall random recovery software or keep secret words beside instructions. Periodically confirm that the manufacturer still documents the workflow and that a legitimate replacement device is obtainable.
24. A passphrase is a separate recovery dependency
An optional BIP39 passphrase combines with the mnemonic to derive a different wallet. Every exact passphrase can lead to a valid-looking wallet, so a typo may reveal an empty wallet rather than an error message. The recovery words alone do not restore assets protected by a forgotten passphrase.
Do not stamp or write the passphrase on the same object as the full seed if separation is meant to provide protection. Do not rely solely on memory for important assets. Store and test it through a separate documented method appropriate to the threat model.
25. Multisig is different from secret sharing
In a multisignature wallet, several distinct keys participate in authorizing a transaction according to a policy such as 2-of-3. SLIP39 divides the recovery material for one wallet master secret into shares. Reconstructing the SLIP39 threshold recovers that one secret; collecting multisig backups restores the separate keys needed by the wallet policy.
A multisig recovery plan may also need the wallet descriptor, script type, key origin information and cosigner details. Backing up one multisig key with SLIP39 is possible in some environments, but it adds layers rather than making the two systems equivalent. Users considering multisig should follow wallet-specific documentation and practice with a low-value setup.
26. Side-by-side backup comparison
| Method | Physical durability | Compatibility | Setup complexity | One item can restore? |
|---|---|---|---|---|
| BIP39 on paper | Low to moderate | Broad, with wallet details still relevant | Low | Usually yes, unless a separate passphrase is required |
| BIP39 on steel | Potentially high, product and marking dependent | Broad if accurately recorded | Moderate | Usually yes, unless a separate passphrase is required |
| Device-specific microSD | Electronic media limitations | Usually tied to a documented device workflow | Low during supported setup | Often yes; check the exact implementation |
| SLIP39 multi-share | Depends on the medium used for each share | Requires SLIP39 support | Higher | No, when fewer than the threshold are present |
| Multisig | Depends on every key backup | Requires compatible wallet configuration | High | Not when policy requires multiple keys |
27. Compare theft risk separately from damage risk
Paper and steel holding a complete phrase have similar consequences when read by an attacker, even though their physical durability differs. An unencrypted microSD backup can also represent full access when its documented recovery process is available. SLIP39 can reduce the value of one isolated share, but only while the threshold is not reached.
Use physical access control, location separation and a controlled inventory. Obscurity can supplement these controls but should not replace them. A clever hiding place may become inaccessible after moving, renovation, incapacity or death.
28. Compare loss risk separately from theft risk
One full copy has a simple recovery process but creates a single point of loss. Multiple full copies improve availability while expanding the number of theft targets. Threshold shares can tolerate selected loss without giving each location the whole secret, but a poorly chosen threshold can make ordinary unavailability fatal.
Think through one-location loss, two-location loss and the temporary unavailability of a person or institution. The advanced seed backup threat-model guide provides a broader framework for redundancy and disaster testing.
29. Compare recovery complexity honestly
A method is too complex when the owner cannot explain and test it without exposing the secret. Paper and steel BIP39 backups have a familiar word-entry flow. A microSD card can simplify recovery on a supported device but may complicate fallback recovery. SLIP39 requires the correct number of compatible shares and supported tools.
Complexity increases further with passphrases, distributed custody or multisig. Each layer should solve a named risk and have documented non-secret instructions. Do not build a puzzle whose security depends on remembering undocumented exceptions.
30. Compare maintenance and inspection
Paper should be checked for fading, moisture, pests and container failure. Steel should be checked for corrosion, displaced components and legibility. microSD should be verified through the device’s supported backup-check function rather than mounted on a general computer. Distributed shares require confirmation that the necessary locations remain available.
An inspection should not involve photographing, transcribing or repeatedly exposing the secret. Record the inspection date and result separately. Our guide to verifying a seed phrase backup safely explains how to check wallet correspondence without using an online phrase checker.
