How to Evaluate Steel Seed Backup Tests: Fire, Corrosion, Crushing, Readability and Recovery Confidence

A metal backup does not pass a disaster test merely because some metal remains. The real question is whether an authorized person can reconstruct the exact wallet backup—including format, character positions and word order—without guessing. Heat can erase a printed template while leaving punched marks; corrosion can remove shallow engraving; crushing can mix tiles or fold positions over one another. This guide explains how to read fire, corrosion and deformation tests, separate measurable evidence from marketing and judge whether the surviving information still supports a reliable recovery.

Last reviewed: October 16, 2026. Materials, product designs, wallet backup formats and manufacturer claims change. Confirm the current specification and instructions for the exact product and wallet. Never perform destructive testing on a real recovery phrase. Fire, chemicals, power tools and presses can cause serious injury and require qualified facilities. This independent guide is educational and is not affiliated with a manufacturer.

1. Define success before reading a test

A test needs a pass condition. “The plate survived” is too vague. For a wallet backup, success means enough information remains to reproduce the exact secret using the correct standard, wordlist, order and any required threshold. A scorched plate can look impressive while losing one positional marker that makes several readings plausible.

Write a recovery-oriented condition: an independent authorized person, given the documented format but not the original phrase, can decode the sample without guessing. Cosmetic damage is acceptable when data and order remain unambiguous. Beautiful metal is a failure when essential information disappears.

2. Identify what the product stores

Before comparing durability, identify the payload. A product might hold a 12- or 24-word BIP39 mnemonic, a 20-word SLIP39 share, first-four-letter prefixes, numeric word indexes, punched grid positions or movable letter tiles. These formats fail differently.

Do not assume that every “seed plate” stores the same thing. A plate designed for 24 BIP39 words may not correctly represent a 20-word share, and a product that holds one share is not a complete multi-share recovery system by itself.

3. BIP39 determines the information requirement

BIP39 maps entropy plus a checksum into an ordered mnemonic of 12, 15, 18, 21 or 24 words. Each word corresponds to an index in a 2,048-word list. The order is essential; preserving all words in a different sequence does not preserve the same wallet.

The BIP39 English list was designed so the first four letters identify each word uniquely. A correctly designed four-letter backup can therefore be complete for that specific list. This does not justify abbreviating an unrelated format or language without confirming its rules.

4. A checksum detects some errors, not every error

The BIP39 checksum can reject many incorrect combinations, but it is short and is not an error-correction system. The specification notes that some random errors can still produce a valid checksum. A successful checksum is evidence of a structurally valid mnemonic, not proof that it is the intended one.

Do not use the checksum as permission to accept vague marks. If damage leaves two plausible letters or positions, preserve all observations and use a controlled recovery procedure. Never test candidate real phrases in websites or ordinary connected software.

5. Separate medium, construction and encoding

A strong alloy cannot compensate for loose components or an encoding whose template disappears. Conversely, a visibly deformed solid plate may still preserve every deeply punched coordinate.

6. Compare full-word and abbreviated records

Full words are easier to interpret without an external lookup but require more space and more marks. Four-letter prefixes reduce work while depending on the correct wordlist. Numeric indexes are compact but require a reliable mapping from number to word. Coordinate grids may survive when surface labels do not, provided the orientation and grid definition remain known.

A test report should show what was encoded, not merely a product photographed empty. Durability of the enclosure says little about retention of the actual marking method.

7. Position information is part of the secret record

A backup must distinguish word 1 from word 12. Numbered rows, fixed slots and a clear reading direction can preserve order. Movable components need a mechanism that prevents rotation, reversal and mixing after impact.

When reviewing damaged samples, ask whether the top, front and starting position remain identifiable. If turning the object around creates another plausible sequence, the result is not unambiguous.

8. Mark depth matters

Deep plastic deformation from stamping or center punching can remain visible after paint, ink and surface finish disappear. Shallow engraving may depend more heavily on contrast and an intact surface. Depth alone is not sufficient: excessively forceful marking can distort thin material or make nearby positions harder to distinguish.

