§ Recovery
How to Store a Crypto Wallet Recovery Phrase Safely (2026)
How to store crypto wallet recovery phrase safely: the four real options, the threat model behind each, and the hybrid metal-plate-plus-encrypted-notes setup that actually works.
Quick answer: How to store crypto wallet recovery phrase safely in 2026: stainless steel seed plate as primary, geographic separation from your residence, optional Shamir split for six-figure-plus holdings, and a true end-to-end encrypted notes app as a read-only convenience copy. Never iCloud Drive, never email, never screenshots, never a password manager you reset with email. Lose the seed, lose the wallet. That is the deal.
The threat model
A recovery phrase — typically 12 or 24 words from the BIP-39 wordlist — is the master credential for a self-custodial crypto wallet. Anyone with the phrase controls the funds. Anyone without it cannot recover them. The honest threat model has five real attackers, and your storage strategy needs to handle all of them:
- House fire / flood. Routine and devastating. Paper is gone. Metal survives.
- Casual theft.A burglar pulling drawers finds a notebook labeled “Wallet”. Geographic separation breaks this.
- $5 wrench attack. Physical coercion. Cryptography cannot help; not advertising and using a decoy wallet can.
- Phishing.A fake wallet site asking you to “verify” your seed. The seed should never leave its storage medium for any reason.
- Cloud breach. Email account compromised → password reset → password manager → seed exposed. The chain of resets needs to terminate offline.
Storage strategies that handle four of five but not all five are still a fail. The right answer combines methods.
The four real options
| Method | Pros | Cons | Good for |
|---|---|---|---|
| Paper backup | Free, simple, no electronics | Burns, fades, water-destroys | Short-term backup, low value |
| Stainless steel seed plate | Fire / water / corrosion resistant | $30–$120, physical theft risk | Primary long-term storage |
| Shamir split (2-of-3) | No single point of failure | Complex setup, more surface area | Six-figure+ holdings |
| E2EE notes app | Instant phone access, encrypted at rest | Device-dependent, meta-recovery problem | Read-only reference copy |
Paper. The default a hardware wallet ships with. Acceptable as atemporary backup the night you set up the wallet. Not acceptable as long-term storage. Paper burns at 230°C. House fires hit 800°C+. Water destroys ink within hours. The friction of writing the words is real; the survivability is not.
Stainless steel seed plate. The serious answer. Grade 304 or 316 stainless plates with stamped letters or punched word tiles survive house fires (typical 800–1100°C, well below stainless's 1400°C melting point), survive immersion, survive a decade in a damp basement. Cryptosteel Capsule, Billfodl, Coldti, ELLIPAL Mnemonic, and a dozen other vendors all do this competently. Budget $30–$120. Stamp words from the BIP-39 wordlist; the first four letters of each word are unique within BIP-39, so you only need to stamp four letters per word.
Shamir's Secret Sharing.Splits your seed into N shares such that any K of them (K<N) reconstruct the original — and fewer than K reveal nothing. The standard configuration is 2-of-3: three plates, one at home, one with family in another city, one in a bank safe deposit box. Any two reconstruct. One alone is useless. Trezor Model T and the SLIP-39 standard handle this natively; some wallet apps support it in software. Right tool for portfolios where compromise or loss of one location is non-trivial — generally six figures and up.
Encrypted digital storage. A specific narrow case. A true zero-knowledge encrypted notes app on your iPhone, with its own master password and 12-word recovery seed, locked behind Face ID, holding the phrase as a quick read-only reference. Convenient. Recoverable from your phone. Not the primary — because the meta-recovery problem (you need another seed to recover the notes app's vault) makes it derivative.
Where digital storage actually works
The narrow case for keeping a recovery phrase in an encrypted notes app: you have a metal plate as primary, geographic separation handled, and you want the convenience of checking the phrase from your phone without traveling to your safe. This is legitimate. The constraints are tight.
The app must satisfy all of:
- True end-to-end encryption with AES-256 and a key derived on-device. No web reset, no email magic link.
- Master password plus 12-word recovery seed for the app itself, so the meta-recovery problem is bounded — you have two seeds (wallet, app) and you store the app's seed on the metal plate too.
- Per-folder password beyond the app's master, so the wallet phrase sits in a separately-locked folder even if someone unlocks the rest of the app.
- Biometric lock with a short auto-lock timer (60 seconds or less) so an unattended phone does not become a leak.
- No iCloud sync in plaintext, ever. Sync is fine if it's ciphertext. Secure Notes does this properly.
The meta-recovery problem is real. If your only copy of the wallet seed is in an app whose recovery seed you also lost, you have two losses to recover from instead of one. Treat the digital copy as derivative — convenient, never authoritative.
What never to do
- Never screenshot.Photos sync to iCloud (and Google Photos, and often automatically to a desktop), get indexed by ML, and survive in “Recently Deleted” for 30 days.
