A crypto seed phrase is the single string of words standing between you and every coin you own. Lose it, and your funds are gone forever. Expose it, and someone else’s funds are gone forever too, just with your name attached to the loss. In 2026, security researchers keep tracing wallet drains back to the same root cause: people photographed their recovery phrase, backed it up to Google Photos or iCloud, or typed it into a notes app that synced to the cloud. None of that is a cryptography failure. It’s a storage failure, and it’s fixable in an afternoon.

This tutorial walks through the full process: auditing where your seed phrase currently lives, generating a clean replacement offline, verifying it against the official BIP39 word list with a script you run air-gapped, stamping it into metal, adding a passphrase, and setting up a recovery test you can actually trust. By the end you’ll have a working offline verification toolkit and a documented, repeatable process instead of a hopeful guess.

None of the steps below require you to trust a third-party website with your seed phrase, and none of them require special hardware beyond a hardware wallet you likely already own and a metal backup kit you can buy from any of several established vendors. The verification scripts run entirely offline on your own machine, so you can read every line before you ever type a real seed phrase into them.

Why seed phrase security keeps making headlines in 2026

A July 29, 2026 security checklist published after the SparkKitty malware incidents made a blunt point: any seed phrase that was ever photographed should be treated as already compromised. Malware on Android and iOS has been shown to scan photo libraries for image patterns that look like a 12- or 24-word list, then exfiltrate the match. Once that happens, rotating your wallet isn’t optional caution, it’s damage control.

The pattern behind most 2025-2026 seed phrase losses isn’t sophisticated cryptanalysis. According to an August 2, 2026 explainer from news.bitcoin.com, a standard 12-word BIP39 phrase carries roughly 128 bits of entropy, which is computationally infeasible to brute-force with any hardware that exists today or is likely to exist for decades. A 24-word phrase carries around 256 bits, an even larger margin. Attackers don’t beat the math. They wait for you to hand them the answer through a synced photo library, a Telegram “saved messages” folder, or an unencrypted notes app.

That’s the gap this tutorial closes. Not by making the cryptography stronger (it’s already strong enough) but by making your storage and handling process boring, offline, and repeatable. For the full technical spec these wallets follow, see the official BIP-39 standard maintained in the Bitcoin protocol repository, and Bitcoin.org’s own wallet security guidance.

How BIP39 entropy actually works

It helps to know what those 12 or 24 words are actually doing before you start writing them down, mostly because it explains why the process below is so strict about offline handling. A BIP39 seed phrase starts as raw random data (128 bits for a 12-word phrase, 256 bits for 24 words), generated by a hardware random number source. That raw entropy gets split into 11-bit chunks, each chunk maps to one word in a fixed 2,048-word list, and the final word also encodes a checksum of everything before it.

Two things fall out of that design. First, the words themselves carry no meaning, “abandon abandon ability” isn’t hinting at anything, it’s just a human-readable encoding of a number. Second, because the last word is a checksum, a script can catch most transcription errors instantly, which is exactly what Step 4 below does. The wordlist itself is public (that’s by design, security comes from the entropy, not from hiding the list), and every word is unique within its first four letters, which is why metal backup kits often stamp only four characters per word to save space.

For comparison, NIST’s own digital identity guidelines discuss entropy and memorized secret requirements in SP 800-63B, and while that document targets passwords rather than crypto wallets, the underlying entropy math is the same discipline. 128 bits, the floor for a 12-word phrase, sits so far past any realistic brute-force budget that the actual attack surface has shifted entirely to storage and handling, which is the whole reason this tutorial spends more time on workspace setup and metal stamping than on the math itself.

Prerequisites: what you need before you start

Gather everything below before you touch your wallet. Stopping halfway through to go find a pen defeats the point of a no-camera, no-interruption workspace.

