Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Your recovery phrase is the credential that controls a self-custody crypto wallet. Anyone who obtains it can usually restore the wallet and move its assets. A wallet password, phone passcode or biometric lock normally protects only an app or device. Phishing attacks target this difference: scammers impersonate support, deliver fake wallet software or induce you to approve a transaction. Hardware wallets add a physical signing barrier but cannot make a disclosed phrase or an approved malicious transaction safe. Protecting assets also requires an inheritance plan that combines secure instructions, legal authority and a recovery process your beneficiary can actually follow.
The four security facts to remember
- Recovery phrase: a wallet-generated sequence of words from which accounts and private keys are derived. Possession generally gives complete control.
- Password or passcode: a local access control for an application or device. It is usually not the wallet’s ownership credential.
- Private signing device: a hardware wallet can keep keys away from an everyday computer and require a physical confirmation, but you must still verify every transaction.
- Inheritance plan: heirs need both legal authority and enough technical information to locate, restore and use the assets without exposing the secret prematurely.
MetaMask describes its Secret Recovery Phrase as the foundation of a wallet and states, “MetaMask cannot recover your wallet for you.” Coinbase likewise explains that its wallet recovery phrase gives the user sole access. Ledger’s warning is categorical: “Never share the 24 words of your recovery phrase with anyone under any circumstances.”
As an Amazon Associate I earn from qualifying purchases.
Recovery phrase, private key, password and passcode: what each one does
| Credential or control | What it protects | What happens if it is lost or exposed |
|---|---|---|
| Recovery or seed phrase | Derives the wallet’s accounts and private keys; establishes control in a self-custody wallet | Loss can make recovery impossible. Exposure should be treated as total compromise because another person can restore the wallet. |
| Wallet password | Unlocks locally encrypted wallet data in an application; MetaMask uses this pattern for phrase-created wallets | Forgetting it can normally be remedied by restoring with the recovery phrase. It does not replace the phrase. |
| Phone, computer or app passcode | Controls access to the device or app, often with a biometric option | Someone who bypasses it may reach the app, but the passcode itself is not generally sufficient to restore a phrase-based wallet elsewhere. |
| Hardware-wallet PIN | Unlocks the physical signing device | It can block use of that device, but a backed-up recovery phrase can restore the wallet on another compatible device. An exposed phrase remains dangerous even if the PIN is secret. |
| Smart-wallet identity and password | Some smart-wallet designs combine a cloud identity, password and account-recovery controls | Recovery requirements depend on that provider’s design; document every factor rather than assuming a seed phrase is the only credential. |
A metal backup improves resistance to fire, water and physical wear, but it does not change the authority of the words. If someone has copied the phrase, moving it to a stronger container does not make the old wallet safe.
Free tools Windows power users keep installed
One-click scans. No signup required.
How phishing steals crypto
Phishing is social engineering: the attacker persuades you to reveal a secret or authorize an action. Trezor calls it “the most common scam you will encounter in the cryptocurrency space.” Treat an unsolicited message as hostile until you verify it through a channel you opened yourself.
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
Common delivery methods
- Fake support agents on social media, messaging apps, phone calls or email.
- Search advertisements and look-alike websites that imitate a wallet’s download or recovery page.
- Fake mobile or desktop applications, browser extensions and QR codes.
- Malicious decentralized applications that request an unlimited token approval or a transfer.
- “Airdrops,” giveaways or account-security forms that ask for the recovery words.
- AI-generated voice, video or chat that appears to come from a company employee.
Signals that a contact is fraudulent
- The person asks for any recovery word, private key, password, PIN or one-time code.
- You are pressured to act immediately, keep the conversation secret or move funds to a “safe” address.
- A link, QR code or attachment is supplied instead of telling you to open the official app or type its address yourself.
- The page asks you to paste a phrase into a browser, form, cloud note or chat.
- A transaction request is vague, unusually broad or inconsistent with what you intended.
Legitimate support does not need your recovery words. Stop communicating, close the page and reach the service through an address or application you already know is authentic. Do not search for a support number while you are under pressure.
What to do after entering or sending your recovery phrase
Assume the wallet is compromised even if no funds have moved yet. The controlling risk is possession: an attacker can restore the wallet later, at a time you may not notice.
