The wallet configuration ladder

Rung 1 of 4

Single-signature wallet

One key, one seed, one backup — kept on a hardware device you control. The simplest self-custody that isn’t negligent.

One hardware wallet holds a single seed. The device signs transactions; you confirm on its own screen and buttons. Your seed is backed up once or twice on metal, stored somewhere secure. That’s the whole setup — and for most people starting out, it’s the right one. This is the simplest setup that genuinely protects your coins, and there is a single mental model to learn.

What one key actually is — and what that makes possible

Your Bitcoin is not in the device. The words on your backup are a compact way of writing down one very large secret number, and everything else — every address you receive at, every signature that spends — is calculated from that number by a published recipe that every wallet implements the same way. The device is a calculator that keeps the number behind glass. Almost everything true about this rung follows from that one fact.

• It is why losing the device is not losing the coins. Buy another one — any maker, any model that supports the standard — type the words in, and the same wallet reappears with the same history and the same balance. Nothing was stored on the device that could not be recreated. The uncomfortable half of the same fact: anyone else who types those words in gets the same wallet, and there is nothing to stop them.
• It is why the backup is the setup. The PIN protects the device against whoever is holding it, and that is all it does. It does not protect the coins, because the coins never depended on the device. This is the rung’s whole security model in one line: keep the words, and never let anyone else see them.
• The device signs; it never hands the key over. Your computer builds the payment, the device signs it internally, and what comes back is a signature — the key itself never travels. That is what “cold” actually means, and it is why the device’s own screen matters: it is the one display that malware on your computer cannot rewrite, so the address you confirm there is the address that gets paid.
• “One key” means one secret, not one address. A single seed generates an endless sequence of addresses, and a good wallet hands you a fresh one every time you get paid. That is a privacy habit rather than extra security — all of them spend with the same key — but it is why you never need to reuse one to “keep things simple.”
• Nothing anywhere is checking your backup for you. No service knows whether the words you wrote are correct, complete, or still readable, and a wrong backup looks exactly like a right one until the day you need it. Proving it is its own lesson later in the course — Testing a backup, in 103 · Private key creation.
• What people try instead of metal, and why we don’t. Paper works until water or fire reaches it. Photos and password managers put your entire wallet on a machine that talks to the internet — the most common way a seed leaves a house. Memorising the words, or splitting the list by hand across two places, each fails in its own well-documented way (Shamir, the designed version of the splitting idea, gets its own treatment later in this level). The full tour of the clever schemes and why each one loses is in the backup lesson — Backing up a seed phrase, in 103 · Private key creation. Metal, kept somewhere fire and water don’t reach, is the boring answer that keeps working.

What it gains you

• Simplicity. One device, one seed, one backup. Little to get wrong, little to forget.
• Cost. A capable device runs $59–$249. No coordination software, no service fees.
• Fast recovery. One seed phrase into one wallet and you’re back — no extra files or coordination to piece together.
• Universal support. Every wallet app and every guide supports it.

What it costs you

• No second layer. If someone gets the seed, they can spend the coins. Nothing else stands in the way.
• Coercion exposure. With one seed, an attacker who forces you to hand it over sees the whole balance. A passphrase — the next rung — is the usual answer to that specific worry.

Who should use it

Holders whose stack is modest relative to their net worth; anyone in their first year of self-custody; anyone whose main concern is exchange risk rather than a targeted physical attacker. The near-universal pattern across custody experts is small balance on single-sig for convenience; large balance on multisig for security. Leaping straight to a five-key setup adds complexity you’re not yet equipped to manage — and at this scale that complexity is a larger threat than the ones it defends against.

When to climb

If losing this Bitcoin would genuinely hurt, our position is that you climb — this rung is a single point of failure, and one thing failing should never be able to take everything. A passphrase is the next rung and the smallest step that fixes it: a second secret that has to be right as well, which also answers a found or photographed seed. Multisig removes the single point of failure at the hardware level, so no one device or maker can ever be enough. And if you want a professional safety net for your heirs, collaborative custody is rung 4. Learning with a small amount? Staying here is genuinely fine.

Rung 2 of 4

Single-signature wallet + passphrase

Add a secret “25th word.” The seed alone opens a decoy; seed + passphrase opens the real wallet.

Exactly rung 1, plus a passphrase you set when you set up the wallet. The seed phrase on its own opens one wallet — a decoy. The seed phrase plus the passphrase opens a different, hidden wallet — your real one. The passphrase is sometimes called the “25th word.” Watch a passphrase open a different wallet →

How it actually works — and what that makes possible

A passphrase is not stored anywhere. Not on the device, not in your backup, not in the wallet file. It is an ingredient: your seed words and your passphrase go into one standard calculation, and a wallet comes out. Change a single character and the calculation produces a different wallet — not an error, a different wallet. Almost everything else about a passphrase follows from that one fact.