  • A hardware wallet or wallet software capable of generating a new BIP39-compliant seed offline (most current hardware wallets support 12 or 24-word phrases; check your device’s firmware supports the BIP39 standard, which nearly every model shipping in 2026 does)
  • Two ballpoint pens, since one running dry mid-word is a bigger problem than it sounds
  • A metal seed backup plate or capsule kit (steel or titanium, stamped or engraved letter/number system)
  • A laptop or Raspberry Pi you can fully disconnect from Wi-Fi and Bluetooth, ideally one that has never touched your seed phrase before
  • Python 3.9 or newer installed on that offline machine (verify with python3 --version before you disconnect it)
  • The mnemonic Python package (version 0.21 or newer) and, optionally, shamir-mnemonic (version 0.3 or newer) installed before you go offline, since you can’t pip install anything once the network is off
  • 90 minutes of uninterrupted time, phones (including your own) placed in another room
  • A fireproof, waterproof storage location, or two separate locations if you’re splitting backups geographically

Install the verification libraries now, while you’re still online:

pip install mnemonic==0.21 shamir-mnemonic==0.3.0
python3 -c "import mnemonic, shamir_mnemonic; print('libraries ready')"

Once that prints libraries ready, disable Wi-Fi and Bluetooth on the machine you’ll use for verification. Everything from here forward should happen without a network connection. Both libraries are maintained by Trezor’s engineering team and published on PyPI: mnemonic and shamir-mnemonic, so you can read the source before trusting it with anything sensitive.

Common myths about seed phrase security, debunked

A few beliefs keep circulating in crypto communities that sound reasonable but don’t hold up once you look at how attacks actually happen.

“A locked notes app or a password-protected photo folder is fine.” It isn’t, because the lock protects against someone picking up your unlocked phone, not against malware running with your app permissions or a cloud sync job that copies the file before you’ve locked anything. The protection needs to happen at the storage medium, not at the app layer.

“24 words are always safer than 12.” Both are secure against brute-force; 128 bits of entropy already exceeds any realistic attack budget. The extra 128 bits in a 24-word phrase mostly matters if you’re modeling adversaries with resources far beyond current or near-future computing, not the phishing and malware attacks that actually drain wallets.

“Sending my seed phrase to wallet support to fix a sync issue is fine, they’re the vendor.” No legitimate wallet company, hardware or software, will ever ask for your seed phrase over chat, email, or a support ticket. This is one of the most common social engineering scripts in the space, and support-impersonation scams specifically target people who’ve just posted a technical problem in a public forum.

“A QR code of my seed phrase is more secure than plain text because it’s encoded.” A QR code is just a different encoding of the same words, readable instantly by any phone camera or scanner app. It offers zero additional protection and, if anything, makes casual photography of the seed even easier.

Step 1: Audit where your current seed phrase actually lives

Before generating anything new, find out how exposed your existing seed phrase already is. Check, specifically:

  • Your phone’s photo gallery and any app with camera roll access (search for screenshots taken around the date you set up the wallet)
  • Cloud photo sync: Google Photos, iCloud Photos, Samsung Cloud
  • Notes apps: Apple Notes, Google Keep, Evernote, Samsung Notes
  • Chat apps: Telegram “Saved Messages,” WhatsApp self-chats, Signal notes-to-self
  • Email drafts or sent folders
  • Password managers, if you typed the phrase into a text field rather than storing it as intended for hardware recovery

If you find your seed phrase in any of these places, don’t just delete the file and move on. Deleted photos often persist in “Recently Deleted” folders for 30-40 days, and cloud sync means a copy may already exist on a server you don’t control. Treat any exposed seed phrase as burned. You’re rotating to a new wallet regardless of how the rest of this audit goes.

Step 2: Set up a no-camera, offline workspace

Move to a room with no smart speakers, no laptop webcam facing you, and no phone within reach, including yours. Close curtains if you’re near a street-facing window with visible reflective glass. This sounds excessive until you remember that the entire point of a seed phrase is that whoever sees or hears it can take everything it protects. A five-minute setup here removes an entire category of risk for free.

Lay out your pens, your metal backup kit, and the offline laptop. Do not connect the laptop to any network from this point until Step 10.

Step 3: Generate a new seed phrase entirely offline

Use your hardware wallet’s built-in generator, not a website, not a random word picker you found online, and not a script you wrote yourself unless you’re a cryptography engineer who fully understands entropy sourcing. Hardware wallets use a certified random number generator specifically because software-only generation on a general-purpose computer can leak entropy through side channels or, worse, run on a compromised machine.

On the device screen, choose to generate a new wallet with a 24-word phrase if your device supports it. The extra 12 words cost you a few more minutes of writing and buy you double the entropy margin, which matters more for long-term, high-value holdings than for a wallet you’ll spend from weekly.

