Best Seed Phrase Storage: Steel Backups Compared (Billfodl, Cryptosteel, Cryptotag)

For most people, the best seed phrase storage is a solid stamped or engraved steel or titanium plate kept in two separate locations. Tile-and-slot designs come second, because the loose letters can shift or fall out under heat or crushing. Paper is fine for the first hour of setting up a wallet and a poor choice after that. Below we compare the backups people actually search for, Billfodl, the Cryptosteel Capsule and Cryptotag Zeus, using materials data from the makers and independent stress-test grades. We also cover passphrases, splitting, and the mistakes that lose people their coins.

Key takeaways

• One-piece plates you punch or stamp held up best in Jameson Lopp’s long-running independent stress tests; several tile-based designs lost letters when heated or crushed.
• Cryptotag Zeus and Odin (titanium) earned A grades across heat, corrosion and crush; the Cryptosteel Capsule an A-; the Billfodl a C.
• Never cut a BIP-39 phrase into pieces. Use SLIP-39 Shamir shares or multisig if you want to split a backup.
• Store a passphrase (the “25th word”) separately from the 24 words, or the passphrase protects nothing.
• Prices change and counterfeits exist: buy from the maker or an authorised reseller.

Why a paper seed phrase backup fails

Paper fails slowly and then all at once. Typical house-fire temperatures destroy it, a burst pipe or flood turns ink into a smear, and thermal or cheap ballpoint ink can fade over years in a drawer. Paper is also easy to throw away by accident and easy to photograph if someone finds it. None of this matters on day one. It matters ten years later, when you or your heirs need the words and the card from the hardware wallet box is unreadable.

Writing down a seed phrase is not the same as holding an old printed paper wallet with a single private key, which is an outdated storage method best swept into a modern wallet.

A metal seed phrase backup solves the durability problem. It does not solve the secrecy problem: a steel plate is just as readable to a burglar as paper. Location and splitting strategy matter as much as material. (If you are still fuzzy on why the 12 or 24 words matter so much, start with what a seed phrase is.)

Metal seed phrase backup types

Tile or letter systems

You slot individual metal letter tiles into a frame or tube, usually spelling only the first four letters of each word. Four letters are enough because every word in the BIP-39 list is unique within its first four letters. Tiles are reusable and need no tools, but every tile is a separate part that can move, and a frame that warps can release them.

Stamped or punched plates

You mark a solid plate with a hammer and letter punches, or punch dots into a pre-printed grid. Once marked, the information is part of the metal itself. Setup is noisier and slower, mistakes are permanent, and you’ll want spare plates for practice.

Capsules

A capsule is a tile system rolled into a sealed tube. It is compact and discreet, and the outer shell protects the tiles from crushing better than an open frame does.

Steel seed phrase products compared

The table uses each maker’s published specifications and the grades from Jameson Lopp’s metal storage reviews (jlopp.github.io/metal-bitcoin-storage-reviews), the most widely cited independent test series. Lopp grades heat, corrosion and crush resistance; his heat tests aim for roughly 2,000°F, which he reasons should exceed what a natural house fire can sustain. Grades reflect the unit he tested, and makers sometimes revise designs, so check the review date against the product version you buy.

Billfodl

Billfodl is still sold by its maker in 2026 and remains one of the most-searched brands. It uses 316 marine-grade stainless steel, ships with more than 300 character tiles, and handles 12-, 18- and 24-word BIP-39 phrases. The maker says it withstands “more than double the average house fire” but does not publish a test temperature. In Lopp’s review, the steel itself shrugged off acid. Heat warped the tray enough that several letters fell out, and after the crush test almost all of the letters had come loose when the frame was opened. He rated that a serious failure, since the backup’s whole job is to keep the letters in order. The company also sells the Billfodl Multishard, a three-piece set where any two pieces recover the phrase. Read the splitting section below before choosing that approach.

Cryptosteel Capsule (and the newer Seed24)

The Cryptosteel Capsule is a tube filled with double-sided tiles covering every printable ASCII character, so it can also store passwords or a passphrase. Its shell is AISI 303 stainless steel and its internals AISI 304, per the maker. The tube shape protects the tiles: Lopp graded it A for heat and corrosion and B for crush. Cryptosteel is replacing the Capsule Solo with Seed24, which the company says holds up to 128 characters, adds serial-numbered tamper-evident seals and a detachable core, and is designed for 24-word phrases, SLIP-39 shares and multisig material. Seed24 had no independent grade in the sources we checked. The flat Cryptosteel Cassette scored lower (crush D) because an open frame protects tiles less well.

Cryptotag Zeus, Loki and Odin

Cryptotag makes titanium plates that you mark with an included centre punch. Zeus is two 6 mm plates holding 12 words each. Loki is a newer single 3 mm plate holding 24 words (12 per side) and works for both BIP-39 and SLIP-39 backups. Odin is aimed at Shamir multi-share setups. Cryptotag says its products were tested at temperatures up to 1,665°C (3,029°F), close to titanium’s melting point. That figure is the manufacturer’s claim, but Lopp’s independent A grades for Zeus and Odin point the same way. The downsides: punching dots takes patience, and a wrongly punched dot is permanent.

What about prices?