- Disconnect the suspected site. Close the tab, remove the fake application or extension and stop replying to the person who requested the phrase. Do not enter the words again to “verify” them.
- Use a trusted, clean device. Prefer a device and network you did not use for the suspected phishing interaction. Install or open the wallet only from its independently verified official source.
- Create a new wallet with a new phrase. Do not reuse any word sequence that was exposed. Write the new phrase offline and verify its spelling and order.
- Move remaining assets. Transfer coins and tokens to the new wallet, checking the destination address on the signing device or another trusted display. Account for network fees and assets on every chain.
- Review approvals and permissions. Where the chain and wallet provide an approval-management tool, revoke suspicious token allowances. A revocation is a transaction and also needs careful signing.
- Protect the new backup. Store it offline in a location that is physically secure and separate from ordinary devices. Never send it to a “recovery specialist” who contacts you afterward.
- Document the incident. Record the affected addresses, dates, transaction IDs and the site or application involved. Contact the relevant exchange or chain-specific support only through an independently verified channel if funds reached a custodial service.
Exact transfer and approval-revocation screens differ by wallet and blockchain. If the attacker has already drained funds, preserve transaction records and report the theft to the exchange, wallet developer and appropriate law-enforcement or cybercrime service; do not pay a stranger who promises guaranteed recovery.
Recommended Free Tools
Rank #2
- Seedless by design, nothing to steal: Your private key is generated inside the EAL6+ chip and never leaves it. No seed phrase is shown or typed at setup, so a tampered device, keylogger, or phishing site has nothing to capture. 9+ years, millions of card.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 16,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Backup without a seed phrase: Your wallet is copied to 2 backup cards with end-to-end encryption, so there are no words on paper to lose or leak. Keep them in separate places; if one card is lost, the others restore full access. Optional seed phrase for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
How to store a recovery phrase safely
Write it offline and verify it
Record the words in the exact order shown by the wallet, including any required capitalization or numbering convention. Check the backup by using the wallet’s built-in verification flow or, for a new wallet, restoring on a separate trusted device before depositing significant value. Do not photograph the phrase or place it in email, cloud storage, a password manager that syncs online, a spreadsheet or a printer queue.
Limit who can reach it
Anyone who can read the backup can potentially spend the assets. Keep it in a locked, water-resistant location and consider a durable metal format for fire and flood resistance. Tell no support agent, friend, contractor or online “helper” the words. If you must involve another person for estate planning, use a legally documented access arrangement rather than casually disclosing the secret.
Separate backup from daily access
A phone or computer used for browsing, gaming, email and downloads has a larger malware surface than an offline backup. Keep the phrase away from those devices and avoid typing it into a connected computer. Ledger advises entering the 24 words only directly into the hardware device during an official recovery process.
Rank #3
- Unparalleled Security: Protect your assets with EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Multi-share Backup eliminates single points of failure for secure cold wallet recovery
Are hardware wallets safer than phone wallets?
| Security consideration | Hardware wallet | Phone or desktop wallet |
|---|---|---|
| Key exposure | Keys are designed to remain on a dedicated device rather than the everyday computer; signing requires physical possession. | Keys or encrypted wallet data reside on a general-purpose device exposed to more apps, malware and remote attacks. |
| Transaction confirmation | You can inspect and physically confirm the transaction on the device, depending on the model and asset. | Approval usually occurs on the same screen as the potentially malicious application or browser. |
| Phishing resistance | Better protection against remote key extraction, but a user can still type the phrase into a fake site or approve a harmful request. | More opportunities for a fake app, extension or website to capture secrets or manipulate what is displayed. |
| Recovery | Loss or damage requires the recovery phrase and a compatible replacement; the device PIN is not the backup. | Restoration also depends on the recovery phrase or the wallet’s documented account-recovery method. |
| Usability | Extra setup, cable or wireless pairing and a physical confirmation step; suitable for larger balances or infrequent signing. | Quick access and convenient mobile signing, but convenience increases the importance of device hygiene and screen review. |
MetaMask characterizes a hardware wallet as a firewall between attackers and wallet contents. That barrier reduces the chance that malware extracts signing keys; it does not judge whether a transaction is honest. Before confirming, read the recipient, network, amount, fee and contract operation on the trusted display. Reject anything you did not initiate, including “test” transfers and unlimited approvals.