31. Scenario: a small everyday wallet
For a low-value wallet used for learning or routine spending, a clear paper backup in controlled storage may be proportionate. The recovery process should still be verified, and the phrase must stay offline. Adding a complex threshold scheme can create more operational risk than it removes.
“Low value” should be revisited as the balance changes. If the wallet grows into long-term savings, redesign recovery before the existing copy becomes the only protection for a material amount.
32. Scenario: long-term hardware-wallet savings
Long time horizons increase exposure to fire, water, moves, forgotten context and hardware obsolescence. A correctly created steel BIP39 backup can improve physical durability, while a separately protected copy or threshold plan can address location loss. Compatibility and recovery testing remain essential.
Do not assume that buying a durable product completes the design. Consider where it will be stored, who can reach it, whether a passphrase exists, how the intended wallet is identified and what happens if the owner is unavailable.
33. Scenario: travel or frequent relocation
Frequent movement makes hidden home storage less dependable and transporting a complete phrase more exposed. Avoid carrying a full seed casually with the hardware wallet. A thoughtfully distributed threshold design may reduce dependence on one object, but recovery locations must remain reachable across legal and geographic boundaries.
Do not transmit shares through ordinary email or cloud notes. Review border, storage, insurance and legal considerations with qualified professionals where material. The best travel arrangement is one that does not require handling recovery secrets during routine trips.
34. Scenario: family and inheritance
An heir may have legal ownership yet lack technical access, or may discover a complete phrase before authority exists. A backup comparison must therefore include understandable instructions, legal coordination and safe timing. Paper is easy to recognize but easy to copy; steel is durable but may look like scrap; shares can distribute trust but require coordination.
Keep legal documents free of complete recovery secrets unless qualified advice supports a specific arrangement. The separate seed phrase inheritance plan explains how to connect authority, instructions and recovery without exposing the wallet during the owner’s lifetime.
35. Combining methods can address different failures
Paper plus steel can provide media diversity, but both may contain the same complete secret. microSD plus recovery words can provide quick device-native restoration and a broader analog fallback. SLIP39 shares can be stored on different media, though every share still needs accurate recording and physical protection.
Combination is useful only when each component has a defined purpose. An undocumented collection of plates, cards and files can create confusion about which backup is current. Maintain a non-secret inventory and retire obsolete backups securely after funds move to a new wallet.
36. Signs that a backup plan is overengineered
- The owner cannot state the format, threshold and recovery steps clearly.
- Recovery depends on custom software from an unknown source.
- No one knows which copy or share set is current.
- Several passphrases exist only in memory.
- Shares are split manually using an improvised scheme.
- A single missing note explains how every component fits together.
- The plan has never been tested with a harmless wallet or device-native check.
- Complexity was added for prestige rather than a defined threat.
37. When to migrate to a new wallet
Create a new wallet with fresh recovery material if the phrase may have been photographed, typed on an online device, entered on a suspicious site or accessed by an unauthorized person. Also consider migration when the current backup format cannot support the required recovery design or when obsolete copies cannot be confidently controlled.
Verify a receiving address on the trusted wallet display, send a small test transaction and confirm it before transferring the remaining assets. Preserve necessary public records, then securely retire the old backups. A compromised phrase cannot be made safe by moving it from paper to steel.
38. Seed backup decision matrix
| Priority | Method worth evaluating | Important limitation |
|---|---|---|
| Low cost and broad readability | BIP39 on durable paper | Physical damage and transcription risk |
| Resistance to severe physical damage | BIP39 on properly marked steel | A stolen full copy still controls the wallet |
| Fast supported device recovery | Official device-generated microSD backup | Format, hardware and media dependencies |
| No single location should hold enough information | SLIP39 multi-share with tested threshold | Compatibility and operational complexity |
| Independent signing authorities | Properly designed multisig | Each key and wallet configuration needs backup |
39. Practical selection checklist
- Identify the exact backup standard and all additional recovery dependencies.
- List realistic risks: loss, theft, fire, water, relocation and incapacity.
- Decide whether one found object may be allowed to restore the wallet.
- Confirm which trusted devices or applications support the format.
- Choose media that address the relevant physical environment.
