128 characters. That is how long a Trezor wallet passphrase can be now — more than double the old 50-character cap. The change lands in a week when hardware wallet owners are checking everything twice, after fresh wallet attacks and one very public implant scare.
Key points:
- Trezor lifted its wallet passphrase cap from 50 to 128 characters, live now in Trezor Suite with updated device firmware.
- July's Coldcard attacks pushed it over the line — long, one-of-a-kind passphrases kept some wallets safe even after their recovery details were exposed.
- Old firmware and the Model One still stop at 50, so you only get the longer cap once you update — and a forgotten passphrase still locks you out for good.
On Sunday, Trezor said the longer cap is ready in Trezor Suite for devices running the new firmware. A passphrase is the extra password you can set on top of your recovery phrase. If someone gets hold of your recovery words, they still need that passphrase to open the wallet it guards. That one extra secret is the whole point of the feature.
The July Coldcard attacks are why this matters now. A firmware flaw left some of those devices making recovery phrases with weak randomness, and attackers could rebuild them. Trezor says strong, one-of-a-kind passphrases shielded some of the people hit, even with their recovery details out in the open. Those attacks were tied to about $100M in wallet thefts, and that number is hard to forget.
Read also: Trezor Warns CryptoBilis Buyers After Suspected Safe 5 Hardware Implant Report
My own read is simple: This is a quiet fix with a loud message. Trezor is telling owners the extra password is not a side feature anymore, it is the lock itself. But longer only helps if you can keep it exact. Type one letter wrong and you open a different, empty wallet, with no warning. Trezor cannot reset it for you, and no support ticket will bring it back.
Should you switch to a longer passphrase today?
First, update. Old firmware still caps you at 50, and Trezor's own docs say the Model One stays at 50 even now. Second, do not rush it. A longer passphrase you cannot reproduce word for word is worse than a shorter one you know cold. Write it down somewhere safe, offline, and test it before you trust it with real funds. Coming right after Friday's CryptoBilis implant warning and today's BTCPay wallet drains, the timing says plenty about where wallet safety stands this week: the devices are fine, but the small human steps around them are where money gets lost.
Read also: BTCPay Wallets Drained on Old Versions — Is Your Server Next?
— BitByLine News Desk
This is news only, not financial advice. I never tell anyone to buy or sell anything here — whether you move your coins or touch your wallet settings is your own call, and your own risk, so do your own research first.
Read our full Disclaimer.
Sources: Cointelegraph, Trezor
Comments
Post a Comment
We love hearing from our readers! Share your thoughts, questions, or corrections below — please keep it respectful and on topic.