Step 4: Verify each word against the official BIP39 list, offline

This is the step most tutorials skip, and it’s the one that prevents the single most common recovery failure: a misheard, mis-transcribed, or misspelled word that makes the wallet unrecoverable months or years later, right when you actually need it. Every BIP39-compliant wallet draws from a fixed 2,048-word list, and the last word encodes a checksum of the rest. That means a script can catch typos immediately, before you’ve stamped anything into metal.

On your disconnected machine, run this verification script. Type your seed phrase in when prompted; nothing is written to disk and nothing leaves the process.

from mnemonic import Mnemonic
import getpass

mnemo = Mnemonic("english")

phrase = getpass.getpass("Enter your seed phrase (input hidden): ").strip()
words = phrase.split()

print(f"\nWord count: {len(words)}")
if len(words) not in (12, 15, 18, 21, 24):
    print("WARNING: not a standard BIP39 length (12/15/18/21/24 words)")

unknown = [w for w in words if w not in mnemo.wordlist]
if unknown:
    print(f"INVALID WORDS (not in BIP39 list): {unknown}")
else:
    print("All words found in the official BIP39 wordlist.")

if mnemo.check(phrase):
    print("Checksum PASSED. This is a valid, recoverable BIP39 seed phrase.")
else:
    print("Checksum FAILED. Do not proceed to a metal backup until this is fixed.")

del phrase, words

Expected output for a correctly generated and transcribed phrase:

Word count: 24
All words found in the official BIP39 wordlist.
Checksum PASSED. This is a valid, recoverable BIP39 seed phrase.

If you see Checksum FAILED, stop. Re-check every word against your device screen character by character before you write anything permanent. A single transposed word (writing “quick” instead of “quiz,” for example) produces a phrase that looks fine to the eye but derives a completely different, empty wallet.

Step 5: Write the phrase on paper first, as a working draft

Write each word clearly, numbered 1 through 24 (or 12), on paper before you touch the metal kit. This draft copy is your working reference for the stamping step and catches handwriting ambiguity (a “7” that looks like a “1,” a lowercase “l” that looks like a “1”) before it’s permanent. Read each word back against the BIP39 list or the verification script output, not from memory.

Step 6: Transfer the phrase to a metal backup

Paper burns, and it dissolves in water, both of which have ended real backups. A steel or titanium plate survives house fires (rated to 1,400°F+ on most commercial kits) and flooding. Stamp or engrave each word’s first four letters (the standard BIP39 abbreviation, since every word in the list is uniquely identifiable by its first four characters) into the plate, one letter or word per row depending on your kit’s format.

After stamping, re-run the Step 4 verification script using only the metal plate as your source, ignoring the paper draft entirely. This confirms the metal backup itself is readable and correct, not just your handwriting.

Step 7: Add a BIP39 passphrase (the “25th word”)

A passphrase is an optional extra word or phrase that combines with your seed to derive the final wallet. It’s not stored on the device and isn’t part of the 12/24-word list, it’s chosen by you and typed in at wallet setup. Here’s why it matters: if someone finds your metal plate, they still can’t access funds without the passphrase, because the plate alone derives a different (and typically empty) wallet.

This script shows how a passphrase changes the derived seed, so you can see conceptually what your hardware wallet does internally when you enable this feature (run it offline, same as before):

from mnemonic import Mnemonic

mnemo = Mnemonic("english")
phrase = "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about"

seed_no_pass = mnemo.to_seed(phrase, passphrase="")
seed_with_pass = mnemo.to_seed(phrase, passphrase="correct-horse-battery-staple")

print("Seed without passphrase:", seed_no_pass.hex()[:32], "...")
print("Seed with passphrase:   ", seed_with_pass.hex()[:32], "...")
print("Different wallets:", seed_no_pass != seed_with_pass)
Seed without passphrase: 5eb00bbddcf069084889a8ab9155568 ...
Seed with passphrase:    56826cf1cc3d0e6de7abcc9f10bb6cc0 ...
Different wallets: True

Two critical rules for passphrases: never write the passphrase on the same plate or paper as your seed words, and never forget it. A forgotten passphrase is unrecoverable by design, that’s the entire security property. Memorize it, or store it separately using a different method entirely (a password manager entry, for instance, kept apart from anything that mentions your seed phrase).

Step 8: Create geographically separated copies

One copy in one location is a single point of failure: fire, flood, theft, or a bad landlord dispute can wipe it out. Common practice among long-term holders is two to three physical copies stored in separate locations, such as a home safe and a bank safe deposit box, or a trusted family member’s secure storage. Each additional copy is also an additional place someone could find it, so more isn’t automatically better past three. Balance redundancy against exposure.

