How to store a seed phrase safely (and what not to do)

A seed phrase — also called a recovery phrase or mnemonic — is the list of 12 or 24 words a self-custody crypto wallet shows you when you create it. Those words can rebuild the wallet on any device. That is what makes them useful if your phone is lost, and also what makes them dangerous: there is no password reset, no bank to call and no way to reverse a transfer once someone else has them.

A wallet app's own passcode only protects the app on one device. The seed phrase is the master key behind it.

Do this once, carefully, when you create the wallet:

1. 1Make sure nobody is around and no camera is pointed at your screen, including video calls and screen recording.
2. 2Write the words by hand, in order and numbered, on paper. Use clear block letters and double-check spelling against the wallet's word list.
3. 3Verify the backup: most wallets ask you to re-enter some words. Do it from your written copy, not from memory.
4. 4Make a second copy and store it in a different physical location, so one fire, flood or move does not destroy both.
5. 5For long-term storage, consider stamping or engraving the words on a metal plate made for this purpose; paper fades and burns.
6. 6Keep the copies somewhere private and dry — a home safe or another secure place you control — and avoid labelling them in a way that announces what they are.

Most losses come from a copy that was convenient rather than safe:

• Screenshots and photos. They sync to cloud photo libraries, show up in search, and get shared by accident.
• Cloud notes, email drafts and documents. An account takeover exposes everything in them at once.
• Chat apps, including messages to yourself.
• Any website or form that asks for it. No legitimate wallet, exchange or support team ever needs your seed phrase. A pop-up, airdrop or “wallet validation” page that asks for it is a scam.
• Anyone who contacts you first offering help — by phone, chat or social media — even if they use an official-looking name or logo.

Security guides from wallet makers generally say no, and offline storage remains the safer default. Some people still keep a digital copy, for example while travelling or as a third backup. If you do, be clear about the trade-off: any copy on a phone is only as safe as the phone and the app holding it.

If you choose that route, the minimum is a place that is encrypted, offline, protected by its own passcode, and not synced to a cloud account — never a screenshot, a plain note or a photo in your library. Treat it as an extra copy, never the only one.

The same thinking applies to other secrets on your phone; see how to store passwords safely on your phone and how to store ID photos safely.

• Use a 6-digit or alphanumeric iPhone passcode and keep software updated.
• On iPhone with iOS 17.3 or later, turn on Stolen Device Protection (Settings → Face ID & Passcode), which adds Face ID requirements and a security delay for sensitive changes when you are away from familiar places.
• Protect the email and Apple Account linked to your exchanges with two-factor authentication.
• Before handing the phone to a repair shop, read what to do before sending your iPhone for repair.

Lockboxy is not a crypto wallet and cannot recover or move funds. What it offers is an encrypted place on your phone for the things around your crypto that you do need to keep: 2FA codes, exchange passwords, and — if you have decided to keep a digital copy — a seed phrase.

• The Wallet area has dedicated entries for crypto seed phrases, passwords and 2FA codes (a live code generator), and every field is encrypted individually.
• Everything is encrypted with AES-256 on the device, behind a passcode separate from your iPhone passcode. There is no account and no server, and the vault works offline.
• The vault hides its content from screenshots and the app switcher.

Keep the offline paper or metal copy as your primary backup either way. And remember the vault's own rule: if you forget the Lockboxy passcode and never created a Recovery Key (Premium), the content cannot be recovered by anyone. More details are in the FAQ.