Passphrase (25th Word)

A BIP39 passphrase, often called the 25th word, is an optional secret you supply alongside your written seed phrase. Unlike the seed words, which are drawn from a fixed list of 2,048, the passphrase can be any text you choose — letters, numbers, symbols, spaces, any length. It is not appended as another mnemonic word; it is a separate input to the seed-derivation function. Combine the same 12 or 24 words with different passphrases and you get completely different wallets, each with its own keys, addresses, and balances, with no on-chain or cryptographic hint that they share a mnemonic.

How it works under the hood

BIP39 turns a mnemonic into a binary seed by running it through the PBKDF2 key-stretching function with HMAC-SHA512, using the string "mnemonic" plus your passphrase as the salt. An empty passphrase is simply an empty salt — which is why every BIP39 wallet technically has a passphrase; most people just use the default blank one. Change one character of the passphrase and the derived seed changes completely, which cascades through the entire hierarchy of keys and addresses. There is no "wrong passphrase" error anywhere in this process: any passphrase deterministically produces a valid wallet, just not the one holding your coins.

A second factor and plausible deniability

Because the passphrase is never written down with the seed phrase, an attacker who finds your backup cannot spend without also knowing it. This turns the seed into something closer to two-factor custody: the words are something you have, the passphrase something you know. It also enables plausible deniability — the words alone unlock a decoy wallet you can fund with a modest amount, while your real savings sit behind the passphrase in a hidden wallet. Under coercion, you can surrender the decoy convincingly, because nothing about the seed reveals that a passphrase-protected wallet exists.

The unforgiving side

That power cuts both ways, and this is where people lose money:

• No recovery exists. Forget the passphrase and the hidden wallet is gone permanently, even with the full seed in hand. There is no reset, no support desk, no brute-forcing a strong passphrase.
• Silent failure. A typo, an unexpected space, or a capitalization difference derives a different — empty — wallet. Users see a zero balance and panic, when in fact their coins are safe behind the exact string they originally used.
• Backup asymmetry. Heirs who inherit the words but not the passphrase inherit nothing. Estate planning must cover both secrets, stored separately.

Treat the passphrase as a high-value secret in its own right: back it up in a different location from the words, keep it memorable or durably recorded, and always test recovery — restore the wallet from words plus passphrase on a clean device and verify addresses match — before sending meaningful funds.

Choosing a passphrase that survives you

The passphrase inherits none of the seed's built-in error correction — no checksum, no fixed wordlist — so the burden of getting it right is entirely yours. Favor length over cleverness: a sequence of several unrelated words is both stronger and more reliably remembered and transcribed than a short string of symbol-substituted characters. Avoid anything discoverable — names, dates, quotes on your bookshelf — since an attacker holding your seed words can afford an extensive guessing campaign against weak passphrases. Decide deliberately how it will be stored: memorization alone is a single point of failure the day something happens to you, so most careful setups record it on durable media kept geographically separate from the seed words, with clear instructions for heirs. And fund the decoy wallet believably; an obviously empty base wallet defeats the deniability the feature exists to provide.

A passphrase pairs naturally with cold storage and a hardware wallet that supports on-device entry, so the secret never touches a computer keyboard. For higher-stakes setups, compare it against multisig, which removes the single point of failure entirely — the two approaches solve overlapping problems in different ways, and serious self-custody often uses both.