- Never email yourself. Email is plaintext on someone else's servers. Gmail's spam filters have read it. Microsoft's. Apple's iCloud Mail. Don't.
- Never type it into iCloud Drive, Dropbox, Google Drive. Even with Advanced Data Protection on, the surface is broad, recovery is account-tied, and a single phishing event kills you.
- Never paste it into a password manager you log into via SSO. “Sign in with Google” → Google account phished → password manager open → seed exposed. The recovery chain has to terminate offline.
- Never give it to a “support” agent. No legitimate wallet, exchange, or service ever asks for your seed. Ever. If asked, you are being phished. The seed leaves storage only to type into your wallet during a genuine recovery you initiated.
- Never store it in a general password manager that allows email-based account recovery. If they can email you a reset, the seed is reachable through that email.
A practical recommended setup
For a holding worth protecting but not Shamir-justifying (roughly five-figure to low-six-figure range):
- Stainless steel plate, stamped. Primary. Stored in a fire-resistant safe at home or a bank safe deposit box. Never photographed.
- Second plate, geographic separation. Parent's house in another city, or a sealed envelope with your lawyer. Same content, different location. Solves house-fire-plus-theft compound risk.
- Encrypted notes app, read-only copy. In Secure Notes or an equivalent zero-knowledge app, behind a per-folder password and Face ID, with the app's own 12-word recovery seed stamped on the metal plate too. Convenience reference, not primary.
- Verification ritual. Once a year, on a known date (a birthday, New Year's), restore the wallet from each storage location to confirm it still reads. Plates degrade only rarely, but the test takes ten minutes and tells you something a year of not-checking does not.
For six figures and up, add 2-of-3 Shamir, drop the second plate in favor of the three Shamir shares geographically separated, and consider a multi-sig wallet on top. The principle does not change: multiple independent copies, offline-primary, encrypted-digital secondary, verification annual.
Frequently asked: storing a recovery phrase
Where is the safest place to store a seed phrase?
A fire-rated stainless-steel seed plate, stamped not engraved, stored in a location separate from your main residence — a bank safe deposit box, a parent's house, a sealed envelope with your lawyer. Paper is acceptable as a backup to the plate. Digital storage is acceptable only as a third tier inside a true zero-knowledge encrypted notes app with its own recovery seed. Never just one location, never in a cloud you log into with email-based reset.
Is it safe to store a seed phrase in an encrypted notes app?
Conditionally yes, as a secondary copy. The app must be true end-to-end encrypted with a master password and recovery seed of its own — a zero-knowledge architecture, not 'we encrypt your data on our servers.' Even then, treat it as the convenient read-only copy, not the primary. The metal plate is primary. The notes app is the reference you check from your phone in seconds without exposing the plate.
Should I split my recovery phrase across multiple locations?
Splitting a 12-word phrase in half (6+6) is a common idea and a bad one — knowing six words reduces brute-force effort enormously and any sophisticated attacker who finds half can recover the rest in days. The correct way to split is Shamir's Secret Sharing, which uses cryptographic threshold reconstruction — for example a 2-of-3 setup where any two shares reconstruct the seed but one share reveals nothing. Trezor and a few wallet apps support this natively.
Can a metal seed plate survive a fire?
Yes, properly chosen. Stainless steel grade 304 melts at around 1400°C; a typical house fire peaks around 800–1100°C. Plates rated for fire and corrosion resistance — Cryptosteel, Billfodl, Coldti, ELLIPAL Mnemonic — are the standard. The failure mode to watch is the engraving itself: stamped (impact-stamped letters or punched-tile slots) survives heat better than laser-etched. Test by photographing your finished plate at full read distance, then store.
Is it safe to store a seed phrase in iCloud?
No. Even with Advanced Data Protection on, iCloud sync surface is broad, recovery is tied to your Apple ID password and a recovery contact who can also reset it, and any device signed into your iCloud is a potential exfiltration point. Putting a seed phrase in iCloud Drive, iCloud Notes, or Photos is the most common high-stakes mistake in the crypto space. Don't do it.
What is a $5 wrench attack?
The shorthand from xkcd #538: no matter how strong your cryptography is, an attacker with physical access to you can just demand the seed at the threat of violence — the proverbial $5 wrench. Defense is geographic separation (the seed isn't where you are), plausible deniability (a decoy wallet with a smaller balance), and not advertising your crypto holdings on social media. Cryptography solves digital threats; it cannot solve physical coercion.
Keep reading
Related guides
Privacy
Storing passwords in a notes app
When a notes app is the right place for sensitive credentials.
Privacy
Encrypted notes on iOS
What end-to-end encryption actually buys for sensitive content.
Privacy
Private note-taking, properly
How a zero-knowledge notes app should be set up.