How to use the Bitcoin Key Backup Record

• A printer, printing at actual size
• A pen with archival pigment ink. Not pencil, which smudges and fades. Not gel or rollerball, which run when wet.
• The device or software holding the key
• Twenty uninterrupted minutes, offline, somewhere you're not overlooked

Print on the heaviest plain paper your printer takes. Avoid glossy stock, because ink sits on the surface and smears.

Set your print dialog to 100% / Actual Size. Not "Fit to page", not "Shrink to fit". Browsers default to scaling, and a scaled sheet has boxes too small to write in.

Sheet 1 carries a calibration ruler. After printing, measure it. If the line is not 100mm, the page was scaled, so change the setting and reprint. The ruler is the ground truth, not the on-screen preview.

Choose the paper size that matches your printer's tray. A4 gives marginally larger boxes; Letter is otherwise identical.

Print Sheet 4 once for every person who will hold any part of this backup. It contains no secrets, and whoever ends up holding only Sheet 3 needs the handwriting key and the warnings just as much as you do.

Master fingerprint. Eight hexadecimal characters that identify this key. Your device shows it during setup, and wallet software shows it whenever you import the key.

Take it from the master key at m, not from an account xpub. Some software shows a fingerprint for the account level as well, and the two are different values. The one you want is the one that identifies the key as a whole.

If you use a passphrase, load it first and record the fingerprint shown with the passphrase applied. That is the value that appears in your descriptor, and how a future recoverer confirms the passphrase is right.

Hex uses only 0-9 and a-f. There is never an o, l, s, g or z, so a circle is always zero and a bare vertical stroke is always the digit one.

Key origin. Which device or software created the key, and what version. Some vendors have had derivation quirks in specific firmware versions, so record it. Record the serial number and the device number if the hardware carries them; they are how you tell two identical-looking devices apart years later.

Do not record the device PIN. It is not part of the backup: the seed words override it, so the PIN cannot help whoever is recovering. Written on the sheet, it only helps a thief who finds the device and the paper together.

Single-sig derivation path. Optional. Wallet software scans the standard paths automatically, so an ordinary single-signature wallet is found without it. Record it if you used anything unusual.

If the entropy was imported, say where the key came from and what else has ever held it. An imported key's security is capped by the weakest environment it has ever touched: a phone wallet from 2017, a paper backup someone once photographed, an exchange that generated it for you. Nothing else records this, and it becomes unknowable later. If the honest answer is uncomfortable, move the funds to a fresh key rather than document the problem.

Multisig table. Leave it blank for single-signature wallets. The derivation path belongs to each wallet, not to the key: the same device used in a single-sig and two multisigs uses three different paths. Fill in one row per wallet.

Reading a path back: m/48'/0'/0'/2' is a multisig using native segwit. A second multisig on the same device usually increments the third number, so it appears as m/48'/0'/1'/2'.

The descriptor checksum is the eight characters after the # at the very end of the descriptor:

wsh(sortedmulti(2,[...]))#tjg09x5t

It never contains b, i, o or the digit 1. So when you read it back: a circle is always zero, a bare vertical stroke is always l, and a shape like b is always 6.

The checksum catches a transcription error in a descriptor you already have. Eight characters cannot reconstruct one.

Write in capitals if it helps legibility, and don't join letters up. BIP39 words are always lowercase whichever way you write them, so capitals are only ever a legibility choice. Tick the box at the top of the sheet saying which you used, so nobody reading it later has to guess.

There are nine boxes per word. No word on the list is longer than eight letters, so one box is spare. If you write a letter wrong, fill that box in solid with black ink and carry on in the next one. A blacked-out box is not part of the word.

Fill in the word numbers. Each BIP39 word has a position from 1 to 2048, and your wallet software will show them. Handwriting degrades, ink fades, and flight and fight look identical after fifteen years in a drawer. #712 does not.

Strike through every unused row. A sheet with twelve words and twelve blanks is ambiguous; a sheet with twelve words and twelve struck-out rows is not.

Only the first four letters of each word are needed to identify it. And the final word encodes a checksum, so a single mistyped word is almost always rejected outright by wallet software: a phrase that "almost works" means a transcription error, not lost funds.

Copy the master fingerprint onto this sheet too. It is already on Sheet 1, but sheets get separated, and the fingerprint is how a recoverer confirms they have restored the right wallet. Tick whether it is the fingerprint for these words plus the passphrase on Sheet 3, or for these words on their own. If there is no passphrase, Sheet 3 is unused and can be discarded entirely.

Leave this sheet blank and destroy it if you don't use a passphrase.

Choosing one. Pick every word with true randomness, using dice or a tool built for the job. A phrase you thought of yourself is not random and will be guessed. How many words you need depends on the list you draw from:

• at least 7 words from the BIP39 English wordlist
• at least 6 words from the EFF long wordlist
• at least 5 words from the whole English dictionary

Run the words together with no spaces between them. Upper and lower case letters are both fine, as long as you tick which you used. Nothing else: no spaces anywhere, no punctuation, no accented letters, no emoji.

