Passphrase: Ledger’s Advanced Security Feature

The passphrase is an advanced security feature that hardware wallets like the Ledger Nano X or Ledger Nano S can use. It adds an extra word of your own choosing to your already existing recovery phrase to unlock a brand-new set of accounts. Let’s take a closer look at how passphrases work, what they do, and some best practices for using one.

Introducing the Passphrase

As you might be aware, your 24-word recovery phrase is the backup to all of your crypto assets. It’s absolutely key to store your 24 words securely and to never enter it into a smartphone, computer or other device that can connect to the internet. If someone manages to get a hold of your set of 24 words, they can steal all of your cryptocurrencies. Unless… What if we told you that there’s a way to add an additional layer on top of your 24-word recovery phrase?

This can be done through the Passphrase.

The passphrase is an advanced feature that allows you to add an additional word to your recovery phrase. For this reason, it’s also commonly referred to as the 25th word. Unlike the regular recovery phrase, you would choose the 25th word. There are no limitations for which word you’d like to choose. As a matter of fact, the only limitation is using a maximum of 100 characters. The passphrase is also sensitive to caps and can be composed of numbers and signs as well.

When you use a passphrase on top of your usual settings, it will open a brand-new set of accounts. It’s similar to having two completely different recovery phrases.

Why would you want to use a passphrase and have a brand-new set of cryptocurrency addresses, however?

Why would I consider using a Passphrase

Now firstly, as the passphrase adds an additional layer, using it would mean that someone having your 24-word recovery phrase would still simply not have enough information to get access to your precious cryptocurrencies. One would need your 24 words and your self-created 25th word to access your crypto assets. If they’d only have your 24 words, they can only access your regular accounts instead. This is why the accounts managed with a passphrase are often called hidden accounts.

Not only does it create another layer, it also adds more randomness to your backup. Now, the standard 24-word recovery phrase is already extremely random, with a massive total of 115.792.089.237.316.195.423.570.985.008.687.907.853.269.984.665.640.564.039.457.584.007.913.129.639.936 possible combinations. These words are, however, from a set list known as the BIP39 word list. 

With a 25th word, you’d be cranking this humongous number of potential combinations to a whole new level. Also this introduces a human element to the mix as well. Rather than relying on a set of 24 words you’ve received by a device, you’d be adding a random word that you personally thought of and have created. We would like to add though that only using a recovery phrase created by a Ledger device is highly secure as well. Ledger devices have the highest certificate when it comes to the quality of our True Random Number Generator (TRNG) used to create your recovery phrase. Lastly, using a passphrase would grant you Plausible Deniability. Let’s take a closer look at why that could be important.

What’s plausible deniability?

Much like with anything of value, there will always be people trying to steal it by any means possible. Unfortunately in the world of crypto, we have seen rare occasions where individuals known to have some wealth in crypto to be the target of physical robbery and threats. The Passphrase could offer a limited amount of protection for your cryptocurrencies in such an event.

For the passphrase, Plausible Deniability comes down to being able to make someone else think they now have access to your crypto fortune. For example, someone could be putting you under duress to hand out your recovery phrase or unlock your Ledger device. With its usual settings, it would only give access to your regular accounts, not your hidden ones. Especially if there is a bit of a balance on your regular accounts while the majority of your crypto rests on hidden accounts, this could be pretty convincing. You could even use multiple hidden accounts with different passphrases. This can be useful if the attacker is aware of the passphrase feature.

Plausible Deniability doesn’t give any certainties, but it could give you a fighting chance to save your crypto fortune under extreme circumstances.

Can I use a passphrase on my Ledger device?

Yes, you can! Quite a few other hardware wallets do allow for a passphrase but would have you enter it on a computer. This would lead to your passphrase being vulnerable to online attacks. With Ledger, you can enter your passphrase directly on your Ledger device to enable a hidden account. This would prevent your passphrase from falling into the wrong hands.

You actually have two options for setting up a Passphrase with Ledger. The first is entering it into your device every single time you want to use your passphrase. We refer to this as the “Set temporary passphrase” option. With this, once your Ledger device is turned off it will grant access to your regular accounts again.

Another option is to link a passphrase of your choosing to a secondary PIN code. When choosing this option, you would first create a passphrase directly on your Ledger device. After having done so, you will be able to choose a secondary PIN code for your Ledger device. After this, each time you turn on your device, you can choose between entering your normal PIN code or your secondary PIN code. If you would enter your secondary PIN code, your accounts hidden behind a passphrase will be accessible.

For example:

Regular PIN code: 1653 → Normal accounts
Secondary PIN code: 8530 → Hidden accounts

You can read more about using a Passphrase for your Ledger device in this article as well.

Best practices

Now we must add that a passphrase is considered an advanced feature for a few simple reasons. Firstly, you must remember your passphrase perfectly. A single character being mixed up would cause a completely different set of accounts to be accessed. Even a character being capitalized or not would result in this. 

If you don’t remember your passphrase character for character, you cannot gain access to the crypto you managed with it. As such, it’s key that you 1. Enter it correctly the first time you’d set it up and 2. Remember it perfectly.

Also, one Passphrase is not as secure as the other. It can be as long as 100 characters and you can choose whether you want to use capitalized characters, numbers and/or signs. The longer the passphrase and the more different types of characters you use, the more complex and secure it becomes. Ideally, you would treat it like a password where you try to make it as complex as possible and not use words directly.

For example:
Passphrase 1: password → Very insecure due to short length, no random characters or caps.

Passphrase 2: IReallyLikeMyBitcoins → A bit more secure: longer and uses caps, but still uses common English words and no numbers or signs. 

Passphrase 3: H05!xp4e2i6dAnV?esRjfap953nxZprsi495nAASF5n,!f01.?d → Even more secure: lengthy, wide mix of caps, numbers and signs and doesn’t use actual words. 

While Passphrase 3 can be seen as the most secure of the bunch, it’s also extremely hard to remember. You could make it a form of cryptographic puzzle. For example: Iret3LNS’tuBgm! concerns the first letters and special characters/numbers of the sentence “I really enjoy the 3 Ledger Nano S’s that Uncle Bob gave me!”.

We would like to stress that your Passphrase is sensitive information. As such, we recommend treating it with the same kind of care as you would treat your Recovery Phrase:

– Never share your Passphrase with anyone – Ledger will never ask for this
– Never enter your Passphrase on a computer, smartphone, or other internet-connected device

You can read more on these best practices here.

Keep learning! If you enjoy getting to grips with crypto and blockchain, check out our School of Block video 3 Ways to Earn Passive Income from Crypto.