Skip to Content
DocumentationDesktop ApplicationSetup ScreensHidden Wallets

Hidden Wallets (Advanced)

“Passphrase creates a separate hidden wallet from the same seed. If enabled, you MUST remember it — a wrong passphrase opens a different empty wallet, not an error.”

— card 3 of 3, shown after setup

Hidden wallets card with passphrase toggle

This is the only card in the wizard you cannot skip. It carries a live toggle — Enable passphrase protection — and you have to make a call before setup finishes. Either answer is fine, and both are reversible in Settings. Read this page before deciding.

What a passphrase actually does

Your recovery phrase alone produces one wallet. Recovery phrase plus a passphrase produces a completely different wallet — different addresses, different keys, no on-chain link to the first.

The passphrase is not a password guarding a wallet. It is an input to key derivation. That distinction is the entire reason this card exists, because it produces one behavior that surprises everyone:

Every passphrase is valid. There is no “wrong passphrase” error. Type hunter2 and you get one wallet. Type Hunter2 and you get a different, empty wallet. Type a typo and you get a third, also empty. The device cannot tell you that you made a mistake, because from its perspective you didn’t — you asked for a different wallet and it derived one.

If you fund a hidden wallet and then can’t reproduce the passphrase exactly — same characters, same case, same spaces — those funds are gone. Your recovery phrase alone will not bring them back.

Why it exists

It closes the physical gap. KeepKey is deliberately open — no secure element, no proprietary black box, firmware anyone can audit and reproduce. That openness is the security model, and we’re direct about its consequence: a sufficiently determined attacker with physical possession of the device and a lab has paths a sealed chip would complicate.

A passphrase makes that irrelevant. The secret that unlocks the hidden wallet is not on the device at all. It’s in your head. Extract everything the hardware contains and you get the base wallet — whatever you chose to leave there — and no indication that anything else exists.

It gives you plausible deniability. Under coercion, you can unlock the device normally. The base wallet opens. It holds whatever you put there. There is no screen, no flag, and no on-device artifact that reveals a hidden wallet exists.

How to decide, right now

Leave it off if: this is your first hardware wallet, or you’re not confident you can reproduce a string exactly, years from now, under pressure. Off is a completely reasonable default — your seed and PIN are already a strong setup. You can turn it on later, once you’re comfortable.

Turn it on if: you understand the “every passphrase is valid” behavior, you have a plan for remembering the passphrase, and you specifically want the physical-coercion protection.

“You can turn this on or off anytime in Settings.” — the app’s own hint, and it’s true. Enabling it does not create a hidden wallet by itself; it means you’ll be prompted for a passphrase when you unlock. Nothing is lost by choosing either way today.

If you enable it

Choosing one:

  • Long, and memorable to you. A phrase beats a random string you’ll never recall.
  • Never reused from another account.
  • Careful with characters you might mistype later — trailing spaces, smart quotes pasted from a document, ambiguous case.

Backing it up:

  • Do not store it with your recovery phrase. Together in one place they are exactly equivalent to no passphrase at all.
  • Memorize it, or store it in a genuinely separate location from the seed backup.
  • Test it: enable, enter it, note an address, unplug, reconnect, enter it again, confirm the same address. Do this before sending funds.

Living with it:

  • Fund the base wallet with a small, plausible amount. An empty base wallet undermines the deniability story.
  • Reconnecting the device requires re-entering the passphrase every time.
Last updated on
App Connections Are OffRecovery Phrase