• It is why there is no “wrong passphrase” message. Nothing has a copy of the right one to compare yours against. Every passphrase is valid; they simply open different wallets. Put a capital in the wrong place and your device shows you a real, empty, perfectly ordinary wallet and says nothing is amiss.
• It is why it cannot be reset, rate-limited, or recovered. A password lives inside a system that can lock someone out after three wrong tries. This is arithmetic. Anyone holding your seed backup runs that same calculation on their own machine, as often as they like, with nobody to stop them.
• Any string at all is a passphrase. Letters, digits, punctuation, spaces — any length your device accepts. Nothing is rejected and no format is required, which is a freedom and a hazard in the same breath, because a typo is also a perfectly valid passphrase.
• One seed can open any number of wallets. A different passphrase gives you a different wallet from the very same words, and you are never choosing between them — that is exactly what makes the decoy above work. The “no passphrase” wallet is simply one more of them: an empty passphrase is what your seed opens on its own.
• Most devices will show you a wallet fingerprint — a short code identifying the wallet you have just opened. It is the only feedback the design allows, and it is genuinely useful: the same passphrase always produces the same fingerprint, so a code that does not match the one you noted means you mistyped something.

What it gains you

• Protection against a found seed. A metal backup someone discovers, a photographed seed, a seed pulled off a compromised device — none of them alone can spend your real funds.
• Plausible deniability. The decoy wallet doesn’t look like a decoy. Under coercion you can hand over the seed and the (small) decoy wallet without revealing the real one.
• Cheap to add. You already own the device — no second purchase, no coordination software, no fees. The cost is the ten minutes it takes to roll one properly, not money.

What it costs you

• A brand-new single point of failure. Lose or forget the passphrase and the coins are gone — even though the seed is safe.
• A passphrase is not a password. It can’t be reset, rate-limited, or recovered. A weak or guessable one is almost as bad as none.
• Deniability is a belief, not a guarantee. There are documented cases where a decoy didn’t convince an attacker and the victim was harmed anyway.

How to actually build one

A passphrase is the one part of this setup with no safety net anywhere in it. It cannot be reset, nothing rate-limits a guess, and there is no such thing as a “wrong passphrase” error — mistype it and a different wallet opens, empty and perfectly valid, with nothing to tell you which one you are looking at. Everything below follows from that.

• Generate it. Don’t invent it. This is the whole thing, and it is the step almost everyone skips. A passphrase you thought of is worth a small fraction of the strength it feels like, because the part that makes it memorable — real words in a sensible order, a name, a date, a lyric, a substitution you thought was clever — is the first thing a guessing computer tries. Roll it with dice, off the same printed word table the seed procedure uses — the dice method is taught step by step later in the course, in Generating a seed, 103 · Private key creation, and the worksheet on the roll-your-own-seed page walks the short passphrase version.
• Six words is the floor. Eight if it is protecting savings. That is 66 bits and 88 bits respectively — 30 throws for the first, 40 for the second — ten minutes with dice you already have out, taking fewer words than a seed needs.
• Length, not symbols. The maths that turns a passphrase into a wallet is deliberately quick, so someone holding your seed backup can test guesses offline, on their own hardware, with nothing to slow them down. Swapping letters for punctuation barely slows a guessing computer and costs you accuracy when you copy it; one more word off the table multiplies the guesswork two-thousand-fold. The full arithmetic, for anyone who wants it, is on the roll-your-own-seed worksheet page.
• Plain ASCII, and no space at either end. Wallets genuinely disagree about how they treat accented letters, emoji and other non-ASCII characters, so a passphrase built from them can open your wallet on one make of device and not on another. A leading or trailing space is worse: invisible on paper, and part of the secret. Capitals and the spaces between words count too — write it down exactly as it is.
• Check the length your devices actually accept. Makers set different limits, and a passphrase longer than some other wallet’s maximum is a passphrase you cannot recover on that wallet. Find the limit for every device you might restore on, not just the one you are typing it into today.
• Prove it somewhere else before you fund it. The point of a passphrase is that your words plus your passphrase rebuild the wallet anywhere. So prove it on a second hardware device — a different maker is the strongest version of the test — confirm the addresses match, and only then move coins. (Never restore a live seed into a wallet app on a phone or computer to check it: that types the words into an internet-connected machine, the one thing this guide asks you never to do.) Testing a backup is its own lesson later in the course — Testing a backup, in 103 · Private key creation — and a passphrase doubles what there is to get wrong.
• Write down the wallet fingerprint too. It is the one check the design gives you, and it costs nothing: note the code your device shows for the passphrase wallet, alongside the passphrase itself. Next time you restore, a fingerprint that matches means you typed it correctly — which is otherwise a thing you simply cannot know.