Designing an inheritance plan that works
Cryptoassets are estate property in many jurisdictions. HM Revenue & Customs (HMRC) states that cryptoassets are treated as assets of a person’s estate in much the same way as bank accounts, property, shares and investments. Tax, probate and fiduciary rules differ by jurisdiction, so obtain advice from a qualified estate professional where the value or complexity warrants it.
Build an inventory without publishing secrets
- List each wallet, exchange account, chain, address type and device used.
- Record where the recovery phrase, hardware device and any PIN instructions are stored, but do not put the phrase itself in an openly readable will.
- Note assets that require a specific network, token standard, staking withdrawal process or software wallet.
- Include contact routes for exchanges and the location of transaction history, tax records and purchase documentation.
HMRC’s search checklist includes exchanges, bank statements, devices, applications, papers and secure storage. An executor should know which places to check without receiving an unprotected list of secrets.
Rank #4
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
Give the executor legal authority
Use a will, trust or other document recognized where you live to identify the fiduciary and authorize access to digital assets. A technical instruction without legal authority can create disputes, while a legally valid appointment is useless if the executor cannot locate the wallet or understand its recovery process. Store the legal document separately from the secret backup, with clear instructions on how the two are connected.
Choose a recovery architecture
| Architecture | How it works | Strengths | Risks and requirements |
|---|---|---|---|
| Single phrase in secure custody | One backup restores the wallet; the executor receives authorized access to its location after death. | Simple and inexpensive; easiest to rehearse. | A single lost, destroyed or exposed backup can block recovery or enable theft. Physical custody and access controls matter. |
| Multisignature wallet | Two or more keys are required to authorize a transaction. Keys can be distributed among the owner, executor and a trusted institution or person. | No single lost key necessarily destroys access; reduces dependence on one custodian. | Every signer, device, derivation path and signing procedure must be documented. A signer who is unavailable can still delay access. |
| Timelock or staged policy | A policy delays or conditions spending, creating time for an heir or alternate signer to act. | Can provide a controlled inheritance path and a window to detect an unauthorized action. | Smart-contract rules may be irreversible or chain-specific. The policy must be tested and its expiration, fees and emergency path understood. |
| Provider-assisted smart-wallet recovery | Recovery depends on a documented identity, password and designated guardians or service controls rather than a traditional phrase alone. | May be more familiar to a nontechnical heir. | Provider availability, authentication changes and legal authority become critical. Record the exact recovery dependencies and keep them current. |
BIP-388 describes policies using timelocks and multisignature arrangements, but a sophisticated design is not automatically safer. Complexity creates new failure modes: an heir may not know which device to use, a signer may lose a key, or a chain upgrade may change the workflow.
Rehearse with a low-value wallet
- Give the intended executor a non-secret walkthrough describing the devices, software, network and order of operations.
- Restore a test wallet or move a small amount using the same number of signers and the same policy.
- Confirm that the beneficiary can identify the correct chain, pay network fees and verify an address without copying from an untrusted message.
- Update the inventory after every wallet, device, signer or policy change, and set a calendar reminder to review it.
A dead-man’s switch can send instructions after a period of inactivity, but it introduces operational and custody risks: false triggers, a compromised account, an unavailable service or a recipient who receives sensitive information too early. Treat it as one component of a tested plan, not as a substitute for legal documents and secure key custody.
Quick Recap
Routine security checklist
- Keep the recovery phrase offline, private and legible; maintain a durable backup where appropriate.
- Use a unique device or app passcode and enable biometrics only when you understand the device’s recovery behavior.
- Install wallet software from an independently verified official source; avoid search-ad links and unsolicited QR codes.
- Assume every unexpected support message is a scam until verified outside the message.
- Review recipient addresses, network, amount, fee and contract permissions before signing.
- Use a hardware wallet for balances whose loss would be unacceptable, while remembering that it does not prevent social engineering.
- Maintain an estate inventory, legally authorized instructions and a tested recovery exercise.
- After any phrase disclosure, abandon the wallet, create a new one and move assets from a clean device.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
