Trezor Raises Wallet Passphrase Limit to 128 Characters

Trezor expanded the maximum length of optional wallet passphrases to 128 characters in October software updates, giving users of four hardware-wallet models a longer secret to pair with a wallet backup.

The change appears in Trezor Suite desktop releases 26.10.2 and 26.10.3. In a Nov. 1 explanation, Trezor connected the expansion to user requests and lessons from July’s seed-generation incident involving Coldcard.

Users of the Model T, Safe 3, Safe 5 and Safe 7 can use up to 128 characters after updating device firmware. The Model One remains limited to 50 characters, as do devices running older firmware. Trezor’s guide specifies standard ASCII characters; uppercase and lowercase letters count differently, and spaces count toward the limit.

A passphrase is an optional secret entered with a wallet’s recovery backup to derive a separate wallet. A typo opens a different wallet, so users need the exact string to reach the intended funds. Length alone does not make a passphrase strong; unpredictability matters too.

Coldcard maker Coinkite disclosed in July that a firmware bug weakened seed generation on certain devices. Its advisory lists Mk2 and Mk3 firmware versions 4.0.1 through 4.1.9, along with seeds created on Mk4, Mk5 and Q devices before specified fixes, among affected cases. Pre-fix seeds on the latter models had about 72 bits of entropy, compared with 128 bits expected.

Attackers reconstructed private keys offline and stole funds from affected wallets, Coinkite said, without remotely accessing or taking over the devices. Trezor said strong, unique passphrases protected some users during the initial attacks.

A passphrase can add a barrier to access, but it does not repair an affected seed. The remedy is to move funds to a wallet created from a new seed. Trezor devices and wallets originally created on them were not affected by the Coldcard flaw.