And then back it up as carefully as the seed, kept somewhere the seed is not — which is the failure directly above, and the one that actually costs people their Bitcoin.

Who should use it

Holders who want a second cryptographic layer without taking on the operational weight of multisig — especially when your realistic worry is “someone finds my seed backup” rather than a targeted attacker. Less useful if your real concern is sophisticated coercion, where the deniability argument gets shaky.

When to climb

If your holdings grow to where a single seed backup — decoy or not — feels like too much resting on one thing, the answer is to remove the single point of failure entirely with multisig (rung 3). If you want split backups without full multisig, look at the optional Shamir backup.

Rung 3 of 4

Multi-signature wallet

Several keys, and it takes more than one to sign — commonly 2-of-3. No single key, lost or stolen, can move or lose your coins.

A wallet made of several keys where more than one is needed to sign — most commonly 2-of-3: three keys, any two together can spend. Each key ideally lives on its own hardware device, from a different manufacturer, all held by you. The keys live in different places (a common split: home, a bank safe-deposit box, and a trusted family member or second property). This is the first rung that genuinely removes single points of failure for personal-scale holdings. Tap through a live 2-of-3 wallet →

How several keys become one wallet — and what that makes possible

A multisig wallet is not a device and it is not a key. It is a rule — “these three specific keys exist, and any two of them together may spend” — written down in one line called a wallet descriptor. Each device knows its own key and nothing about the others. The rule is what ties them into a single wallet, and it lives outside all of them.

• It is why the descriptor is as necessary as the keys, and not secret. It holds no private keys — it cannot spend anything, and someone who steals it can only watch. But without it, two of your three keys rebuild nothing: the software has no way to know what wallet they belong to. Rung 1 had one thing to keep safe. This rung has that plus one thing to keep findable, and they fail in opposite directions.
• Nothing ever assembles the keys in one place. A part-signed transaction is passed from device to device — each one adds its signature and passes it on, and no computer, coordinator or device ever holds enough to spend by itself. That is the actual defence, and it is why the keys can sit in three different buildings without the setup being any harder to reason about.
• The two numbers do different jobs, and confusing them is the classic mistake. In 2-of-3, the 2 is how many must agree — it decides what a thief needs. The 3 is how many exist — it decides how many you can lose. Raise the first and you are harder to rob; raise the second and you are harder to lock out. They pull against each other, which is why there is no configuration that is simply “more secure.”
• What that makes possible, including the shapes we advise against. You can build 2-of-2 — and it is strictly worse than one key, because now either device failing locks you out permanently. You can build 3-of-5, which is the same technology with more to manage (below). You can hold all three keys in one house, which spends the money and keeps the risk. You can hand one key to a family member, which is a real design and turns a technical setup into a conversation you have to be willing to have. And you can buy three devices from one maker — the arrangement that looks finished and defends against nothing, because one flaw in one firmware reaches all three at once.
• You are not locked in to one company’s software. The descriptor is a standard, so a multisig created in one coordinator can be rebuilt in another with the same keys and the same file. Check that before you fund it, not after: a setup you can only reconstruct inside one vendor’s app has quietly reintroduced the single point of failure you paid three devices to remove.

What it gains you

• No single point of failure. Losing any one key, or one location, or trusting any one vendor, no longer risks your coins.
• Full sovereignty. No company is involved. Nothing to freeze, fail, or subpoena.
• Recoverable. Lose one key and you simply sign with the other two, move funds to a fresh 2-of-3, and you’re whole again.

What it costs you

• Complexity — the top cause of lost Bitcoin. You now manage six sensitive items (three keys, three seed backups), plus the wallet descriptor and coordinator software — the desktop app that assembles the keys into one wallet.
• Geographic coordination. To spend you need to reach two of three locations — manageable normally, hard during a crisis.
• Harder inheritance. “Just give them the seed” no longer works (see below).
• Arduous re-keying. A lost key means sweeping everything to a fresh setup and paying on-chain fees.

