Durable seed backups

A seed card in a drawer is a perfectly good backup right up until the moment you actually need it, which is likely to be the same moment your house is on fire, under water, or being emptied by someone else.

That is the awkward property of backups: the scenarios that make you reach for one are the same scenarios that destroy paper. This page is about closing that gap without turning it into a hobby.

A stamped stainless steel seed plate on a workbench beside a letter punch set and a hammer, a paper seed card alongside for comparison.

Image to come

1What actually happens to paper

Paper does not need a disaster to fail. It has a list of ordinary enemies, and most losses come from the boring ones rather than the dramatic ones.

• Fire is the obvious one, and paper is gone well before a structure is.
• Water from flooding, a burst pipe, or the effort to put out the fire. Ink runs; some inks vanish entirely.
• Fading. Receipt-style thermal paper can go blank in a warm drawer within a couple of years, and some ballpoint and gel inks fade badly in light.
• Damp and mould in a basement, garage, or safe that is not as dry as it looks.
• Being tidied away. An unlabelled card of random words looks like rubbish to anyone who is not you, and that includes people helping you move house.

The last one is worth sitting with. Nothing needs to go wrong for it to happen.

2What metal buys, and what it does not

A stamped steel plate survives house-fire temperatures, immersion, damp, and decades of neglect. Common stainless steels melt far above the range a typical structure fire reaches, and titanium higher still — either is comfortably sufficient. Avoid aluminium, which melts at a temperature ordinary house fires can exceed.

What metal does not do is change anything else about your security. It is exactly as readable to whoever finds it as the paper was, and rather more durable in their hands too.

3You only need the first four letters

Every word in the BIP39 list is uniquely identified by its first four letters. No two words share them. Abandon and ability differ by the fourth character; nothing beyond that is doing any work.

So a backup recording ABAN is exactly as complete as one recording ABANDON, and stamping four characters per word rather than up to eight roughly halves the labour and the number of chances to make a mistake.

• Record four letters per word. Any wallet or wordlist will resolve them unambiguously.
• Words shorter than four letters are written in full — there are only a handful.
• Number your words. Order is part of the secret, and a plate of unnumbered words is a puzzle you have set for your future self.
• This shortcut applies to BIP39 wordlists. If your wallet uses a different scheme — Electrum's own seed format, for instance — write the words in full.

4Choosing a plate

Products fall into two broad families, and the trade between them is straightforward.

• Avoid anything that stores your words behind a lid, a window, or a sticker rather than in the metal itself. If a casual glance reveals it, so does a casual burglary.
• Avoid aluminium, and avoid products that rely on adhesive to keep letters in place.

5Stamping it without ruining it

The mistakes here are all mechanical, and all avoidable by slowing down.

• Practise on a scrap plate first. Get a feel for how hard to strike before you touch the real one.
• Work on a hard, flat surface. A workbench or concrete floor, not a table that absorbs the blow.
• Stamp one word at a time and check it against your written list before moving on. Correcting later is not an option.
• Watch for upside-down punches. N and Z, M and W, 6 and 9 are the usual casualties.
• Do this alone, away from windows, with no phone camera facing the bench.

When you have finished, restore from the plate rather than from your paper draft, and confirm you reach the right wallet. The plate is the thing you will be relying on, so the plate is the thing that gets tested.

6What has to be stored alongside it

Words alone are a complete backup for a simple single-signature wallet, and an incomplete one for anything more elaborate. This is the step people get wrong after doing everything else right.

• A passphrase, if you use one — recorded separately, never on the same plate. Also record that one exists, or a future reader will restore the words, see an empty wallet, and stop.
• The wallet configuration, for multisig — the descriptor, the policy, the other public keys. Seeds alone will not rebuild a multisig wallet.
• The seed format, if it is unusual — noting that it is an Electrum seed rather than BIP39 costs one line and saves a great deal of confusion.
• A plain-language note explaining what the plate is and what it is for, written for someone who has never heard of any of this.

7Where it goes

A plate stored next to the hardware wallet is one theft away from being useless, and a plate nobody can reach in an emergency is not much better.

• Store the backup and the device in different places. One event should not reach both.
• Consider a second plate in a third location if the amount justifies the extra copy — more copies means more durability and more places to be found, which is a genuine trade rather than an obvious win.
• If you use a safe deposit box, check the access terms, what happens on death, and whether anyone else can open it.
• Tell someone it exists, without telling them what it is. A backup nobody knows about is a backup that gets skipped.

The mistakes worth naming

• Photographing the plate to check your work. That instantly recreates the digital copy you went to metal to avoid.
• Inventing an encoding scheme — shifting letters, reversing order, a personal cipher. You will forget it, or your heirs will never crack it, and it protects against far less than it costs.
• Splitting words across locations ad hoc — half here, half there. This is not a real security scheme, and it turns one point of failure into two.
• Never testing it — a plate that has never been restored from is exactly as unproven as any other backup.
• Leaving the paper draft lying around after stamping. Destroy it once the plate is verified.

Testing durability, sensibly

You will see videos of people taking blowtorches and acid to seed plates. That testing is useful and it is not something to perform on your own backup.

If you want the reassurance, stamp a decoy plate with a throwaway set of words using the same product and technique, and abuse that one instead. What you are testing is whether the letters remain legible after heat and impact — which is a property of the product and your stamping depth, not of your particular words.