- Calculate tools, copies, storage and maintenance—not only purchase price.
- Keep any optional passphrase separate and recoverable.
- Write non-secret instructions for format, wallet type and recovery sequence.
- Verify the backup through an official device-native or controlled process.
- Test the human workflow with a separate empty or low-value wallet.
- Record locations without copying secrets into the inventory.
- Schedule periodic inspection and review after moves or major life changes.
Frequently asked questions
Is steel always better than paper?
Steel can offer much stronger resistance to physical damage, but it does not reduce the power of a stolen complete phrase. Paper may be adequate for some low-risk situations, while long-term holdings may justify more durable media and stronger location controls.
Can I store a seed phrase on a USB drive or microSD card?
Do not create an ordinary text file as a default backup. A wallet’s official microSD feature has a documented format and recovery model; improvised digital storage can expose plaintext, depend on passwords or become unreadable. Follow the exact wallet documentation.
Is SLIP39 the same as splitting a BIP39 phrase into pieces?
No. SLIP39 is a defined secret-sharing standard with unique shares and a recovery threshold. Manually dividing BIP39 words into groups creates different security and loss properties and should not be described as SLIP39.
Does one SLIP39 share reveal part of the wallet?
The SLIP39 specification is designed so that fewer than the required threshold of valid shares does not reveal the master secret. However, share metadata and physical possession can still disclose that a backup arrangement exists, and enough shares restore the wallet.
Can a BIP39 wallet be restored from SLIP39 shares?
They are different formats and are generally not directly interchangeable. Use a wallet that supports the backup actually created. Migrating an existing wallet to another standard may require creating a new wallet and transferring funds.
Should the seed phrase and passphrase be stored together?
Not when separation is intended to protect the wallet. Anyone obtaining both can restore the protected accounts. The passphrase must nevertheless have its own reliable recovery method because losing it can permanently prevent access.
How often should a backup be checked?
There is no universal schedule. Review after creation, relocation, storage damage, device changes or changes to the recovery plan, and perform periodic inspections appropriate to the medium. Avoid unnecessary exposure during every check.
Can support recover a lost seed phrase?
Legitimate self-custody wallet support normally cannot recreate a lost secret. Anyone asking for existing recovery words, a private key or payment to “unlock the blockchain” should be treated as suspicious.
Official standards and wallet documentation
Use these primary standards and official wallet resources to verify the format and recovery workflow before choosing or changing a backup method:
- Bitcoin BIP39 — Mnemonic code for generating deterministic keys — the specification for BIP39 entropy, checksum, mnemonic lengths and seed derivation.
- SatoshiLabs SLIP39 — Shamir’s Secret-Sharing for Mnemonic Codes — the standard defining shares, thresholds, groups and BIP39 compatibility boundaries.
- Trezor — What is Shamir Backup? — an official explanation of multi-share recovery and threshold examples.
- Trezor — Understanding 12-, 20- and 24-word wallet backups — differences between BIP39 and SLIP39 formats and device support.
- Trezor — Recover a wallet with Multi-share Backup — the official SLIP39 recovery workflow.
- BitBox — Hardware wallet backups: microSD, recovery words or steel? — official trade-offs among device-generated microSD, paper and steel options.
- BitBox — Set up a microSD card backup — creation, storage and security boundaries for a device-specific card backup.
- Bitcoin BIP48 — Multi-Script Hierarchy for Multi-Sig Wallets — technical context for deterministic multisig wallets, which are distinct from secret-sharing backups.
Final takeaway
Choose a seed phrase backup method by the failures it must survive, not by one dramatic product claim. Paper favors simplicity and broad readability. Steel improves physical resilience. A supported microSD workflow can reduce transcription effort while adding device and format dependencies. SLIP39 can distribute recovery across shares but raises the demands on compatibility, inventory and threshold planning.
The best design is understandable, recoverable and proportionate. Identify the standard, protect every component, separate additional secrets, verify recovery safely and document the process without duplicating the secret. A modest plan that has been tested is more dependable than an elaborate arrangement nobody can reconstruct.