Test Your Wallet Backup: A Self-Audit of Your Seed Phrase

Testing your wallet backup means proving, before you need it, that the seed phrase you wrote down restores your wallet, that no stray copies of it exist and that a thief or an heir would find exactly what you expect. The cheapest time to find a weakness in your wallet setup is before anyone else does, so treat it as cracking your own wallet: a structured self-audit that checks the backup, looks for copies where they shouldn’t be, measures how much a partial leak would give away and shows what a thief would get from your devices. Everything below applies only to wallets you own. Trying any of it on someone else’s wallet is an attempt to take their money, whatever the tool.

The Six Tests at a Glance

Does Your Backup Actually Restore?

Hardware wallets can check a backup without exposing it. On a Trezor Safe 5, for example, Check backup in Trezor Suite has you enter the words on the device, which compares them with the backup it holds; Trezor recommends running it before you wipe the device and before every firmware update (Trezor guide). Ledger’s Recovery Check app does the same on Ledger devices: you type the phrase on the device and it reports whether it matches (app source). A software wallet has no such check. While it is still empty, delete it from the app and restore it from the paper: if the same first address appears, the words are right.

If you use a BIP39 passphrase, test it separately. BIP39 is designed so that every passphrase produces a valid wallet, which means a typo doesn’t cause an error: it opens a different, empty wallet. Open the passphrase wallet and confirm that it shows the first receiving address you expect.

Then look at the paper itself. Every word should be legible, numbered and spelled as in the BIP39 list, where the first four letters identify each word. If a word is doubtful, how to fix seed phrase errors explains how the checksum narrows it down.

What Would a Partial Leak Give Away?

A complete 12-word phrase from a proper random generator carries 128 bits of entropy, far beyond any guessing (why a seed phrase can’t be guessed). Part of a phrase is a different matter. Recovery software tries every candidate against an address you know, and the checksum discards most of them without any further work:

Each candidate that passes still needs 2,048 rounds of PBKDF2-HMAC-SHA512 to become a seed. In our test, one core of a current laptop did that in about half a millisecond, so even 30 million candidates is a matter of hours. Open-source tools such as BTCRecover exist precisely to recover your own phrase when words are missing or mistyped. The lesson: scrambling the order of 12 words, or storing most of a phrase in one place, protects far less than it seems.

Is Your Phrase in Photos, Cloud Storage or Notes?

Malware looks for phrases where people leave them. Kaspersky found apps in Google Play and the App Store carrying SparkCat, which read photo galleries with text recognition to find wallet recovery phrases, and advised against keeping such screenshots (Securelist). Microsoft reports that the Lumma infostealer searches computers for wallet files, browser extensions and local keys (Microsoft Security).

Check the places they would: your photo library and screenshots, cloud drives and photo sync, notes apps, email drafts, chat “saved messages”, password managers, and old phones and computers. If a copy was ever synced or shared, deleting it doesn’t undo the exposure: create a new wallet with a new phrase and move the funds.

What Would a Thief Get From Your Devices?

• Hardware wallet. A PIN guards the device, and repeated wrong guesses erase it: three attempts on a Ledger, 16 on most Trezor models and 10 on the Trezor Safe 7 (Ledger, Trezor). That makes the written backup the real target, so it should never be stored with the device (where to keep a seed phrase).
• Phone and computer. Check the screen lock, full-disk encryption and the wallet app’s own PIN, and that the wallet locks itself after a short time.
• Encrypted wallet files. A copied wallet file can be attacked offline at full speed. Password-cracking tools such as hashcat list ready-made modes for Bitcoin Core’s wallet.dat, Electrum, MetaMask and Ethereum keystore files, so the password is the only barrier. Rather than testing a weak password, replace it with a long random one, such as six random words from a diceware list (about 77 bits).

Would You Spot a Phishing Request?

You don’t need a phishing simulator. Check that you reach your wallet and exchange through bookmarks, that your hardware wallet’s screen shows the same receiving address as your computer, and that old token approvals have been revoked. Then settle the rule in advance: nobody gets the phrase, whoever asks and however urgent it sounds. The guide to protecting a wallet from phishing covers the common tricks.

Could Someone You Trust Restore It Without You?

Ask whether a person you trust could restore the wallet without you. Would they find the backup, know which wallet app and which coins it holds, and know that a passphrase exists and where it is kept? Write those instructions down and store them apart from the phrase, without the secret itself. A backup that only you can interpret is lost on the day you can’t.

Rules for a Safe Self-Audit

• Never type a real phrase into a chat, including with support staff or an AI assistant.
• Try any tool with the public BIP39 test phrase first, and run it offline.
• Download recovery tools only from their official repository, since a lookalike copy can carry malware.
• Write down what you found and what you changed, without recording any secret.

Frequently Asked Questions

Is it legal to test my own wallet like this?

Testing your own backup, devices and passwords is ordinary security practice. Using the same tools against a wallet that isn’t yours, including a phrase you found or bought, is an attempt to access someone else’s funds.

Can someone brute-force my 12-word seed phrase?

Not if the words came from a proper random generator: 128 bits of entropy is out of reach. The real risks are partial leaks, phrases chosen by people instead of generators, and weak passwords on wallet files.

How often should I repeat the audit?

Run the backup check before firmware updates and before wiping a device, as Trezor recommends, and repeat the whole audit whenever something changes: a new phone, a new storage place or a new passphrase.