Free tools Windows power users keep installed
One-click scans. No signup required.
A hardware-wallet passphrase creates a separate wallet from the same recovery words. Someone who steals only your recovery words can usually open the ordinary wallet, but not the passphrase-derived wallet; someone who loses or mistypes the passphrase can never open it. Set it up on the hardware device, write both secrets down offline, verify a new receive address on the device, move funds to that address, and rehearse recovery before storing significant value.
What a hardware-wallet passphrase actually is
Your recovery words are the primary backup for a deterministic wallet. A passphrase is an additional secret input to the derivation process. The same recovery words combined with different passphrases produce different wallets and different addresses.
As an Amazon Associate I earn from qualifying purchases.
People often call it the “25th word,” but that nickname is misleading. A standard recovery phrase may contain 12, 18, or 24 words, and the passphrase is not an extra word selected from the wallet’s word list. It is a separate, case-sensitive string that can contain spaces, punctuation, and characters outside the recovery-word list, depending on the device’s implementation.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →On Ledger devices, the passphrase feature opens a separate set of unconnected accounts. Trezor uses the passphrase as part of BIP39 or SLIP39 derivation. In either case, enabling the feature does not convert an existing account into a protected one and does not move any coins automatically.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
- The original recovery words still derive the ordinary wallet.
- The same words plus the exact passphrase derive a different wallet.
- A one-character change, different capitalization, extra space, or missing punctuation derives another wallet, normally with empty addresses.
- The wallet application cannot recover a forgotten passphrase for you; the device manufacturer does not have a copy.
What protection a passphrase provides—and what it does not
Protection against a copied recovery backup
If an attacker photographs or copies your recovery words but does not know the passphrase, the attacker can derive the standard wallet but not the passphrase-derived wallet. This is the principal reason to use the feature. It can also provide plausible deniability: the ordinary wallet can contain a small balance while the larger balance is in a separate passphrase wallet. Do not treat that arrangement as protection against coercion or legal disclosure; it only changes which wallet is derived from which secrets.
Threats a passphrase does not solve
- Approving a malicious transaction: The device will sign what you confirm. A passphrase does not identify a fraudulent recipient or make a smart contract safe.
- Phishing: A fake support agent, wallet application, or recovery page can capture both your words and passphrase if you type them into a computer or phone.
- Host malware: Malware can alter an address shown on the computer. Always compare the destination or receive address on the device screen.
- Physical coercion: A passphrase does not make you invulnerable to threats against you or anyone who can force disclosure.
- Human error: Forgetting the exact string, storing it where it can be destroyed, or failing to document the derivation path can make the wallet unrecoverable.
Ledger’s security guidance says hardware wallets do not eliminate social engineering, physical threats, or human error. The passphrase is one control in a broader custody plan, not a substitute for careful transaction review and secure backups.
Prepare before enabling the feature
- Use a genuine, initialized hardware wallet and the manufacturer’s current manual. Update firmware only through the vendor’s documented process.
- Perform setup in a private room. Trezor warns that cameras and microphones can capture a backup ceremony; keep phones, webcams, smart speakers, and other recording devices away.
- Have a permanent offline backup medium ready. Paper is vulnerable to fire and flood; an engraved or punched stainless-steel or titanium backup is more durable.
- Decide where the recovery words and passphrase will be stored. If your threat model includes a single burglary, storing both in the same container defeats much of the benefit.
- Create an inheritance or recovery plan. A trusted successor must be able to locate both secrets and understand which device and wallet software can restore them.
- Set aside a spare compatible device, or enough time to use the vendor’s documented recovery flow, for a recovery rehearsal.
Step-by-step: set up a passphrase wallet safely
- Initialize or verify the hardware wallet. Follow the current manufacturer manual. Generate the recovery backup on the device itself. Never accept words supplied by a website, an email, or another person.
- Write the recovery words privately. Record every word in order, exactly as displayed. Check spelling and sequence twice. Do not photograph, scan, copy, paste, or type the words into a computer or phone. Ledger’s guidance is explicit: never enter a recovery phrase on a computer or smartphone.
- Verify the backup on the device. Use the wallet’s built-in backup check if available. A backup is useful only if every word and its order are correct.
- Enable passphrase mode. Open the security or passphrase option on the hardware wallet, not on an untrusted website. Prefer on-device entry. Trezor documents an “always on device” setting that prevents the passphrase from being sent from the host computer.
- Create a reproducible passphrase. Make it long, unique, and case-sensitive. Avoid quotations, song lyrics, public biographical facts, or a phrase reused anywhere else. Ledger documents a 100-character maximum for its implementation. Other devices may impose different limits, so check the exact manual for your model.
