There Is No Password Reset for a Crypto Wallet

By NorwegianSpark Editorial · Published August 8, 2026 — written with AI assistance and reviewed by the NorwegianSpark SA editorial team.

Every other account in your life has a way back in. Forget a banking password and you answer some questions. Get defrauded on a card and there is a chargeback process.

A self-custodied crypto wallet has none of that. The keys are the asset. Lose them and nothing can be done; let someone else obtain them and the transaction is final. That is the intended design, and it means the security burden sits entirely on you.

The seed phrase is the wallet

The twelve or twenty-four words generated at setup are not a password protecting the wallet. They *are* the wallet — anyone holding them can recreate it anywhere, and no other information is required.

Which gives a small number of non-negotiable rules:

• Never type it into anything unless you are deliberately restoring a wallet. No legitimate app, support agent or airdrop needs it. There is no exception, and every request is a theft attempt.
• Never photograph it or store it as text. Not in notes, not in a password manager's free-text field, not in cloud storage, not in email. A photo syncs to the cloud automatically.
• Write it on paper, or stamp it into metal. Paper is vulnerable to fire and water; metal backup plates exist for exactly this and are inexpensive relative to what they protect.
• Store copies in more than one physical place. A single copy is one house fire from total loss. Two or three, geographically separated, each individually secure.
• Never enter it on a website. Ever. This bears repeating because it is how most large individual losses happen.

Hardware wallets, and what they actually do

A hardware wallet keeps your keys on a dedicated device that never exposes them to your computer. Transactions are signed on the device, and you approve each one on its own screen.

The critical property is that a compromised computer cannot silently move funds, because signing requires physical confirmation on separate hardware.

What it does not do is protect you from approving a malicious transaction. If you are tricked into confirming a transfer, the hardware wallet dutifully signs it — this is why reading what you are approving on the device screen, rather than trusting what the computer displays, is the entire point.

Buy directly from the manufacturer. Devices bought second-hand or from marketplace sellers have been tampered with, sometimes arriving with a pre-generated seed phrase the seller already holds.

Where losses actually come from

Sophisticated cryptographic attacks are not the problem. The dominant causes are duller:

• Phishing sites imitating a wallet or exchange, harvesting seed phrases
• Fake support in chat groups and social media, messaging first and asking you to "validate" your wallet
• Malicious approvals — connecting to a site and granting an unlimited spending permission that is drained later, sometimes months on
• Clipboard malware that swaps a pasted destination address for the attacker's
• Simple loss — a forgotten phrase, a discarded drive, a device with no backup

Two habits address most of it: verify the first and last characters of any destination address on the device screen after pasting, and periodically review and revoke token spending approvals you no longer need.

The case for not self-custodying

Self-custody is presented as obviously correct. For many people it is not, and the honest advice depends on the amount.

A regulated custodian holds keys for you, with account recovery, support and — depending on jurisdiction — some regulatory oversight. You trade the risk of your own mistake for the risk of the institution failing or restricting access.

For a small holding someone checks twice a year, a reputable custodian is often the lower total risk, because the realistic failure mode is not exchange collapse but the owner losing their own phrase. For larger amounts, or for anyone who will genuinely maintain the discipline, self-custody removes the counterparty risk.

Splitting is reasonable: a custodial account for the amount you actively use, self-custody with a hardware wallet for the rest.

Test the recovery before you need it

Set up the wallet, write down the phrase, then wipe the device and restore from that written phrase with a small amount in it.

It takes twenty minutes and it is the only way to know your backup works. A phrase that was written down wrong, or is missing a word, looks exactly like a correct one right up until the moment it matters.