Think through your actual threat model before picking locations. A home safe protects against casual theft and small fires but not a total house loss. A bank safe deposit box protects against most physical disasters but adds a dependency on bank hours and access rules, which matters if you ever need funds urgently. A relative’s storage adds redundancy but depends on that relationship staying stable and that person staying reachable. None of these is strictly better, they fail in different ways, which is exactly why combining two different failure modes (not just two copies of the same failure mode) is the actual goal.

Step 9: Migrate funds from the old, exposed wallet

With the new wallet generated, verified, and backed up, move your holdings over. Send a small test transaction first (an amount you can afford to lose entirely if something is misconfigured), confirm it arrives and that you can see it in the new wallet’s interface, then transfer the remainder. Don’t skip the test transaction step to save five minutes. It’s the cheapest insurance in this entire process.

Step 10: Purge the old exposure

Now that funds are moved, go back to everywhere you found the old phrase in Step 1 and remove it:

  • Delete screenshots and empty the “Recently Deleted” album (Google Photos and iCloud both keep this for roughly 30-40 days by default)
  • Search cloud backups, not just the local device, since sync can restore a deleted local file
  • Delete notes app entries and empty their trash/recovery folders
  • Delete chat messages containing the phrase, on both ends of the conversation if you shared it with anyone
  • Revoke camera roll or photo library permissions from apps that don’t need them, reducing future exposure surface

Step 11: Document locations, without documenting the phrase itself

Write a separate document, stored apart from any seed backup, listing where copies are physically located and how a trusted heir or executor could recover funds, without including the actual words. This is where most inheritance planning fails: either the seed phrase is never documented anywhere and funds die with the owner, or it’s written directly into a will (a public document once probated) and becomes a security hole instead of a safeguard. The location list plus passphrase hint, kept separately from both the plate and each other, threads that needle.

Step 12: Test recovery before you trust it

An untested backup is a guess. On a second, wiped, or spare hardware wallet, run through a full recovery using your metal backup as the only source. This checklist script keeps you honest about which steps you’ve actually completed, rather than which ones you assume you did:

#!/usr/bin/env python3
checklist = [
    "Second/spare hardware wallet is wiped or factory-reset",
    "Recovery performed using ONLY the metal backup (no paper draft)",
    "Passphrase entered from memory, not from a written note",
    "Wallet address after recovery matches the original wallet's known address",
    "Test transaction (from Step 9) is visible in the recovered wallet",
    "Recovery time recorded (should be under 15 minutes for 24 words)",
]

print("Seed Phrase Recovery Dry-Run Checklist\n")
for i, item in enumerate(checklist, 1):
    status = input(f"{i}. {item} — done? (y/n): ").strip().lower()
    print("   PASS" if status == "y" else "   INCOMPLETE — resolve before relying on this backup")
print("\nRe-run this dry-run every 6-12 months, or after any change to storage location.")

If recovery fails at any point, whether the address doesn’t match or a word is unreadable on the plate, you’ve found the flaw in your setup while your funds are still safe on the original wallet. That’s the entire value of testing before you need it for real.

Advanced tip: splitting your seed with Shamir’s Secret Sharing (SLIP39)

For larger holdings, a single seed phrase (even backed up in three locations) still means any one location’s compromise is total. Shamir’s Secret Sharing, standardized for crypto wallets as SLIP-0039, splits your secret into multiple shares where a threshold number (say, 3 of 5) is required to reconstruct it, and any share below that threshold reveals nothing on its own. Some current hardware wallet models support SLIP39 natively; you can also use the reference library to understand the mechanics offline:

from shamir_mnemonic import generate_mnemonics

# Split a secret into 5 shares, requiring any 3 to reconstruct (3-of-5 threshold)
secret = bytes.fromhex("00000000000000000000000000000000")  # replace with real 128-bit secret
groups = generate_mnemonics(
    group_threshold=1,
    groups=[(3, 5)],   # (threshold, total shares)
    master_secret=secret,
)

for i, share in enumerate(groups[0], 1):
    print(f"Share {i}: {share}")

Each share gets its own metal backup and its own location. Losing two of five shares still leaves you with a recoverable wallet. An attacker finding one or two shares gets nothing usable. This adds real operational complexity, so it’s worth the overhead mainly for holdings where the extra setup time is trivial next to what’s protected. The full spec for this scheme is published as SLIP-0039, and the reference implementation lives in the python-shamir-mnemonic repository if you want to audit exactly what the split-and-reconstruct math does before trusting it with a real secret.

