Why You Should Never Store a Cryptocurrency Seed Phrase In Plain Text

I wrote a small educational demo in Python. This tool demonstrates just how easy it is to scan for plain text seeds (in other words, seeds that aren't encrypted). My demo is a small library and UI for testing out and showing this concept, and can also be combined with code that would, for example, exfiltrate stolen seeds and store them in an attacker's database. Scanning for the seed is fairly simple - using regular expressions (a common programming tool) to search files on disk. Obviously, don't use the seeds shown in this demo as anyone could steal your coins.

Real malware exists that can execute these sorts of attacks, or other attacks like clipboard hijacking. Attackers have also compromised weak passphrases on encrypted password managers, such as those exposed in the LastPass vault breach.

What should you do instead?

• If it's a hardware wallet seed only store the seed on paper or metal. The whole purpose of an offline wallet is to keep the keys away from general purpose devices like phones or PCs, even in encrypted form
• If it's a software wallet seed, you can store the seed in an encrypted form in software such as an encrypted password manager. However, you MUST ensure that the passphrase protecting that encrypted key store is strong, and only for smaller amounts of money. (again, see the LastPass vault breach).
• Don't ever store the seed on a PC or phone in a plain text (unencrypted) format, period.