1. What did Trezor change?
Hardware wallet maker Trezor has raised the maximum length of optional wallet passphrases from 50 to 128 characters, announcing the change in a blog post on Sunday, November 1, 2026. The longer limit is available in Trezor Suite, the company's desktop and web application, when paired with updated device firmware. Devices that remain on older firmware stay capped at 50 characters, so owners need to update before they can set a longer phrase.
The change is small in engineering terms but meaningful for people who hold significant amounts of cryptocurrency. A passphrase is an extra layer of protection that sits on top of a wallet's main backup, and its strength depends heavily on how long and unpredictable it is. Raising the ceiling more than doubles the room users have to build something that is hard to guess.
Trezor tied the decision directly to recent security events, pointing to the attacks on Coldcard wallets in July. The company said strong, unique passphrases helped protect some users whose wallet recovery information had been compromised in those attacks.
Owners of hardware wallets often treat the device as the whole security story, but the choices made around it are just as important. Whether to use a passphrase, how long to make it and where to store it all influence how well the wallet holds up when something else goes wrong. The new limit gives users more room to make those choices well.
2. How does a wallet passphrase work?
A passphrase works as an additional password that is combined with the recovery phrase, the list of words generated when a hardware wallet is first set up. According to Trezor's own guidance, someone who obtains only the recovery phrase still cannot reach the funds in a passphrase-protected wallet, because the passphrase is required to derive the correct keys.
Technically, the passphrase is mixed into the process that turns the recovery words into the wallet's private keys. Every different passphrase produces a different wallet. Entering the wrong one does not return an error; it opens a different, empty wallet. This is why users must record their passphrase exactly, and why it is not stored on the device itself.
That design makes the feature powerful and unforgiving. It protects against theft of the written backup, but a lost or misremembered passphrase means the funds cannot be recovered by anyone, including the manufacturer. Users who adopt one need a reliable way to keep it safe that is separate from the place where the recovery phrase is stored.
A useful comparison is a safe with two keys held in different places. The recovery phrase is the first key, and the passphrase is the second. A thief who finds only one of them gains nothing, but the arrangement works only if the two are genuinely kept apart and if the owner can reliably produce both when needed.
3. What happened with Coldcard in July?
The Coldcard incident is the background for Trezor's decision. In July, attackers drained funds from users of Coldcard hardware wallets after a firmware flaw caused some devices to generate recovery phrases without enough randomness. Because the phrases were less random than they should have been, attackers could reconstruct them and take the funds.
Randomness is the foundation of wallet security. A recovery phrase is safe only because the number of possible phrases is so large that guessing one is impractical. If a flaw narrows the range of values a device can produce, an attacker can search that smaller range and recover keys that the owner believes are secret.
In that situation a passphrase can act as a second, independent secret. Trezor said strong, unique passphrases protected some affected users even though their recovery information had been compromised. The attackers could rebuild the recovery phrase but could not derive the passphrase-protected wallet without also knowing the extra password.
The episode demonstrated why defense in depth matters in self-custody. Users who relied only on the recovery phrase had a single point of failure, and once that phrase was reconstructed there was nothing left between an attacker and the funds. Those who had added a passphrase had a second barrier that did not depend on the same flawed randomness.
4. Why does passphrase length matter?
Length is the most reliable way to make a password resistant to guessing. Each additional character multiplies the number of possible combinations, and a long phrase made of unrelated words or random characters can be effectively impossible to crack with current hardware. A short or predictable passphrase, such as a name, a date or a common word, offers far less protection.
The old limit of 50 characters was already adequate for a well-chosen phrase, but it constrained some users. People who prefer a sentence-like passphrase built from several random words, or who generate passphrases with a password manager, can run up against a lower ceiling. A 128-character limit removes that friction and gives users more freedom to choose a format they can reliably reproduce.
Security experts generally recommend that passphrases be unique, never reused from another service and not derived from personal information. Combining several unrelated words is often easier to remember than a string of symbols while remaining strong, provided the words are chosen randomly rather than by the user's preferences.
Typing is a practical consideration too. Long passphrases are entered through the Suite interface rather than on the device screen, and they must be reproduced exactly, including capitalization, spacing and punctuation. A phrase that is strong but too awkward to enter correctly can lock its owner out as effectively as a forgotten one, so a balance between strength and usability is worth striking.
5. What should Trezor users do now?
Owners who already use a passphrase should first check their firmware version and update through Trezor Suite if an update is available. Existing passphrases continue to work as before. Anyone who wants to move to a longer phrase must remember that a new passphrase creates a new wallet, so funds would have to be sent from the old one to the new one rather than simply changing the password in place.
Users without a passphrase should consider whether one suits their situation. For holdings that would be painful to lose, the extra protection can be worthwhile, but it adds a responsibility: the passphrase must be stored safely and tested with a small transfer before relying on it. Making a mistake with it can be as damaging as a theft.
Whatever length is chosen, the passphrase should be kept apart from the recovery phrase. Storing both in the same place defeats the purpose, because anyone who finds the backup then finds the extra secret as well. A common practice is to keep them in separate secure locations or to memorize the passphrase if it is short enough to do so reliably.
It is also sensible to run a test before moving large holdings. Setting up the new passphrase, receiving a small amount, restoring the wallet from the backup and confirming that the same address appears proves that the whole process works. Doing this before committing a full balance costs little and removes the most common cause of lost access.
6. Why this matters for hardware wallet security
The episode shows how a flaw in one product can push competitors to revisit their own defaults. Hardware wallets are marketed on the idea that private keys never leave a secure device, but that promise depends on details such as random number generation, firmware integrity and the optional features that add depth. When a vulnerability surfaces at one manufacturer, users at others ask what would happen in the same circumstances.
A longer passphrase does not fix a faulty device, and it cannot protect users who never enable it. What it does is expand the margin of safety for those who do. In layered security, an optional second factor that remains secret even when the primary backup is exposed is one of the few protections that continues to work after a failure elsewhere.
For the wider market, the change signals that manufacturers are treating passphrases as a mainstream protection rather than an advanced feature. It also puts more emphasis on user education, because the benefits of a stronger passphrase are only realized if people understand how it works and how to store it.
Hardware wallet makers compete on trust, and trust is built through transparency about both strengths and failures. A manufacturer that responds to an industry incident by improving its own safeguards, and says plainly why it is doing so, gives customers a clearer basis for deciding which device to rely on for long-term storage.
7. What comes next?
Users should watch for firmware releases and for the instructions in Trezor Suite, since the 128-character limit applies only to devices that have received the update. Trezor has not announced further changes to passphrase handling in this release, so the practical next step for owners is the update and a review of their own backup practices.
The Coldcard thefts also remain a reference point for the industry. Further analysis of how the flawed devices produced weak recovery phrases, and what other manufacturers do to confirm the quality of their own randomness, will shape how hardware wallets are evaluated in the months ahead.
For individual owners, the most useful follow-up is a short review: confirm the firmware is current, decide whether a passphrase fits their holdings, and make sure the backup and the passphrase are stored in separate places. Those steps cost little and address the failure modes that the July attacks brought into view.