How the passphrase changes the seed
BIP39 derives the seed with PBKDF2-HMAC-SHA512, using the mnemonic as the password and the text "mnemonic" + passphrase as the salt, with 2048 iterations. With no passphrase the salt is just "mnemonic". Any change to the passphrase changes the salt, and therefore the entire 512-bit seed.
It is not really a word
“25th word” is a popular name, not part of the standard. The passphrase can be empty, a sentence, or a long random string. It is not taken from the word list and has no checksum, so no tool can tell you whether it is “correct”.
Case, spaces and Unicode
- Case matters:
TREZOR≠trezor. - Spaces matter, including leading and trailing spaces.
- Both mnemonic and passphrase are normalized with Unicode NFKD, so characters such as “é” give the same result whether typed as one character or as “e” plus an accent.
Mnemonic vs passphrase
| Mnemonic | Passphrase | |
|---|---|---|
| Required | Yes | No (empty by default) |
| Format | 12–24 words from the list | Any text |
| Error detection | Checksum | None |
| If lost | Funds unrecoverable | Funds unrecoverable |
Backing up a passphrase
A passphrase protects against someone who finds your written mnemonic — but only if it is stored somewhere else. Losing it has the same result as losing the words. Record it exactly, including case and spaces, and test a restore with a small amount before relying on it.