Bitcoin Seed Storage Compared: Metal, Paper, Shamir, Digital

Seed Storage Methods at a Glance

A seed phrase is the master backup for a Bitcoin wallet. Lose it, and your funds are gone forever. Store it poorly, and a fire, flood, or thief can wipe out your holdings in seconds. The storage method you choose is one of the most consequential self-custody decisions you will make.

This guide compares five categories of seed storage: metal plates and devices, paper backups, Shamir's Secret Sharing splits, encrypted digital backups, and DIY methods. Each is evaluated on durability, cost, complexity, and resilience to single points of failure.

Metal Seed Storage: Products Compared

Metal backup devices are the industry standard for long-term cold storage. They resist fire, flooding, and corrosion far better than paper. The critical design distinction is between punch/stamp plates (where words are permanently deformed into the metal) and tile/letter-slot designs (where removable characters sit in a rail or capsule). Jameson Lopp's metal seed storage stress tests, covering 75 devices across six rounds, have consistently shown that punch and stamp designs outperform tile-based products under extreme conditions.

The stress tests applied a propane torch at approximately 2,000°F for 10 minutes followed by water submersion (simulating firefighter response), muriatic acid immersion for 12+ hours (corrosion), and a 20-ton hydraulic press (crush/collapse). Average house fires peak at around 1,100°F, so these tests deliberately exceed worst-case residential conditions.

Why Punch and Stamp Designs Win

Tile-based products like the Billfodl and original Cryptosteel Cassette use removable letter tiles that sit in rail slots. Under heat, the housing warps enough for tiles to loosen and fall out, causing catastrophic data loss. Several tile products marketed as "stainless steel" also contained hidden aluminum components (melting point ~1,220°F), which destroyed the device entirely during heat testing. Center-punch and stamp designs permanently deform the metal itself, making the data as durable as the plate.

For a broader look at backup planning, see our Bitcoin backup strategies comparison.

Paper Backups: Cheap but Fragile

Writing a seed phrase on paper costs almost nothing and requires no special tools. That simplicity is its only advantage. Paper ignites at approximately 450°F (232°C), well below house fire temperatures of 600–1,000°C. Ink fades over years, especially in humid or sunlit environments. Acid-free archival paper can last 100+ years under controlled library conditions, but a home drawer or safe is not a climate-controlled archive.

Real losses have occurred. During the January 2025 Los Angeles wildfires, a 70-year-old woman lost her Bitcoin savings because her only backup was a paper key stored in her home. Laminating paper adds water resistance but provides no meaningful fire protection. Paper backups are acceptable for temporary use or negligible amounts, but experts uniformly recommend metal for any holdings worth protecting long-term.

Shamir's Secret Sharing and SLIP-39

Shamir's Secret Sharing (SSS) splits a secret into multiple shares where any subset below a threshold reveals zero information about the original. SLIP-39 is the Bitcoin-specific implementation, developed by SatoshiLabs (Trezor's parent company), that applies this scheme to HD wallet seeds.

A typical setup might split a seed into a 2-of-3 or 3-of-5 scheme: you need at least 2 (or 3) shares to reconstruct the wallet, but any single share is useless to an attacker. SLIP-39 also supports a two-level group hierarchy for complex policies (for example, requiring shares from both a "friends" group and a "family" group).

Each SLIP-39 share is encoded as 20 or 33 words from a dedicated 1,024-word list (distinct from BIP-39's 2,048-word list). The wordlist is designed with unique 4-letter prefixes and a minimum edit distance of 2 between words to reduce transcription errors. A Reed-Solomon checksum detects errors touching up to 3 words.

Hardware Wallet Support for SLIP-39

SLIP-39 adoption remains limited. Only a few signing devices support it natively:

• Trezor Safe 5 (ships with SLIP-39 as the default backup method), Safe 3, Safe 7, and Model T
• Keystone 3 Pro (air-gapped implementation)

Software wallets with SLIP-39 import support include Electrum, Sparrow Wallet, BlueWallet, and Wasabi Wallet.

