Before you begin

One key and a passphrase

Simpler to operate, but forgetting or losing the passphrase can permanently prevent recovery. A compromised device or poorly stored backup can still put funds at risk.

• Keep the passphrase on paper apart from the plate. If someone finds both the seed backup and its passphrase, they may be able to access your funds. Keep them separately and test restoration.
• One device, one maker. A flawed or tampered device can still fail you.
• Words and passphrase go into the device itself during recovery, nowhere else. No hardware company will ever ask for your seed phrase.
• Check the receiving address on the device screen, not only on the computer screen, before you accept coins.
• The watch-only wallet can watch, it cannot spend alone. Spending needs the device and the passphrase together.

Three keys (2-of-3 multisig)

Separates signing keys across devices or locations, but makes setup and recovery more complicated. Securely preserve the wallet configuration/descriptor and test the recovery procedure.

• Most steps to get right. A missed step in any key can lock the wallet later.
• Lose two keys and the map, and the funds are locked. Keep three plates in three places, and keep the encrypted map apart from any single plate.
• Two signing keys meet the 2-of-3 threshold, but recovery also requires the correct wallet configuration. Keep verified copies of the descriptor and recovery instructions in separate safe locations, and rehearse reconstruction and spending before funding the wallet.
• No passphrase on the 2-of-3. The protection comes from three keys in three places, not from a passphrase.
• Practice spend first, and rehearse on testnet if you have not done this before. Savings do not move until the practice spend works.
• Shut down fully between keys. A key left in memory is a key at risk.