Hardware wallet maker Trezor has raised the Trezor passphrase limit for optional wallet passphrases to 128 characters, up from a previous ceiling of 50, announcing the change on November 1. The expanded limit is available through updated Trezor Suite software paired with compatible device firmware.
The update gives users a longer secret to combine with a wallet backup, adding another option for securing cryptocurrency holdings after a series of wallet security incidents this year. Trezor linked the expansion to user requests and to lessons drawn from July's seed-generation incident involving rival device maker Coldcard, according to TOKENPOST.
Which devices support the Trezor passphrase limit increase
Owners of the Model T, Safe 3, Safe 5 and Safe 7 can use passphrases of up to 128 characters once they update their device firmware, according to TOKENPOST. The change appears in Trezor Suite desktop releases 26.10.2 and 26.10.3, which rolled out in October.
The Model One remains capped at 50 characters, and the same restriction applies to any device still running older firmware, TOKENPOST reported. Cointelegraph also noted that outdated firmware keeps the 50-character limit in place, while Trezor said Sunday the longer passphrases are available in Trezor Suite with updated firmware.
Trezor's guidance specifies that passphrases use standard ASCII characters, with uppercase and lowercase letters treated as distinct and spaces counting toward the total. Length by itself does not guarantee strength, since unpredictability also matters, according to the company's documentation as reported by TOKENPOST.
How a passphrase protects a wallet
A passphrase is an optional secret entered alongside a wallet's recovery backup, and the combination derives a separate wallet. According to Trezor, it functions like an additional password layered on top of the recovery phrase, so an attacker who obtains the recovery phrase would still need the exact passphrase to reach the funds in that wallet.
Each distinct passphrase produces an entirely different wallet, which means a small typing error opens a different wallet rather than the one holding the user's funds. Trezor cannot recover lost or forgotten passphrases, so a user who loses the exact string may be permanently locked out of the cryptocurrency, Bitcoinist reported.
Trezor cautions that passphrases remain an advanced security feature even with the added flexibility of the higher character limit. Extended secrets can deliver real defensive value, though holders need to keep them in a safe place and reproduce them character for character, according to Bitcoinist.
Coldcard incident behind the longer Trezor passphrase limit
Trezor tied the change to July's Coldcard attacks, in which a firmware flaw led some devices to produce recovery phrases without enough randomness, letting attackers rebuild them. Coldcard maker Coinkite disclosed that the bug weakened seed generation on certain devices, and attackers reconstructed private keys offline and stole funds from affected wallets without remotely accessing or taking over the devices, the company said.
Coinkite's advisory lists Mk2 and Mk3 firmware versions 4.0.1 through 4.1.9 among the affected cases, plus recovery seeds generated on Mk4, Mk5 and Q units prior to designated fixes. Seeds generated on the latter models before the fixes carried about 72 bits of entropy, compared with the 128 bits expected, according to TOKENPOST.
Estimated losses tied to the Coldcard vulnerability topped $100 million, sharpening examination of wallet makers and how they handle security, according to Bitcoinist. Trezor said strong, unique passphrases protected some users during the initial attacks, keeping funds safe even where recovery information was compromised.
Trezor has stressed that wallets first created on its own hardware were untouched by the Coldcard firmware flaw. By contrast, anyone who generated a recovery phrase on a vulnerable Coldcard unit and later restored it on Trezor hardware stays exposed until funds move to a wallet built on a new seed, because restoring a compromised phrase elsewhere does not remove the underlying weakness.
While a passphrase raises an extra hurdle for attackers, it cannot fix a seed that is already compromised, according to TOKENPOST. The remedy for anyone holding a vulnerable seed is to transfer funds to a wallet generated from a fresh seed.
Separate warning over reseller devices
The passphrase update follows a separate warning involving Trezor's own hardware. The company told customers on Friday that anyone who purchased a wallet from CryptoBilis, a former authorized reseller, at any point since March should shift their funds into new wallets, Cointelegraph reported.
A customer in Indonesia flagged what appeared to be an implant concealed in a Trezor Safe 5, one capable of reading on-screen data such as recovery phrases and sending it out via a cellular connection. The company said Friday that it had yet to inspect the unit and that no losses connected to the case had been reported to it, according to Cointelegraph.
Conclusion
Trezor's Trezor passphrase limit now stands at 128 characters for users of the Model T, Safe 3, Safe 5 and Safe 7 who update their device firmware, while the Model One and older firmware remain at 50 characters. The company announced the change on November 1 and tied it to lessons from July's Coldcard seed-generation incident, in which strong passphrases shielded some users whose recovery information was compromised.
The next concrete step for affected users is clear from the facts: anyone who created a recovery phrase on a vulnerable Coldcard device must move funds to a wallet built from a newly generated seed, since a passphrase alone does not fix a weakened seed. Trezor has also directed customers who bought from former reseller CryptoBilis since March to transfer their funds to new wallets.
Frequently Asked Questions
What is the new Trezor passphrase limit and which models support it?
Trezor raised its maximum optional passphrase length from 50 to 128 characters, announced on November 1. Users of the Model T, Safe 3, Safe 5 and Safe 7 can use the longer passphrases after updating device firmware. The Model One and devices on older firmware stay limited to 50 characters.
Why did Trezor raise the passphrase limit to 128 characters?
Trezor connected the expansion to user requests and lessons from July's Coldcard seed-generation incident, in which a firmware bug let attackers reconstruct recovery phrases and steal funds. Trezor said strong, unique passphrases protected some users during the initial attacks, keeping funds safe despite compromised recovery information.
Does a longer passphrase fix a seed affected by the Coldcard flaw?
No. A passphrase adds a barrier to access but does not repair an affected seed. Users who created recovery phrases on vulnerable Coldcard devices remain exposed even after restoring them on Trezor hardware. The fix is to shift funds into a wallet built on a newly generated seed.
What happens if a Trezor passphrase is typed incorrectly?
Every different passphrase generates a separate wallet, so even a minor typing error opens an entirely different wallet rather than the one containing the funds. Trezor cannot recover lost or forgotten passphrases, which means users who lose the exact string may be permanently unable to access their cryptocurrency.
What did Trezor warn about wallets bought from reseller CryptoBilis?
On Friday, Trezor advised customers who bought wallets from former authorized reseller CryptoBilis since March to move funds to new wallets. A customer in Indonesia reported what looked like an implant hidden in a Trezor Safe 5, one able to read on-screen data such as recovery phrases and send it out over a cellular connection. Trezor said it had not examined the device and had no reports of related losses.
Sources
Read Also