A meaningful report identifies the tool and technique used. A manufacturer testing a professionally laser-engraved sample may not demonstrate how a customer’s lightly struck character will behave.

9. Test the weakest component

A capsule may combine a high-temperature shell with lower-temperature internal parts. A tile device may rely on a fastener, cable or frame to retain letters. A plate may depend on an inked template that is less durable than the substrate.

Look for results covering every data-bearing and order-preserving component. Quoting the melting point of the strongest material hides failures elsewhere in the assembly.

10. What a fire test can show

A controlled heat exposure can show how one prepared sample reacts to a stated temperature, heat source and duration. It can reveal warping, oxidation, opening, tile movement, loss of printed labels and changes in readability.

It cannot prove survival in every building fire. Real events vary in fuel, oxygen, hot spots, structural load, debris, firefighting water and exposure time. Treat the result as comparative evidence under disclosed conditions, not an unlimited “fireproof” guarantee.

11. Temperature without duration is incomplete

A brief contact with very high flame and a long period in a hot enclosure impose different conditions. A test should report both temperature information and duration, along with how temperature was measured. The torch’s advertised maximum is not necessarily the sample’s uniform temperature.

Be cautious when a demonstration shows a dramatic flame for seconds but supplies no measurement, timing or post-test decoding. Visual intensity is not a test protocol.

12. Local flame versus whole-object heating

A torch concentrates energy in a small region. A furnace can heat the assembly more evenly. Local heating may create severe gradients and warping, while enclosure heating may affect all fasteners and internal pieces. Neither method reproduces every disaster.

Comparison requires similar protocols. Product A exposed to one minute of local flame cannot be ranked fairly against Product B exposed for ten minutes and then quenched.

13. Cooling is part of the event

Firefighting can rapidly cool hot metal. Thermal shock may deform components, loosen layers or change surface scale. Jameson Lopp’s published tests have included water immersion after heating to simulate this additional stressor.

A test that ends when the flame stops may miss damage during handling and cooling. Post-test images should be taken after the sample is safe, cleaned only according to a disclosed method and ready for decoding.

14. Melting point is not a recovery score

An alloy’s melting range is only one property. Long before complete melting, a backup may warp, oxidize, lose contrast, release tiles or become fused to debris. The relevant question is whether the encoded information remains recoverable.

Marketing that compares a single material number with an assumed house-fire temperature omits geometry, thickness, assembly and marking method. Product-level evidence is more useful than a material fact presented alone.

15. Read heat discoloration correctly

Heat can produce scale and colors that obscure shallow marks. Discoloration is not automatically data loss: angled light, raking illumination or careful removal of loose residue may reveal permanent impressions. Any cleaning method should avoid grinding away evidence.

A report should distinguish “not immediately readable in one photograph” from “physically absent.” It should also show whether interpretation required the original phrase, which could bias the assessment.

16. What a corrosion test can show

A corrosion test explores reaction to a defined chemical environment for a defined time. It may expose poor material choices, galvanic interactions, vulnerable fasteners or markings that disappear as the surface is attacked.

It does not recreate every basement, coastal atmosphere, flood, soil or safe. Acid immersion is an aggressive comparative stress, not a prediction that a product will last a specific number of years in ordinary storage.

17. Document the corrosive environment

Useful reporting states the chemical, approximate concentration, exposure time, temperature and whether the solution remained active. “Acid tested” without these details cannot be reproduced or compared.

Look for before-and-after mass, thickness or clear photographs where available. Most importantly, require a decoding result rather than a statement that the metal “still exists.”

18. Galvanic and crevice risks

Assemblies containing dissimilar metals can behave differently at their contact points, especially with moisture or salts. Tight gaps can retain contaminants and create crevice conditions. A material list that names only the exterior may omit the fastener that keeps the data ordered.

For long-term storage, construction simplicity can reduce hidden interfaces. This is a design consideration, not proof that every single-piece plate is better than every assembly.

19. Cleaning can change the evidence

After fire or corrosion, aggressive wire brushing, sanding or polishing may erase shallow characters. A fair report explains whether the sample was rinsed, neutralized, brushed or otherwise treated before photographs and scoring.

