Non-custodial wallets give you complete control over your KAS. No company, server, or third party holds your funds on your behalf. That freedom comes with a responsibility that most people underestimate: if you lose access to your recovery phrase, your KAS is permanently unrecoverable. Not locked. Not frozen. Gone.
The steps below are not suggestions — they are a minimum baseline for anyone holding a meaningful amount of KAS in a self-custody wallet. Work through each one before you transfer significant funds.
Step 1: Write Your Seed Phrase on Paper — Not Digitally
Step 01When Kaspa Wallet generates your wallet, it produces a 12 or 24-word BIP39 seed phrase. This sequence of words is the master key to your funds. Anyone who has these words can import your wallet on any compatible device and sweep your balance instantly.
The single most common security failure is storing a seed phrase digitally — in a notes app, a password manager, a text file, an email draft, or a cloud storage folder. Every one of these locations has been a vector for theft at scale. Cloud services get breached. Password managers get targeted. Devices sync automatically in ways users do not expect.
Write your seed phrase on paper using a pen. Use clear, legible handwriting. Number each word. