Skip to main content
Your Trezor hardware wallet gives you two independent security layers to guard your funds: a PIN that locks the device itself, and an optional passphrase that creates an entirely separate hidden wallet. Understanding how each one works—and using them correctly—is one of the most important steps you can take to keep your crypto safe.

​
PIN Protection

Your PIN locks the physical device. Every time you connect your Trezor or authorize a transaction, the device requires you to enter the correct PIN before it proceeds. Without the PIN, no one can use your Trezor—even if they physically possess it.

​
How PIN Entry Works

Trezor uses a scrambled PIN grid to protect you from keyloggers and shoulder-surfing. When you enter your PIN:
  • Your Trezor’s screen displays a 3×3 grid of numbered positions.
  • The numbers on the grid are randomized each session—they are never in the same order twice.
  • Your computer or phone shows a blank 3×3 grid. You click the positions that correspond to your digits as shown on the device screen.
  • Because the mapping changes every time, anyone watching your screen or recording your clicks cannot reconstruct your PIN.
If you enter an incorrect PIN, Trezor enforces an exponentially increasing wait time between attempts. After several failed tries the device wipes itself, protecting your funds even if the device is stolen.

​
Setting Your PIN

1

Connect your Trezor

Plug your Trezor into your computer using the supplied USB cable and open Trezor Suite.
2

Open device settings

In Trezor Suite, click your device name in the top-left corner, then select Settings. Under the Security section, click Set PIN.
3

Confirm on device

Your Trezor screen will prompt you to confirm that you want to set a PIN. Press the right button to proceed.
4

Enter your PIN

Look at your Trezor’s scrambled number grid and click the corresponding positions on the Suite interface. Choose a PIN that is at least 6 digits long—longer PINs are significantly harder to brute-force.
5

Re-enter to confirm

Enter the same PIN a second time to confirm it. The grid will scramble again between entries, so read the device screen carefully each time.
6

PIN is active

Trezor Suite will confirm that your PIN has been set. From this point on, your device is locked and requires the PIN on every use.
Choose a PIN you can remember reliably without writing it down. A PIN stored on paper defeats the purpose—anyone who finds it can use your device. Use a memorable but non-obvious sequence of at least 6 digits.

​
Passphrase Protection

The passphrase is an advanced security feature sometimes called the “25th word.” While your recovery seed (12 or 24 words) backs up the physical device, the passphrase is an extra secret you add on top of the seed. Together, the seed and passphrase derive a completely different wallet with different addresses and balances.

​
What the Passphrase Does

  • Creates a hidden wallet. Any passphrase—including a blank one—generates a unique wallet. This means your main wallet (empty passphrase) and your hidden wallet (non-empty passphrase) both exist simultaneously on the same device.
  • Provides plausible deniability. Under duress you can reveal your PIN and show the main wallet, while your real funds sit in a hidden wallet protected by a passphrase the attacker doesn’t know.
  • Is never stored on the device. Trezor does not save the passphrase anywhere. You must supply it each time you access the hidden wallet.

​
When and Why to Use a Passphrase

Consider enabling a passphrase if you:
  • Hold a significant amount of crypto and want protection beyond the PIN.
  • Are concerned about scenarios where someone could obtain both your device and your recovery seed.
  • Want plausible deniability—keeping a small balance in your standard wallet and the bulk of your funds in a hidden wallet.

​
How to Enable Passphrase in Trezor Suite

1

Open device settings

In Trezor Suite, navigate to Settings → Device.
2

Enable passphrase encryption

Find the Passphrase toggle and switch it on. Trezor Suite will ask you to confirm the action on your device.
3

Confirm on your Trezor

Press the right button on your Trezor to approve enabling the passphrase feature.
4

Enter your passphrase

The next time you access your wallet, Trezor Suite will prompt you to type a passphrase. Enter it on your computer—your Trezor will use it (combined with your seed) to derive your hidden wallet.
5

Verify the wallet address

Always cross-check at least one receiving address shown in Suite against your Trezor’s display to confirm you have accessed the correct hidden wallet.
There is no way to recover a forgotten passphrase. Unlike your PIN, the passphrase is never stored on the device or anywhere else. If you forget it, the funds in that hidden wallet are permanently inaccessible—no support team, no recovery tool, and no process exists to retrieve them. Write your passphrase down securely and store it separately from your recovery seed.
If you choose to write down your passphrase, store it in a physically separate location from your recovery seed. Someone who obtains both your seed and your passphrase has full access to your hidden wallet. Keeping them apart maintains the security advantage of using a passphrase in the first place.