In a real recovery, preserve the object and document its condition before alteration. If professional conservation or forensic help is justified by the value at risk, avoid experimenting on the only surviving backup.

20. What a crushing test can show

Compression can reveal bending, folding, case rupture, tile movement and loss of sequence. A hydraulic press produces a documented force but not every pattern of building collapse. Impact, puncture and abrasion create different damage.

Evaluate the final data, not how flat the object looks. A severely bent plate with legible ordered marks can outperform a neat-looking capsule whose internal pieces have mixed.

21. Force needs context

A force number is meaningful only with contact area, orientation, support and application method. Pressure concentrated on a narrow edge differs from load spread over a plate. Reports should show how the sample was positioned and whether the data side faced the load.

A large tonnage in a headline is not a complete methodology. Comparable products should face comparable loading and decoding rules.

22. Loose components need an order test

For tiles, washers and capsules, inspect whether every component remains present and sequenced. If the container opens, surviving characters may still be useless when their positions cannot be reconstructed.

A test should not quietly reassemble pieces using pre-test photographs. The evaluator should attempt recovery from the post-test object and the product’s normal public instructions, not privileged memory of the original arrangement.

23. Readability is a structured measurement

Score each required position as clear, partially ambiguous, missing or displaced. Record whether orientation and word boundaries survive. A total such as “95% readable” can conceal that the missing 5% includes several critical positions.

The strongest check is blind decoding: another person receives the damaged dummy sample and format documentation but not the original phrase. Their result is compared with the known dummy record.

24. Separate character recognition from wallet recovery

25. Use independent scoring where possible

A manufacturer knows the expected data and has an incentive to present a favorable result. Independent tests can reduce that bias, especially when they publish consistent protocols and high-resolution post-test evidence. Independence does not make a method perfect; examine its limitations too.

Prefer reports that disclose sample preparation, conflicts, sponsorship and scoring. A reviewer who changes methodology between rounds should explain why and avoid direct rankings that ignore the difference.

26. Recognize weak marketing demonstrations

• No exact product version or material specification.
• No dummy data visibly encoded before exposure.
• No measured duration or conditions.
• Only the best camera angle is shown.
• No post-test decoding attempt.
• The tester already knows every expected character.
• A material melting point is presented as product certification.
• “Fireproof,” “indestructible” or “lifetime” is undefined.
• Movable components are not tested while assembled.
• Results from one design are applied to another model.

27. Recognize a useful test report

• Exact model, version and construction are identified.
• Public dummy data and marking method are documented.
• Exposure, duration, equipment and sequence are described.
• Before-and-after images show all data-bearing areas.
• Cleaning and handling are disclosed.
• Every position is assessed, including order markers.
• A blind or independently checked decode is attempted.
• Limitations and failures are reported clearly.
• The conclusion is restricted to the tested conditions.

28. One sample does not establish production consistency

A result applies directly to the tested unit. Material batches, thickness, fasteners, finishes and manufacturing tolerances can vary. Product revisions may keep a similar name while changing construction.

Check the date and exact version. Several consistent samples provide stronger evidence than one. No reasonable number of destructive tests guarantees the user’s particular copy, marking quality or storage environment.

29. Compare reports with a normalization table

If essential fields are absent, mark the evidence unknown rather than filling gaps with assumptions.

30. Do not destructively test a real backup

A real mnemonic controls assets. Heating, soaking, crushing or transporting it to a testing facility creates unnecessary loss and disclosure risks. Even a successful demonstration may leave the secret visible to observers, cameras or waste handlers.

Use a dummy mnemonic generated only for training, with no assets and no relationship to the production wallet. Clearly identify it as test data without marking the actual secret on the same object.

31. Build a safe dummy test

1. Choose a public test vector or create a wallet used exclusively for testing.
2. Confirm that it has never received assets and will never be reused.
3. Record the product version and every supplied component.
4. Mark the sample using the normal instructions and realistic effort.
5. Photograph only the dummy sample for the test record.
6. Verify the encoded dummy data before any exposure.
7. Use a qualified facility for hazardous testing.
8. Ask a second person to decode the final sample without the original phrase.
9. Compare every position and record ambiguity.