Ledger, Coldcard, BitBox02, and Foundation Passport do not support SLIP-39. Coldcard uses its own Seed XOR scheme instead, which requires all parts (N-of-N) rather than a threshold (M-of-N). For users of non-Trezor hardware wallets who want distributed trust, the primary alternative is multisig, which distributes separate keys rather than splitting a single seed.

SLIP-39 Tradeoffs

SLIP-39 eliminates the single point of failure inherent in a standard BIP-39 backup, but introduces its own challenges:

• Setup and recovery are more complex than a single 12 or 24-word phrase
• Each share is 20 or 33 words, and you need N shares: the total number of words to store and protect multiplies quickly
• Converting an existing BIP-39 wallet to SLIP-39 requires creating a new wallet and transferring funds (not a re-encoding)
• At recovery time, threshold shares must be combined on one device, briefly centralizing the secret
• Ecosystem support is narrow: BIP-39 works with virtually every wallet, while SLIP-39 works with a short list

Encrypted Digital Backups

Some users store seed phrases on encrypted USB drives, microSD cards, or in password managers. While convenient, digital storage introduces failure modes that physical media does not.

USB drives and microSD cards can fail silently over time, with no warning until the data is needed. Stefan Thomas famously locked 7,002 BTC on an encrypted IronKey USB drive after losing the decryption password, with only limited attempts remaining before permanent erasure. The 2022 LastPass breach exposed encrypted vaults for approximately 30 million users: TRM Labs reported that attackers used cracked vaults to steal over $35 million in cryptocurrency through 2025.

Coldcard supports saving encrypted seed backups to microSD via AES-256 encryption, which provides a reasonable offline digital copy when paired with a strong passphrase. VeraCrypt hidden volumes offer plausible deniability. But any digital backup introduces a second dependency: you must also securely store and remember the decryption passphrase. If the passphrase is lost, the backup becomes a permanently sealed vault.

The expert consensus from security researchers including Jameson Lopp is clear: seed material should stay entirely offline. Password managers, cloud storage, screenshots, and email drafts are all attack surfaces for malware, phishing, and data breaches. For more on wallet recovery methods, see our research guide.

Multi-Location Storage Strategies

Even an indestructible metal plate fails as a backup strategy if it's stored in only one location. A house fire, burglary, or natural disaster at that single site means permanent loss. The solution is geographic distribution, but the right approach depends on whether you use single-sig or multisig.

Single-Sig Distribution

With a standard single-signature wallet, any copy of the seed phrase grants full spending access. Distributing multiple copies across locations increases resilience against loss but also increases the number of locations an attacker could target. A reasonable minimum is two metal backups in two physically separated locations you control: a home fireproof safe and a bank safe deposit box, for example.

Adding a BIP-39 passphrase (sometimes called the "25th word") creates a second factor: an attacker who finds the seed phrase still cannot access funds without the passphrase. However, this also creates two single points of failure: losing either the seed or the passphrase means permanent loss.

Multisig Distribution

A 2-of-3 multisig setup distributes three separate keys across three locations. An attacker must compromise two locations to steal funds, and you can lose one key entirely without losing access. Companies like Unchained and Casa offer managed multisig services with recommended distribution patterns: never co-locate a hardware wallet with its own seed backup, and never store two of the four items (2 devices + 2 seed backups) in the same location.

Location Options

• Home fireproof safe: immediate access, but vulnerable to house-level disasters
• Bank safe deposit box: vault-level security, but limited to business hours and subject to legal seizure
• Trusted family member: supports inheritance planning, but introduces counterparty risk
• Secondary property: strong geographic separation, but adds maintenance burden

Important: Alongside each seed backup, store the wallet software name, script type, derivation path, and (for multisig) the M-of-N threshold plus all extended public keys. A seed phrase alone is not always enough to recover a wallet without these details.

How to Choose a Seed Storage Method

For most Bitcoin holders, a center-punch metal plate in the $40–$80 range (Blockplate, Seedplate, or Hodlinox) offers the best balance of durability, simplicity, and cost. These products consistently earn top grades in independent stress testing and require no special technical knowledge to use.