Advanced tip: multisig as an alternative to single-seed custody

Shamir splitting protects one seed by distributing its shares. A multisig wallet takes a different approach entirely: instead of one seed controlling funds, you generate two or more completely independent seeds (often on separate hardware wallet devices, ideally different models or vendors to avoid a shared firmware bug taking out every key at once) and require a threshold of them, commonly 2-of-3, to sign any transaction.

The practical difference from SLIP39: with Shamir splitting, reconstructing the threshold number of shares hands an attacker the complete original seed. With multisig, each key stays fully independent and is never combined into a single secret at any point, even during spending. That makes multisig the stronger choice for shared custody between multiple people or entities (a business treasury, for example) where you don’t want any single location, even briefly, to hold a complete secret. The tradeoff is setup complexity and slower transaction signing, since you need multiple devices present to move funds, which is exactly why it’s listed here as an advanced option rather than a default recommendation for personal wallets.

Quick decision matrix: how much of this do you actually need

Not every step in this tutorial applies at every holding size, and treating a small test wallet with the same operational overhead as a long-term treasury just means you’ll skip steps out of fatigue. Match the effort to what’s actually at stake.

Holdings profileRecommended minimumSkip unless needed
Small/test wallet, funds you’d shrug off losingSteps 1-6 (audit, offline generation, BIP39 verification, metal backup)Passphrase, SLIP39 splitting, multisig
Primary savings walletSteps 1-10, plus passphrase (Step 7)SLIP39 splitting, multisig
Long-term holdings, years-long horizonFull tutorial through Step 12, including passphrase and geographically separated copiesMultisig, unless funds are shared with others
Shared/business treasuryMultisig with 2-of-3 or higher threshold, independent devices per keySingle-seed setups, regardless of backup quality

The point isn’t that smaller wallets don’t matter, it’s that operational security has a real time and attention cost, and spreading that cost too thin across every wallet you own tends to mean none of them get the follow-through steps like Step 12’s recovery test. Concentrate the heaviest process on whatever wallet actually holds the funds you’d be upset to lose.

Storage methods compared

MethodFire resistanceWater resistanceSetup complexityBest for
Paper onlyLowLowMinimalTemporary draft copy only, not long-term storage
Metal plate/capsuleHighHighLow-moderatePrimary long-term backup for most holders
Metal + passphraseHighHighModerateAdding a second factor without extra hardware
Multisig walletN/A (distributed)N/A (distributed)HighShared control across multiple keys/parties
SLIP39 Shamir splitHigh (per share)High (per share)HighHigh-value holdings, inheritance across multiple trustees

Where people actually get seed phrase security wrong

PitfallWhy it happensFix
Screenshotting the seed “just for a minute”Feels faster than writing by hand during setupDisable camera access during wallet setup; write by hand only
Cloud photo sync grabbing the screenshot before you delete itSync happens automatically, often within secondsTreat any photographed seed as compromised; rotate wallets, don’t just delete the photo
Storing seed and passphrase togetherConvenience, one document instead of twoStore passphrase separately, ideally memorized
Never testing recoveryAssumes the backup “should” workRun a full dry-run recovery on a spare device (Step 12)
Writing the seed directly into a willSeen as simple inheritance planningDocument locations and process, not the phrase, in the will
Using a single storage locationUnderestimating fire/flood/theft riskKeep 2-3 geographically separated copies
Typing the seed into any internet-connected deviceConvenience during recovery or transferOnly enter a seed phrase on an air-gapped device or the hardware wallet itself

Troubleshooting common issues

The verification script says “Checksum FAILED” but I copied the words exactly. Check for extra spaces, autocorrect substitutions if you typed from a phone, or a word order swap. Re-enter directly from the hardware wallet screen rather than from a written note.

A word isn’t in the BIP39 wordlist at all. You likely transcribed a similar-looking word (common mix-ups: “vessel”/”vessel,” “legal”/”legend”). Cross-check the exact spelling against your device screen letter by letter.

My hardware wallet only offers 12 words, not 24. Both are valid BIP39 lengths. 12 words still gives 128 bits of entropy, which is not the weak link in any realistic attack. Use 24 only if your device supports it and you want the larger margin.

