Trezor Extends Maximum Passphrase Length to 128 Characters for Enhanced Wallet Security
Hardware wallet manufacturer Trezor has expanded the maximum allowed length of the optional passphrase used to protect wallets, increasing it from 50 to 128 characters.
On Sunday, Trezor announced that this feature is now supported in the latest Trezor Suite software along with updated device firmware. Devices running older firmware versions remain limited to passphrases of 50 characters.
Trezor explained that the passphrase functions as an added security layer combined with the wallet’s recovery seed. Even if an attacker obtains the seed phrase, they would still require the correct passphrase to access the wallet's funds.
Trezor referenced attacks targeting Coldcard devices in July, where a firmware vulnerability caused some wallets to generate recovery phrases lacking sufficient randomness, enabling attackers to reconstruct them. The company noted that users who utilized strong and unique passphrases were safeguarded in some cases.
This update comes in the wake of a separate security alert related to Trezor hardware.
On Friday, Trezor advised customers who purchased devices from a former authorized reseller, CryptoBilis, since March of the current year to transfer their assets to new wallets.
An Indonesian customer reported discovering a suspicious implant inside a Trezor Safe 5 device, potentially capable of capturing data displayed on the device screen—including recovery phrases—and transmitting it via cellular networks. Trezor stated on Friday that it has not yet analyzed the reported implant and has received no reports of associated losses.
why
Why it matters
This update strengthens wallet security by enabling longer, more complex passphrases, which provide an essential defense layer especially in light of recent firmware vulnerabilities and emerging threats.
Prepared from the source material with AI-assisted editing and checked against the supplied facts.
Open original source ↗