Beyond 2-of-3: the 3-of-5 variant

You’ll hear about 3-of-5 — five keys, any three sign. It’s the same technology as 2-of-3, just with more keys, so there’s nothing new to learn here. What changes is the trade-off: a 3-of-5 survives losing two keys (a 2-of-3 can’t), at the cost of six-to-eight secure locations and much heavier re-keying. For almost everyone that’s the wrong trade — the extra protection is small, the extra self-inflicted loss risk is large. 3-of-5 earns its keep only for a genuine multi-party or multi-jurisdiction need (family offices, distributed trustees, institutional custody with explicit inheritance planning). If that’s not you, stay at 2-of-3.

Who should use it

Holders with material Bitcoin exposure, the discipline to manage six distributed items, and a real plan for how the setup gets recovered if you’re unavailable. Everyone agrees it’s overkill for small balances, and a mistake to adopt before you’re confident with single-sig.

When to climb

If managing the whole thing yourself — and especially handing it to your heirs — feels like too much, collaborative custody (rung 4) keeps the same multisig security while a partner carries the complexity. Adding more keys (3-of-5, above) is rarely the right move for an individual.

Rung 4 of 4

Collaborative multi-signature wallet

You hold two keys; a service holds the third — for signing help and inheritance, not custody.

The same 2-of-3 setup as rung 3 — but one of the three keys is held by a collaborative-custody company (Unchained, Nunchuk, AnchorWatch, The Bitcoin Adviser, and others). They hold one key and help coordinate spending, recovery, and inheritance. They cannot move your funds — they only hold one of three, and you hold the other two. You keep unilateral control. What you outsource is complexity, not custody.

What the third key can and cannot do

The mechanism is rung 3’s, unchanged — three keys, a rule saying any two may spend, and a descriptor that ties them together. One thing is different: one of those keys belongs to a company. Everything people worry about here, and everything that actually goes wrong here, comes out of the arithmetic of which key that is.

• They hold one of three, so they can never spend without you. Not with a court order, not if they are hacked, not if a rogue employee decides to. One key is not a quorum — never enough keys to meet the wallet’s spending threshold. This is a structural fact about the wallet rather than a promise in their terms of service, which is the entire reason this arrangement is on a ladder about self-custody at all.
• And they can never stop you either — provided you can rebuild the wallet without them. You hold two of three, which is already enough to sign. The only thing standing between you and your coins if the company disappears is knowing the rule: the descriptor. If you hold that and can load it into software they don’t control, their disappearance is an inconvenience. If you don’t, it is a catastrophe with a friendly interface.
• Which is why “sovereign recovery” is a mechanism question, not a marketing one. It has exactly one test, below, and it is the whole difference between a partner and a dependency.
• The arithmetic that catches people out: your two keys are a quorum on their own. In rung 3 you hold three of three, so one maker covering two of them is a risk. Here you hold two of three — so if both of yours are the same make, or live in the same building, a single failure reaches a spending majority and the company’s key never comes into it. The safety net is on the other side of the problem.
• What else is possible here, and where the line is. You can let the service keep the descriptor for you, which is convenient right up to the day you need it from them. You can pick a service whose key can only be used inside their own app, which quietly makes them load-bearing. And you can find arrangements where the company holds two of three — that is not this rung and not collaborative custody; it is custody with extra steps, and the moment they hold a quorum your coins are back on somebody else’s balance sheet.

What it gains you

• Much less to manage. Typically five items instead of seven — for many holders, the difference between “manageable” and “overwhelming.”
• Convenient spending. Sign with one key, ask the partner to co-sign; your second key stays untouched in its secure spot.
• A safety net. Lose a key and the partner can help you recover to a fresh setup — they can only help when asked, never spend alone.
• Inheritance gets dramatically simpler. Your heirs contact the partner, prove who they are, and get help — no PSBT wrangling.

What it costs you

• A partner is now in the loop. You’ve disclosed that you hold Bitcoin, and usually a rough amount — a privacy trade-off.
• Counterparty longevity. What if they go out of business? (See the sovereign-recovery note.)
• Ongoing cost. Free tiers exist, but assisted service runs hundreds to thousands per year for larger balances.

Who should use it

Holders with substantial exposure who honestly recognise that they themselves are their own biggest risk — and who’d rather outsource complexity than build operational discipline from scratch. Especially attractive when your inheritance situation is non-trivial (substantial estate, multiple heirs, complex family), where the partner’s standing process adds real value.

When to climb

For nearly everyone, this is the practical ceiling. From here the work isn’t “more keys” — it’s a tiered portfolio (a hot wallet for spending, single-sig for near-term reserves, multisig for deep cold storage) and a rock-solid inheritance plan. Adding keys beyond this adds complexity, not safety.