Arqma seed phrase security

What is a seed phrase?

A seed phrase is a human-readable encoding of the secret key that controls your wallet. Arqma uses 25 words. Anyone in possession of those words can rebuild your wallet on any computer in the world and move every coin in it. There is no password reset. There is no support line. There is no chargeback.

Why the wallet shows it once

Your wallet generates the phrase locally, on your device. It is never sent to a server. It is shown to you once so that you — not Arqma, not a cloud, not a backup service — are responsible for it. This is the deliberate design of a non-custodial wallet. The cost of self-sovereignty is self-responsibility.

How to store it

The minimum: pen and paper

Write the 25 words in order, by hand, on paper. Number each one. Use a pen that won’t fade. Store the paper in a fire-safe location — a home safe rated for documents, or a bank safety deposit box.

Better: two copies, two locations

One copy at home, one copy off-site. If your house burns down, you still have a backup. If a thief takes your safe, you still have a backup.

Best: metal storage

Stamped or engraved steel plates survive fire, flood, and decades of neglect. Brands like Cryptosteel, Billfodl, and SafePal work; or punch your own with letter stamps and a piece of stainless plate. Cost: $20 to $100 per backup. Cheap insurance.

Threats — what you’re defending against

Phishing

A fake wallet site, support agent, or chat bot asks you to “verify” or “re-import” your seed. A real wallet never asks for the seed after creation. If anything online asks for it, it is a scam.

Malware and screenshots

Clipboard hijackers, screen recorders, and infostealers harvest seed phrases the moment they touch a device. Never type your seed into a search bar. Never screenshot it. Never store it in Notes, Google Docs, iCloud, or Dropbox — even encrypted, those services have been breached repeatedly.

Cloud sync

A photo of your seed on your phone is a photo on Google Photos, iCloud Photos, OneDrive, and every device you’ve ever signed into. Treat phone cameras as broadcast.

Physical theft

A burglar who finds “Bitcoin recovery words” on your bedside table walks away with everything. Keep the storage location non-obvious and locked.

The forgetful you

The most common failure isn’t a hacker — it’s the user who moved house, threw out a drawer of papers, and lost the only copy. Two locations. Tested. Reviewed yearly.

Common mistakes

• Writing 24 words instead of 25. Arqma uses 25. Miscounting voids the backup.
• Misspelling a word. Use the official BIP-style word list as a reference when writing.
• Wrong order. Order matters. Restoring out of order produces a different wallet.
• Skipping the test restore. A backup you haven’t restored isn’t a backup.
• Telling a partner “just in case.” Trust is fragile; cold storage isn’t. If you must share, split the phrase across multiple sealed envelopes.

If you think your seed is compromised

Act immediately. Create a fresh wallet on a clean device. Move every coin from the compromised wallet to the new one. Then destroy the old paper backup. A “maybe leaked” seed is a leaked seed — speed matters more than certainty.