Top 5 Mistakes People Make When Backing Up Their Seed Phrase

Seed phrase backup failures fall into two categories: mistakes that lead to loss (you can no longer access your funds) and mistakes that lead to theft (someone else can access your funds). Both outcomes are permanent. Here are the five most common errors, in order of how frequently they appear.

1Storing the Backup in Only One Location

The most common mistake is treating the backup card that came with your hardware wallet as "the backup." This single piece of paper or card, stored in one physical location, is your entire recovery path. One house fire, one flood, one burglary, and it is gone.

The fix is straightforward: create multiple copies and store them in multiple locations. If your backup is encrypted (as it should be), distributing multiple copies costs almost nothing in security terms, because the ciphertext is useless without the decryption password. If your backup is plaintext, each additional copy is an additional risk, which is one more reason to encrypt first.

The industry recommendation is a minimum of three copies in at least two different physical locations. Common choices: home safe, bank safety deposit box, trusted family member's location.

2Storing the Backup in Plaintext

Whether the backup is on paper, a USB drive, in a notes app, or saved as a photo: if it is plaintext, the only protection is physical concealment. Concealment fails against determined attackers, curious visitors, routine burglaries, and any situation where you are not in control of the location.

Encrypting your seed phrase with AES-256-GCM transforms it from "dangerous if found" to "useless if found." The encryption password is the only secret. This changes the threat model entirely and enables safe storage in locations you would never trust with a plaintext backup.

If your current backup is a piece of paper with your words written on it: go encrypt it now, before continuing reading.

3Never Testing the Recovery Process

This is the mistake that catches experienced users. You created a backup. You stored it carefully. You never verified it actually works. Years later, when you need to recover, you discover that any number of silent failures have been waiting: a single word that is illegible because of faded ink or difficult handwriting, words written in the wrong order, a misspelling (easily done with BIP39 words like "acquire" vs "accuse"), a USB drive that failed silently at some point, or simply forgetting which password you used for the encrypted backup. Every one of these scenarios ends in permanent loss if the hardware wallet itself is also unavailable. The fix is simple: test your backup process before you need it. Verify the backup produces the correct wallet by loading it in your wallet software (on a device fully disconnected from the internet). Do this at least once after creating the backup, and once per year thereafter.

4Storing the Encryption Password With the Encrypted Backup

People who take the right step of encrypting their seed phrase sometimes immediately undermine it by writing the decryption password on a sticky note attached to the drive, in a document in the same folder as the encrypted file, or in a notebook stored next to the same safe.

The encryption provides zero security if the password is stored alongside the ciphertext. An attacker who finds your backup also finds the key. You have created the illusion of security, not actual security.

The password must be stored separately: in a password manager (if digital), written down in a different physical location from the backup, or memorized. The backup and the password should never be co-located. If someone has to obtain both through completely independent means to access your funds, you have the right separation.

5Taking a Photo of the Seed Phrase

Taking a photo of your seed phrase, whether to "temporarily" save it before writing it down or as an "extra backup," is a serious security mistake that many people make without thinking about the implications.

Photos taken on a smartphone are immediately synced to iCloud, Google Photos, or manufacturer cloud services in the background. This upload happens automatically, even when you do not intend it to. Your seed phrase has just been stored on a remote server that can be breached, subpoenaed, or accessed through your account credentials.

Beyond cloud sync, photos persist in unexpected locations: camera roll backups, messaging app caches (if you sent the photo to yourself), Screenshot folders, and backup software. A photo of a seed phrase has a remarkable ability to end up in places you did not intend it to be.

The rule is simple: never photograph your seed phrase. Not even temporarily. Not even on airplane mode. Write it down on paper, encrypt it immediately, and delete the paper once the encrypted backup is verified.

The Checklist

Before considering your backup strategy complete, work through these five questions honestly. Is the backup encrypted with AES-256? Is the encryption password stored in a completely separate location from the backup? Are there at least three copies distributed across at least two different physical locations? Has the decryption been tested end-to-end to confirm the correct seed phrase is recovered? And finally, have zero digital copies of the plaintext seed phrase been made (no photos, no notes apps, no cloud uploads of any kind)?

If all five answers are yes, your backup strategy is solid. If any answer is no, you have a specific, fixable problem.

Conclusion

None of these mistakes require any technical sophistication to make, and none require any technical sophistication to fix. They are habit and awareness failures, not knowledge failures. The correction for all five mistakes is the same: encrypt your backup offline with a strong password, store multiple copies separately from the password, and test the recovery process before you need it.

See our complete encryption guide to implement the correct approach from scratch, or our paper vs encrypted backup comparison to understand why encryption is the right foundation for any backup strategy.