A dummy test evaluates setup and interpretation for that sample. It cannot certify the production backup or replace safe storage.

32. Practice without dangerous exposure

Most owners gain more value from a setup rehearsal than from recreating extreme stress. Use scrap metal or a spare plate to practice alignment, force, numbering and reading direction. Verify that the chosen tool produces consistent legible marks.

Then perform a non-destructive blind decode with dummy data. This catches human errors—wrong order, skipped position, reversed side or weak marks—that material marketing cannot prevent.

33. Do not reproduce acid and fire tests casually

Torches, furnaces, acids, hot metal, fumes and hydraulic presses can injure people and damage property. Some alloys, coatings and contaminants produce hazardous conditions when heated or chemically attacked. Internet instructions are not a substitute for appropriate training, ventilation and protective equipment.

Rely on published evidence or a qualified laboratory. The goal is dependable recovery, not a dramatic home video.

34. Inspect a backup after a real disaster

1. Do not enter an unsafe building or disturb an active incident scene.
2. When lawful and safe, document the object’s location and condition.
3. Handle sharp, contaminated or chemically exposed metal with appropriate help.
4. Do not scrub, sand or unfold it aggressively.
5. Preserve orientation and loose components.
6. Move the object to a private controlled recovery environment.
7. Transcribe observations without uploading photographs.
8. Use a compatible trusted recovery process.

35. Treat exposure and damage as separate risks

A plate can remain perfectly readable but be photographed during cleanup. Physical recovery does not prove confidentiality. If unauthorized viewing was reasonably possible, the safe response may be to restore only long enough to migrate assets to a new wallet generated from fresh secret material.

Do not “repair” confidentiality by changing a device PIN or copying the same words to a new plate. Anyone who learned the old mnemonic may retain access to the old wallet.

36. Use a known public address as a recovery check

A known address can help confirm that the mnemonic, optional passphrase and derivation settings reproduce the intended wallet without first moving funds. Preserve such identifiers separately from the secret where appropriate.

Seeing an empty wallet does not automatically mean the backup is wrong. The cause may be a missing passphrase, different address type, derivation path, account index or network. The separate seed recovery guide covers those compatibility issues in detail.

37. Understand missing-character risk

If a full word retains a distinctive prefix, the BIP39 English list may identify it. If only one or two letters remain, many candidates may exist. Numeric and grid formats have different ambiguity patterns.

Do not publish damaged real fragments to crowdsource recovery. Partial secret material combined with public addresses or other leaks can aid attackers. Use a controlled offline specialist process when the value and uncertainty justify it.

38. Keep the optional passphrase in scope

A BIP39 mnemonic with a passphrase derives a different wallet for every passphrase value. A flawless steel record of the mnemonic alone cannot recover the intended assets when the passphrase is lost. Storing the passphrase on the same plate may remove the separation benefit.

A test report normally evaluates the metal product, not the owner’s complete recovery plan. Judge physical resilience and recovery completeness separately.

39. Multiple copies change the conclusion

Two independent backups can protect against one local destruction event, while every additional complete copy creates another theft and disclosure target. A test result for one plate does not decide how many copies the owner needs.

Use a threat model covering fire, flood, burglary, access, inheritance and geographic separation. Multi-share designs require enough surviving shares and compatible recovery instructions; one durable share may still be insufficient.

40. A durability score is not a product recommendation

A product can perform well under heat and still be difficult to mark correctly, too small for the required format, expensive to duplicate or dependent on tiny loose pieces. Usability mistakes may be more likely than an extreme fire.

Combine test evidence with compatibility, setup error risk, storage, privacy, cost and recovery practice. Avoid turning one laboratory-like grade into a universal “best” ranking.

41. Evidence hierarchy

42. Complete evaluation checklist

• The exact product version is identified.
• The backup standard and word count are compatible.
• The tested sample contains realistic dummy data.
• The marking method matches normal user setup.
• Every data-bearing component is exposed.
• Temperature, duration and heat source are described.
• Cooling and cleaning are disclosed.
• Corrosion chemistry and time are documented.
• Crush force, contact and orientation are explained.
• Orientation and word order survive.
• Loose pieces remain present and sequenced.
• Every position is scored for ambiguity.
• A blind decode is attempted.
• The conclusion does not exceed the evidence.
• Setup, theft and passphrase risks are evaluated separately.