- Record the passphrase offline. Write the exact capitalization, spaces, punctuation, and any non-ASCII characters. Do not store it in a password manager, cloud note, email draft, photograph, or browser field unless you have deliberately accepted the additional digital risk. Keep it separate from the recovery words if simultaneous theft is part of your threat model.
- Open the newly derived account. Let the device derive the passphrase wallet. Use the wallet application only as an interface; confirm the receive address on the hardware screen. Compare the full address, not merely the first and last few characters.
- Send a test amount. Transfer a small amount to the device-confirmed address. Disconnect and reconnect the wallet, re-enter the passphrase exactly, and verify that the same account and balance appear.
- Move the intended funds. After the test succeeds, transfer the remaining amount. Standard accounts remain unchanged; enabling a passphrase does not sweep or relocate them.
- Rehearse recovery. On a spare compatible device, or through the manufacturer’s documented recovery procedure, restore using the recovery words and exact passphrase. Confirm that the same addresses are reproduced before committing a large balance.
How to choose and document the passphrase
Use uniqueness and exact reproducibility
The security benefit comes from secrecy and entropy, not from making the text difficult for you to remember. A long sequence of unrelated words that you create privately is generally easier to reproduce than a short clever phrase. Never reuse it for email, exchange accounts, encryption, or another wallet.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchCase, spaces, punctuation, and spelling are significant. “North Harbor 7” and “north harbor 7” are different wallets. So are a trailing space and no trailing space. If your device normalizes characters or rejects certain symbols, record the form that the device actually accepts.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Separate the two backups deliberately
One location holding both recovery words and passphrase is a single point of compromise. Separate locations reduce the chance that one burglary exposes the protected wallet, but separation increases the chance that one part is lost. Choose locations that are secure, reachable when needed, and included in your estate plan.
Label the passphrase backup clearly enough that an authorized heir can identify it, but do not write the complete secret on an exterior label. Keep an inventory of which device family, account type, and derivation instructions are required without recording the secret in a digital system.
Use durable metal for the recovery words
Trezor notes that paper backups can be destroyed by fire or flood and recommends engraving or punching BIP39 words into stainless steel or titanium. When selecting a metal seed backup, check its word capacity, character system, resistance to heat and corrosion, tamper visibility, and support for your exact recovery-word length. A metal plate protects against environmental damage; it does not hide the words from someone who finds it.
What happens if someone steals your recovery words?
| What the thief has | What the thief can normally derive | What remains protected |
|---|---|---|
| Recovery words only | The ordinary, non-passphrase accounts | Accounts derived with your unknown passphrase |
| Recovery words and exact passphrase | Both the ordinary and passphrase-derived accounts | Nothing that depends solely on those two secrets |
| Passphrase only | Usually no useful wallet without the matching recovery words | The wallet derived from the missing recovery backup |
| A device with an unlocked session | Potentially the accounts available through that session, depending on its lock and PIN state | Accounts not loaded or requiring another passphrase |
A passphrase limits seed-only theft; it does not make the recovery words disposable. If the words are exposed, move funds from the ordinary accounts and consider the entire seed compromised. If you suspect the passphrase itself was exposed, move funds from the passphrase accounts to a newly generated wallet with a new recovery backup and, if desired, a new passphrase.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Passphrase entry and recovery differences by wallet implementation
Implementations vary. Confirm the exact behavior in the current manual for your model and firmware rather than assuming that another device’s workflow applies.
| Capability | Ledger documentation | Trezor documentation |
|---|---|---|
| What the passphrase does | Opens a separate set of unconnected accounts; standard accounts remain unchanged. | Participates in BIP39 or SLIP39 derivation, producing a separate wallet. |
| Entry and host exposure | Use the device’s passphrase feature and follow the model-specific prompts; exact entry choices vary by model. | An “always on device” setting keeps the passphrase from being sent from the host. |
| Character handling | Case-sensitive; Ledger documents a 100-character maximum for its implementation. | Case, spaces, and punctuation must be reproduced exactly; a universal character limit is not stated here. |
| Lost-passphrase result | Ledger does not store or back up it; a forgotten passphrase permanently blocks the corresponding accounts. | Trezor warns that a forgotten or lost passphrase prevents access to the passphrase-protected funds. |
| Automatic movement of funds | None. Setup creates new accounts; it does not move balances from standard accounts. | None. You must verify the new account and transfer funds yourself. |
Recovery and failure troubleshooting
The wallet opens but shows zero balance
First check capitalization, spaces, punctuation, and spelling. Then confirm that you are using the same device model, account type, network, and derivation path used when the funds were deposited. A nearly correct passphrase is not close enough: it is a different wallet. Do not create random variations while connected to a host that could record them; use a controlled recovery procedure and document each deliberate attempt.
The ordinary wallet appears instead of the hidden wallet
You likely opened the wallet without entering the passphrase, or the device’s passphrase mode was not activated. Close the wallet session, reconnect the hardware device, enable passphrase mode, and verify the account identity and receive address on the device screen before sending anything.
