Wallet types and recovery design

Choose for the job, not for the reputation

A software wallet on a phone or browser is convenient and lives in the same environment as your messages, downloads, and links. That makes it well suited to learning and to frequent interaction with applications, and poorly suited to holding a large balance for years.

A hardware wallet keeps signing on a separate device, so malware on the computer cannot extract the key. This is a meaningful improvement, and it is narrower than people assume: it protects the key, not the decision. If you approve a malicious transaction on the device's screen, the hardware signs it faithfully.

Multisignature distributes authority so that several keys must agree. It removes the single point of failure and adds a coordination burden, which is why it suits shared funds and long-term holdings more than daily use. A custodial account outsources all of this to a company, which is a legitimate answer when the alternative is a fragile setup you cannot operate.

Design for ordinary life, not only for attackers

Backup plans usually fail in unremarkable ways. Paper degrades, gets damp, or is thrown out during a move. A safe deposit box becomes inaccessible. A device dies and the owner discovers the backup was never tested. A carefully hidden phrase is genuinely hidden—from its owner, five years later.

So a backup has to survive two opposite threats at once: someone finding it, and you failing to find it. Optimising hard for one usually worsens the other. Two durable offline copies in separate controlled locations is a reasonable default for most people because it tolerates a single accident without creating many opportunities for discovery.

Record the operational details separately from the secret. Which wallet software created it, how many words, whether a passphrase is used, which networks are involved. A recovery phrase with no context can be nearly as unusable as no phrase at all, and this information is not sensitive on its own.

Extra mechanisms add recovery failure modes

Every additional protection is also an additional thing that can go wrong under stress. A passphrase on top of a recovery phrase defeats anyone who finds the words—and permanently destroys access if you misremember it. Multisignature removes a single point of failure and creates several new ones, each of which has to be documented and maintained.

This is not an argument for the simplest possible setup. It is an argument for matching complexity to what you can actually operate, including on your worst day, and for testing every mechanism you add before it protects anything valuable.

Rehearse before relying

Test recovery with an empty wallet or a verified spare device. Confirm that the words are correct, the order is right, the wallet type matches, and any passphrase works. A backup that has never been restored is an assumption, not a plan.

Never rehearse while screen sharing, while following instructions from someone who contacted you, or on a device you are unsure about. And once the process is proven, stop handling the material. Repeatedly opening and re-reading a backup creates exposure without adding safety.

• Separate daily activity from long-term value.
• Keep at least two offline copies in separate controlled locations.
• Store wallet type and instructions apart from the secret itself.
• Restore once from the backup before it matters.
• Plan for a trusted person's access without granting it casually today.