43. Example: the plate survives but the template disappears

A punched grid remains visible after heat, but printed row and column labels are gone. Recovery succeeds only if orientation, grid dimensions and decoding convention can be reconstructed reliably. An engraved key or unmistakable physical orientation may save the record; a separate lost paper template may make it ambiguous.

The correct score is not automatically “pass because all holes remain.” Perform a blind decode using only what an authorized heir or future owner would possess.

44. Example: tiles survive but mix

Every letter tile remains intact after crushing, yet the enclosure opens and order is lost. Character durability is excellent, but mnemonic recovery may be infeasible because the sequence carries essential information.

A report should score information loss, not component survival. Reassembling from a pre-test photograph hides the actual failure.

45. Example: one stamped letter is unclear

A deeply stamped four-letter prefix retains three certain characters and one ambiguous character. Search the correct standardized wordlist offline and document every candidate. Check positions and checksum in a controlled environment, recognizing that a valid candidate is not automatically the intended phrase.

When the real backup may also have been viewed during recovery, plan migration to new secret material after access is restored.

Frequently asked questions

Does stainless steel automatically make a backup fireproof?

No. Alloy, thickness, construction, marking, exposure and order retention all matter. “Fireproof” needs defined conditions.

Is titanium always better than stainless steel?

Not automatically. Evaluate the complete product, marking and recovery result rather than the material name alone.

Can I test my real seed plate with heat?

No. Destructive testing risks loss and disclosure. Use public dummy data on a separate sample and qualified facilities.

Are four letters enough for every seed phrase?

The first four letters uniquely identify words in the BIP39 English list. Confirm the exact format and language before abbreviating any backup.

Can the BIP39 checksum recover a missing word?

It can reduce candidate combinations and detect many errors, but it is not complete error correction and does not prove which valid candidate was intended.

What matters more: appearance or readability?

Recoverability matters. Severe cosmetic damage can be acceptable if all data and positions remain unambiguous.

Should I clean a fire-damaged plate?

Document it first and avoid aggressive treatment. Cleaning can remove shallow evidence; specialist assistance may be appropriate.

Does one successful stress test guarantee my plate?

No. It provides evidence for one sample under one protocol. Production variation, setup and real disasters remain uncertain.

What if someone may have seen the recovered plate?

Treat confidentiality as potentially lost. Restore securely and migrate assets to a wallet generated from fresh secret material.

Is an independent test the same as certification?

No. It may offer valuable comparative evidence, but its protocol, samples and limits must still be examined.

Final takeaway

A steel backup test is meaningful only when it measures retained recovery information. Ask what was encoded, how it was marked, what conditions were applied and whether an independent person could decode the damaged sample in the correct order. Material survival, dramatic flames and large force numbers are secondary to that result.

Use published evidence to inform a broader threat model. Practice setup and blind decoding with dummy data, keep real secret material away from cameras and hazardous demonstrations, and evaluate confidentiality separately from physical durability. The best result is not an undamaged-looking plate; it is a recovery system that remains accurate, private and usable when needed.

Technical standards, manufacturer guides and independent tests

These sources explain the formats, setup assumptions and testing methods referenced in this guide:

• BIP39 Specification — Mnemonic Code for Generating Deterministic Keys: word counts, checksum construction, wordlists and four-letter uniqueness.
• Trezor — Set Up Your Trezor Keep Metal: official format selection, pre-marking, permanent punching and verification instructions.
• Trezor — Keeping Your Wallet Backup Safe: official physical storage and confidentiality guidance.
• Jameson Lopp — Metal Bitcoin Seed Storage Stress Test, Round III: documented heat, water-quench, corrosion and deformation testing.
• Jameson Lopp — A Treatise on Bitcoin Seed Backup Device Design: design conclusions drawn from testing many metal backup formats.