I forgot my passphrase during the recovery test. This is exactly why Step 12 exists. If it’s truly unrecoverable, you’ll need to start over: generate a new seed, this time storing the passphrase somewhere you can reliably access, and re-migrate funds.

The metal plate stamping is hard to read after engraving. Test your stamping kit on a scrap plate first. Depth and letter spacing matter more than most people expect on the first attempt.

Can I use a password manager to store my seed phrase instead of metal? Not as your primary backup. A password manager is a networked, software-based system, which reintroduces the exact attack surface (cloud sync, device compromise) that offline metal storage is designed to eliminate. It’s fine for storing a passphrase hint or your inheritance location document, not the seed itself.

My old wallet still shows a balance after migration. Check that the test transaction and full transfer both confirmed on-chain (view the transaction hash on a block explorer). Balances can lag briefly during network confirmation but should clear within the expected block time for that chain.

Should I split shares across family members for SLIP39? Only with a threshold scheme where no single person’s share is enough on its own (3-of-5, for example), and only with people you trust to keep their share secure and not lose it. A threshold that’s too low defeats the purpose; too high risks unrecoverability if people become unreachable.

I don’t have a metal backup kit yet. Is paper okay for now? Paper is fine as a bridge for a few days while you order a metal kit, provided it’s stored somewhere reasonably fire and water safe in the meantime. Treat it as temporary and follow through on the metal transfer once the kit arrives; don’t let “temporary” quietly become permanent.

The verification script asks for my seed phrase. Is that safe to type? Only on a fully offline, disconnected machine, which is why Step 2 and the prerequisites emphasize disabling networking before you start. The script never writes to disk or makes network calls, and using getpass keeps it out of your terminal history, but “offline” is what actually makes this safe.

Building a complete offline seed audit toolkit

Combine the scripts from this tutorial into one project you keep on a USB drive dedicated to offline verification, never plugged into an internet-connected machine after setup.

seed-audit-toolkit/
├── verify_checksum.py      # Step 4: BIP39 wordlist + checksum check
├── passphrase_demo.py      # Step 7: shows how a passphrase changes the derived seed
├── recovery_checklist.py   # Step 12: interactive dry-run recovery tracker
├── shamir_split.py         # Advanced: SLIP39 threshold splitting demo
└── requirements.txt        # mnemonic==0.21, shamir-mnemonic==0.3.0

Set the USB drive’s contents to read-only after the initial pip install, and store it with (but not attached to) your metal backups. When it’s time for your next 6-12 month recovery dry-run, you already have every tool needed, offline, verified, and ready.

Frequently asked questions

Is a 12-word seed phrase less secure than a 24-word one?
Both are secure against brute-force attacks; 12 words provides roughly 128 bits of entropy and 24 words roughly 256 bits. In practice, storage and handling mistakes are a far bigger risk than the entropy gap between the two lengths.

What if I already photographed my seed phrase months ago?
Treat it as exposed regardless of how much time has passed. Generate a new wallet following Steps 3-8 above, migrate your funds, and purge the old exposure per Step 10.

Do I need a hardware wallet, or can I generate a seed phrase in software?
A hardware wallet’s dedicated random number generator and offline signing process removes an entire category of risk that a general-purpose computer, which runs dozens of other processes and network connections, can’t fully eliminate.

Can I store my seed phrase in a bank safe deposit box only?
A single location, even a secure one, is still a single point of failure against bank closures, access restrictions, or regional disasters. Pair it with at least one other geographically separate copy.

How often should I re-verify my metal backup?
Every 6-12 months, or immediately after moving, changing storage locations, or any event that could have exposed or damaged the backup.

Is it safe to use an online BIP39 checksum validator instead of running the script offline?
No. Any website that accepts your seed phrase as input can log it, and even a “client-side only” claim can’t be verified by an end user. Always validate offline, on a disconnected machine.

What’s the difference between a passphrase and a PIN?
A PIN unlocks the hardware wallet device itself and is typically 4-8 digits. A passphrase is a separate, optional word or phrase that changes which wallet is derived from your seed entirely, functioning as a “hidden wallet” layer on top of the seed.

Should I tell anyone where my seed phrase backups are stored?
Only a small number of highly trusted people, and only the location, not the words themselves. Combine this with a separate inheritance document (Step 11) so funds aren’t permanently lost if something happens to you.