How to Protect a Seed Phrase from Phishing
Learn to spot fake seed phrase requests, protect offline backups, and understand what SeedAddress can and cannot reproduce.
The most important rule is simple: never enter a seed phrase, private key, or BIP39 passphrase into a website, support form, chat, or screenshot. A legitimate service can help you use its application, but it does not need the words that restore your wallet. Open the site from a bookmark or official documentation, distrust urgency, and confirm every operation on the device that controls the wallet.
What phishing tries to obtain
Phishing imitates a wallet, manufacturer, exchange, application, or support account to obtain a secret or make you sign something you do not understand. A message may warn about an update, a locked account, a refund, or an immediate loss. The goal is usually to make you act before checking the domain and the context.
A seed phrase request is a decisive fraud signal. Ledger's guide to crypto phishing describes pages that imitate providers and pop-ups that demand a recovery phrase under a false deadline. A phrase is not validated on a support website: whoever obtains it can try to restore the wallet on another device.
Other attacks target an account password, install malicious software, or lead you to sign a transaction or approval. A hardware wallet reduces some risks from a connected computer, but it does not make a fake website safe or turn an incomprehensible signature into a safe operation. Read the destination, amount, and permission on the device screen and cancel if they do not match what you intended.
How to check a request before acting
When you receive a wallet-related email, message, or pop-up, pause and follow this sequence:
- Close the received link and type the official address using a bookmark you saved earlier. Check the complete domain. HTTPS and the padlock encrypt the connection, but they do not prove that the site is legitimate: a phishing page can also have a valid certificate. A logo, subdomain, or similar extension does not make a copy official.
- Look for the notice inside the official application or its help center, rather than through the phone number, link, or account shown in the message. Support does not need your seed phrase to diagnose a problem.
- Do not download an update from an advertisement, direct message, or search result you cannot verify. Obtain software from the official site and check which application you are opening.
- If an application asks you to sign an operation, compare the address, network, amount, and permission on the device screen. Reject it when information is missing or the request does not make sense for the action you wanted.
- If you are still unsure, stop. The time saved by refusing a fake emergency is worth more than trying to undo a transfer.
Bitcoin.org's guide to securing a wallet also recommends backups, strong passwords, and caution with connected services. An online backup exposed to malware or a compromised account does not have the same protection as an offline copy stored safely.
Protect the backup you actually need
A seed phrase is a recovery backup, not a code to test with third-party services. Write it down or store it according to the wallet's documented procedure, and keep it private, offline, and protected from damage. If you use more than one copy, place the copies in secure locations so that one incident cannot destroy every recovery option. Check a copy with the device's official tool without uploading the words to an online checker.
A wallet may not display or reissue the original seed after creation. Trezor's current wallet-backup documentation explains that a backup restores access if the device is lost, damaged, or reset, and that the format depends on the wallet. BIP39 supports 12, 15, 18, 21, or 24 words; some devices also use other formats such as SLIP39. Identify your wallet's format and keep an independent copy before you need it.
Do not confuse a seed phrase with an optional BIP39 passphrase, a device PIN, or a SeedAddress password. They serve different purposes, and losing one can prevent recovery of a particular wallet. The comparison between a seed phrase and a BIP39 passphrase explains the distinction without putting real secrets on a page.
SeedAddress's phishing boundary
SeedAddress is deterministic: the browser combines the selected coordinates, password, language, and chosen word length to derive a phrase compatible with the selected BIP39 word list. The current derivation uses a precision-9 geohash and HMAC-SHA-256; the public address adds no random entropy. The password and mnemonic remain in transient browser memory during the process and are not sent to the map provider.
These properties do not make the generator a universal backup or make a phishing request safe. A phrase produced by SeedAddress should have an independent offline copy when it matters. A 24-word result is not guaranteed to provide 256-bit security merely because it has 24 words, because this method does not add new random entropy. The inherited five-character minimum remains for compatibility; it is not a recommendation for a new password.
You must also preserve the exact context if you intend to reproduce a result: coordinates, password, language, and word length. Two nearby coordinates within the same geohash cell can produce the same phrase, while crossing a cell boundary can change it. The explanation of places and coordinates describes why a visible place name is not enough. The current interface cannot recover an old phrase by pasting historical coordinates, so an input record documents and compares the derivation rather than guaranteeing recovery.
Do not enter a real phrase into SeedAddress to check whether it matches another wallet, and do not respond to someone who asks you to do that to “verify” an account. If you use SeedAddress, first test with valueless inputs and preserve the mnemonic independently. The offline-backup checking guide explains how to keep the words inside a trusted recovery process.
What to do if you already shared the phrase
Treat a phrase as compromised if you entered it on a website, sent it in a chat, dictated it to someone, or photographed it on a connected device. Do not try to regain control by entering the same words on another page. From an environment and application you have verified, follow the wallet's recovery procedure to move funds to a new wallet with a securely generated backup, and consult the provider's official documentation for exact steps. Review connected permissions and devices, and remove software installed from the suspicious link.
If you have not shared the phrase, the best time to prepare recovery is now: verify an offline copy using the official method, record the format, and store the instructions with the copy without photographing or publishing the words. When a request demands speed, secrecy, or a “recovery code” outside the official application, treat it as phishing and stop.