The host application rejects the passphrase
Check whether the model expects entry on the device, whether an “always on device” option is enabled, and whether the application and firmware versions are compatible. Never work around an error by entering recovery words into the application. If the behavior is not covered by the manufacturer’s manual, stop and contact official support through a verified channel.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
The recovery words were photographed or typed online
Assume the recovery backup is compromised. Generate a new wallet on a clean, verified device, record its new backup offline, and move funds to addresses from that new wallet. Do not wait for proof that someone accessed the image or text; exposure is the risk event.
The passphrase is forgotten
There is no reset mechanism. Search only your deliberate offline records and check exact formatting. Do not rely on a vendor to reconstruct it. If the original device still opens the wallet and the funds are accessible, move them to a newly created wallet immediately and create a recovery plan you can reproduce.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Passphrase, SLIP39, and multisig solve different problems
| Control | Primary purpose | How many secrets or keys are involved | Typical strength | Main failure mode |
|---|---|---|---|---|
| Passphrase | Reduce the impact of stolen or copied recovery words | One recovery backup plus one additional secret | Seed-only theft does not reveal the passphrase wallet | Forgotten, mistyped, or unavailable passphrase causes permanent loss of access |
| SLIP39 | Distribute one wallet backup across locations or custodians | Multiple recovery shares with a threshold, such as two-of-three or three-of-five | Loss of one or more shares can be survivable within the threshold | Lost shares beyond the threshold, or software that does not support SLIP39 |
| Multisig | Require multiple independent keys to authorize a transaction | Multiple devices or keys, with a signing threshold | No single key can spend alone when configured correctly | Lost signers, coordination errors, or incomplete recovery documentation |
SLIP39 is not multisig. SLIP39 splits one wallet key into recovery shares; multisig uses multiple keys that each participate in signing. A passphrase and SLIP39 can be combined, but Trezor describes that as advanced and warns that the added complexity increases recovery risk.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Choose based on the threat you are addressing
- Choose a passphrase when your main concern is that someone may copy the recovery words and you can maintain a reliable second-secret backup.
- Consider SLIP39 when your main concern is distributing backup material among locations or trusted people, with a defined threshold for recovery.
- Consider multisig when custody is shared, organizational approval is required, or you want multiple independent signing devices.
- Do not combine controls merely because more features sound safer. Every additional dependency must be documented, tested, and recoverable by the people who may need it.
Operational checklist before storing substantial funds
- Recovery words were generated by the hardware device and verified in its backup check.
- No recovery word or passphrase has been entered on a computer, phone, website, camera, or cloud service.
- The passphrase is unique, case-sensitive, and recorded exactly offline.
- The recovery words and passphrase are protected against the same theft or disaster.
- The receive address was compared on the hardware screen and in the wallet application.
- A small test transaction arrived before the larger transfer.
- A recovery rehearsal reproduced the same address with the same words and passphrase.
- Your heirs or recovery partners know where the physical records and compatible device instructions are kept.
- You understand which funds remain in standard accounts and which funds are in passphrase-derived accounts.
Frequently asked questions
Can I add or change the passphrase later?
You can use a different passphrase at any time, but it does not rename or transform an existing wallet. It derives another wallet. Transfer funds deliberately and verify the destination on the device; never assume that changing one character preserves an address.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Does a passphrase encrypt the recovery words?
No. It adds another derivation secret. Anyone holding the recovery words can still derive the ordinary accounts, so protect the original backup even after moving funds to a passphrase wallet.
Can I keep the passphrase with the recovery words?
You can, but anyone who obtains that single package can derive the protected wallet. Separate storage is preferable when seed theft is the threat. If separation makes recovery unrealistic, choose a documented arrangement that balances security with the risk of losing one part.
Is a hidden wallet the same as a second hardware device?
No. A hidden wallet uses the same device and recovery words with an additional passphrase. A second device can provide operational redundancy or an independent key, but it does not automatically create a separate wallet or a multisig policy.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →What if my wallet application displays a different address after recovery?
Stop sending funds. Recheck the exact passphrase and formatting, then confirm the account type and derivation path. If the address still differs, use the manufacturer’s documented recovery procedure and verified support channel rather than guessing.
Frequently Asked Questions
Can a manufacturer reset a lost passphrase?
No. The passphrase is not stored or backed up by the manufacturer. Without the exact passphrase, the corresponding wallet is normally inaccessible.
Should I use a passphrase for every account?
Use one only when you can document and rehearse the extra recovery step. A passphrase adds protection against seed-only theft but also adds a permanent loss mode.
Is SLIP39 a replacement for a passphrase?
No. SLIP39 distributes recovery shares for redundancy; a passphrase adds a second derivation secret. They address different threats.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