If you hold enough Bitcoin that a single compromised backup would be catastrophic, move to either SLIP-39 (if your hardware wallet supports it) or multisig. Multisig has broader wallet support and does not require reconstructing the full secret on one device during recovery. For a detailed comparison of custody architectures, see our cold storage setup comparison.

Avoid tile-based metal devices unless you accept their documented vulnerability to heat and crush. Avoid paper as a primary backup for any meaningful amount. Avoid storing seeds digitally unless you have a thorough threat model and accept the risk of device failure, passphrase loss, and malware exposure.

Whichever method you choose, test your backup before relying on it. Send a small amount to the wallet, wipe the device, and verify you can recover using only your backup materials.

Frequently Asked Questions

What is the best metal seed storage device?

Based on independent stress testing by Jameson Lopp across 75 devices, center-punch plates like Blockplate 2.0, Seedplate (Coinkite), and Hodlinox consistently earn the highest grades. They survive fire (2,000°F+ propane torch), corrosion (muriatic acid immersion), and crush (20-ton hydraulic press) without data loss. For best value, the SAFU Ninja DIY washer-stack method costs under $10 and also earned an A grade.

Should I use Shamir's Secret Sharing or multisig?

Both eliminate single points of failure, but they work differently. SLIP-39 (Shamir) splits one seed into threshold shares: simpler to set up, but requires bringing shares together on one device to recover, and only works with Trezor and Keystone hardware wallets. Multisig uses separate independent keys: broader wallet support, no single-device reconstruction moment, and each key can be on a different hardware wallet brand. For most users holding significant amounts, multisig provides stronger security guarantees. For a deep dive, see our guide on multisig wallets.

Is it safe to store a seed phrase in a password manager?

No. The 2022 LastPass breach demonstrated the risk: attackers exfiltrated encrypted vault backups for millions of users, and by cracking weak master passwords offline, stole over $35 million in cryptocurrency through 2025. Unlike a compromised password, a compromised seed phrase cannot be "changed." The attacker has permanent access to those funds. Keep seed material entirely offline.

How long does a paper seed phrase backup last?

Standard paper can degrade within 20–50 years, and ink fades faster in humid or sunlit conditions. Acid-free archival paper can last 100+ years under controlled museum-grade conditions, but no home environment meets that standard. Paper also ignites at approximately 450°F (232°C), far below house fire temperatures. Lamination adds water resistance but does not protect against fire.

Can I split my 24-word seed phrase across two locations?

Naively splitting a seed phrase (for example, 12 words in one place and 12 in another) is explicitly discouraged by security experts. It weakens brute-force resistance exponentially: an attacker who finds half the words has a dramatically reduced search space. If you want distributed storage without a single point of failure, use a proper threshold scheme like SLIP-39 or a multisig setup, both of which are cryptographically designed so that no partial information leaks.

What should I store alongside my seed phrase backup?

A seed phrase alone may not be sufficient for recovery. Store the following alongside each backup: the wallet software that generated it, the script type (for example, Native SegWit / P2WPKH), the derivation path (such as m/84'/0'/0'), and for multisig wallets, the M-of-N threshold plus all extended public keys. Without these details, recovering funds from a seed phrase can require significant trial and error.

Do I need to worry about fire resistance for seed storage?

Yes. Residential fires regularly reach 1,100°F (593°C) and can peak much higher. Paper ignites well below that threshold. Even "fireproof" home safes are typically rated for only 30–60 minutes at specific temperatures, and many are designed to protect documents (rated to 350°F internal) rather than withstand the temperatures that would damage metal. A quality stainless steel backup device rated above 2,000°F provides a meaningful margin of safety that paper and consumer-grade safes do not.

This tool is for informational purposes only and does not constitute financial or security advice. Product data is approximate and based on publicly available information, manufacturer specifications, and Jameson Lopp's published stress test results. Prices, product availability, and test methodologies may change. Always verify current data with the manufacturer and test your backup recovery process before relying on it.