We don’t list prices because they change often, and bundles with Ledger or Trezor devices muddy comparisons. Check the maker’s own store and compare like for like (number of plates, tools included). Be wary of steep discounts on marketplace listings. A backup device is a security product, and a counterfeit could be a poor copy, or a way for a seller to learn what you are protecting.

The DIY option: stamped steel washers

Lopp’s reviews include several DIY kits that graded well, which shows a branded product isn’t essential. The best-known homemade approach is cheap: a stack of stainless steel washers on a stainless bolt, stamped with a hardware-store letter punch set, one word (first four letters) and its number per washer, then locked with a nut. Use stainless steel, ideally 316, not zinc-plated washers, which corrode. Number every washer so order survives if the stack comes apart, and practise on spares first. The result is ugly, but it is a one-piece-per-word stamped backup and usually far cheaper than branded kits.

Where to store a passphrase (the “25th word”)

A BIP-39 passphrase is an extra word or sentence you choose; the same 24 words plus a different passphrase open a completely different wallet. It protects you if someone finds your plate, but only if the passphrase is not stored with it. Common approaches: stamp the passphrase on a separate small plate kept in a different location, or keep it in a separate place your heirs can find through written instructions. A passphrase you cannot recall makes the funds unrecoverable, and it is case-sensitive, so record it exactly.

Splitting a backup: Shamir (SLIP-39) vs cutting a BIP-39 phrase

Storing copies in two places guards against fire, but every copy is a full key. The tempting fix is to cut the phrase into pieces. Done naively, this is risky:

One device builds Shamir sharing into its backup; our Cypherock X1 review explains its 2-of-5 scheme using the Vault and four NFC cards.

• Two halves, both required: you’ve doubled the ways to lose everything, because losing either half is fatal.
• Overlapping “2-of-3” word schemes: each piece reveals most of the phrase. For a 12-word wallet, a piece holding 8 words leaves only 4 unknown: about 17.6 trillion combinations (2,048⁴) before the checksum filters some out. That search is within reach of a well-equipped attacker. For a 24-word phrase the leftover search space is far larger, but the redundancy problem remains.

SLIP-39, the standard Trezor calls Shamir backup, is the proper tool. Shares below the threshold reveal nothing about the secret. Trezor’s Safe 3 (units made from June 2024), Safe 5 and Safe 7 default to a single-share 20-word SLIP-39 backup, which you can later upgrade to a multi-share scheme such as 2-of-3 in Trezor Suite. You can’t convert an existing BIP-39 phrase to SLIP-39 directly. You would create a new wallet and move funds. Our Trezor review covers the devices. Ledger devices use standard BIP-39 phrases and sell an optional paid recovery service instead; see our Ledger review for the trade-offs. Multisig is the other route for larger holdings: several independent phrases, each stored separately.

A simple storage plan by balance

Inheritance deserves a sentence of its own: a perfect backup nobody knows about is a lost fortune. Leave a letter (not in a public will) saying which wallet software to use, where each backup is, and whether a passphrase exists. If you move to self-custody from an exchange, our guide to choosing a non-custodial wallet covers recovery planning in more depth, and the wallets and security hub collects the rest.

What not to do

• Photos, screenshots, cloud notes or email drafts. Phone galleries and cloud accounts are common breach targets.
• Password managers. This one is debated. A strong, well-secured manager is better than a sticky note, but it puts a full key online behind one master password. Most security educators reserve it, at most, for passphrases or small hot wallets, not savings.
• Laser-engraving or “we’ll stamp it for you” services. Any third party that sees your words could empty the wallet. Mark metal yourself.
• Pre-filled recovery cards. A phrase that arrived printed in the box means the device or package was tampered with.
• “Seed checker” websites. Never type your words into a site to verify them; check by restoring on your own wallet instead.

FAQ

Is Billfodl worth it in 2026?

Billfodl is well made from 316 stainless steel and easy to use without tools, which is why it stays popular. Its weakness is the tile-in-frame design: in Jameson Lopp’s independent test, heat and crushing loosened the letters, earning it a C overall. If you choose it, keep it somewhere unlikely to be crushed or burned, and keep a second copy elsewhere. Solid punched plates scored better.

Cryptosteel Capsule or Cryptotag Zeus: which is better?

Both performed well in independent testing: Cryptotag Zeus graded A across heat, corrosion and crush, while the Cryptosteel Capsule graded A- with a B for crush. The Capsule is tool-free, compact and can store any characters; Zeus is solid titanium that you punch permanently. Choose the Capsule for convenience and flexibility, Zeus for maximum ruggedness.

What is the best seed phrase backup for a 24-word phrase?

Any backup that stores 24 words, keeps the word order safe, and survives heat and crushing is suitable. Single solid plates such as Cryptotag Loki or Seedplate fit all 24 words on one piece, and Zeus uses two plates. Tile systems store the first four letters of each word, which is enough under BIP-39. Test a full restore before you rely on the backup.

Is a steel seed phrase backup really fireproof?

Quality stainless steel and titanium survive house-fire temperatures far better than paper, and solid plates passed Lopp’s roughly 2,000°F heat tests. “Fireproof” claims still deserve caution. Some designs survived as metal but lost letters, and a plate can be buried in debris. Keep two copies in separate buildings so one fire cannot destroy both.

Crypto is volatile and risky; this is education, not financial advice. Do your own research.