The no-spaces rule is about paper, not cryptography. A space is invisible: an empty box could be a space, or could be where the passphrase ended, and nobody reading the sheet later can tell the difference. A space at the start or end is worse still, because there is nothing on the page to see at all. correcthorsebatterystaple has no such ambiguity, and loses nothing in strength.

Accented and unusual characters are normalised differently by different wallets, so the same passphrase can open different wallets depending on the software. That is another way to lose funds while believing the backup is fine.

Write one character per box, starting at box 1 and filling every box in order until the passphrase ends. No box in the middle should be left empty.

Corrections work exactly as they do on Sheet 2. A character written wrong gets its box filled in solid with black ink, and the writing carries on in the next box. A blacked-out box is not part of the passphrase. Never scribble over a character or write on top of one, and if the sheet collects more than the odd blacked-out box, start a fresh one and destroy the old one.

Where this sheet lives is the real decision.

For a single-signature wallet, storing Sheet 3 beside Sheet 2 cancels the passphrase out entirely. Anyone who finds the pair has everything. Splitting them is the whole point of having a passphrase.

For multisig, keeping them together is usually correct. One compromised key still can't spend, and the far greater risk is that you or your heir never recovers the passphrase at all.

Copy the master fingerprint across every time, whether you split the sheets or not. It cannot move funds, and it is what keeps this sheet matched to its wallet if you ever hold sets for more than one.

If you split them, name the person holding the seed words, with their email and telephone number. Sheet 1 has the mirror block for whoever holds this sheet.

If you also keep the passphrase digitally, say so at the foot of the sheet: where it is, and the password or key that opens it. A passphrase on its own cannot spend, so a copy in a password manager is a different kind of risk from a copy of the seed words, and the thing that actually loses funds is a copy nobody left to find. Never put the seed words anywhere near it.

This sheet is not secret. Print it for every holder, and give it to your heir now, not on your death. Someone reading "never type these words into a website" for the first time during a bereavement is already at risk.

Fill in the handwriting key while you're still the person who can read your own writing. It takes one minute, and it is what tells a future reader whether the mark you made was a zero or an o, a 1 or an l.

There are two blocks: one for lowercase and one for capitals, since the pairs that get confused are not the same in each. Fill in the block matching the writing you actually used on Sheets 1 to 3, or both blocks if you mixed them, and tick which.

The contact block asks for one person: their name, email and telephone number. Pick someone who will actually pick up the phone, rather than listing two people and trusting that one of them works.

The block below it is for your own instructions. Anything you have written about your wallets, your reasoning or your heirs is no use if nobody can reach it, so record where it lives and the password or key that opens it. Point it at something that will still exist: a document in a password manager your executor can get into, not a link that dies with the account.

Transfer the seed words to stamped or punched stainless steel, which survives fire and flood. Keep the paper for what the steel can't hold: the fingerprint, the paths, the instructions.

Keep copies in at least two separate buildings. A single location is a single fire.

Don't laminate. It traps moisture against the paper, and you can't add to a sealed sheet later, which you will want to do when you complete the test log or add a wallet.

Use a tamper-evident bag and sign across the seal, so you can tell whether a sheet has been read.

A bank safe deposit box is secure but may be sealed on your death, exactly when your heir needs it. A home safe is accessible but is the first place a burglar looks. Most people end up using both.

Restore the seed onto a spare device or into offline wallet software, confirm it produces the same master fingerprint written on Sheets 1 and 2, then wipe the test device. Record it in the log on Sheet 4.

Repeat every year or two, and after every house move. Moves are when backups get separated from the people who know what they are.

If you use a passphrase, test the seed and passphrase together. Testing only the seed proves nothing about the half you're most likely to get wrong.

There is no emergency. Funds don't expire. Rushing is how people lose money at this stage.

Read Sheet 4 first, in full. Then check whether Sheet 1 lists a multisig wallet. If it does, the seed words are not enough on their own, and you must locate the separate descriptor backup first. Sheet 1 records where it was kept.

Next, look at the tick beside the master fingerprint on Sheet 2. It tells you whether a passphrase is part of this wallet. If it says the words stand alone, there is no Sheet 3 to find and you should not go looking for one. If it says the passphrase is needed, the seed words on their own will restore a wallet that is real, empty and not yours, so do not conclude the funds are gone.

Either way, the restored wallet must show the fingerprint written on the sheets. That is how you know you have recovered the right thing.

If you need help, ask a Bitcoin professional you have verified independently: a firm with a real address and a reputation, never someone who contacted you. Show them Sheet 4 and nothing else. A trustworthy helper will never need to see your seed words.