The twelve-word phrase has a problem that almost no one says out loud: whoever reads it, owns everything. The paper in the safe, the plate engraved behind the picture, the sheet forgotten in a drawer — anyone who sets eyes on those twelve words is, from that moment on, the owner of the money. The passphrase exists because of this, and it charges dearly for the service.
The mechanism is almost disappointingly simple. In Lesson 1, the phrase entered the PBKDF2 function along with a fixed salt, the word mnemonic. The passphrase is just a text you add there. Any text. A word, a sentence, a verse, a sequence of symbols. The result is a completely different seed and, therefore, an entirely new wallet, with no relation to the first.
Notice what this simplicity implies. There is no wrong passphrase. There is no verification, no checksum, no warning. Each different text opens a legitimate, empty, and equally valid wallet — and there are billions of them per seed. Typing dog instead of Dog does not produce an error message; it produces a zero balance, which is the scariest thing a wallet screen can show.
On the other hand, what it protects, it protects very well. A thief who finds the twelve words finds a real wallet, with a real balance, and has no way of knowing that there is another one behind them. Many people use this on purpose: they leave a small amount in the twelve-word wallet and keep the rest in the hidden wallet. The bait is meant to be found.
It's worth being honest about the limits of this maneuver. Against someone who stole a paper, it works. Against someone who is in front of you demanding the money, it depends on them believing you — and if they don't believe you, the situation worsens instead of improving. Security against coercion is not a cryptography problem, and no technical feature solves it alone.
There is a second limit, more common and more forgotten. The passphrase protects the paper; it does not protect the device where you type it. On a computer with spyware, the phrase and the passphrase go out together the same way, and the hidden wallet disappears as easily as the other. That's why it should be typed on a dedicated device, never in the browser.
And there is the risk that kills more people than all the thieves combined: forgetting. In 2011, programmer Stefan Thomas stored 7,002 bitcoins on an encrypted disk and lost the paper with the password. The disk allows ten attempts before permanently erasing the content. He used eight. The last two remain there, and so does the money, behind a word no one remembers. A forgotten passphrase does exactly that, without a counter and without ceremony.
Therefore, those who use a passphrase take on three obligations. The first: it is a second backup and deserves the same care as the first — noted, on paper or metal, in a different place from the phrase, because keeping both together nullifies the reason for them being separate. The second: restore the hidden wallet on a clean device before sending money there, and confirm that the addresses match. The third: write with characters that any keyboard produces, because an accent typed on a different device is another passphrase.
Kept in your head and nowhere else, it is a bet against your own memory ten years from now — and that bet has already been lost by very organized people.
A single key, protected by a single word, is still a single point of failure. There is an arrangement where no single key moves anything, and it trades the risk of losing everything for a procedure involving more than one person. In the next lesson, the multisig.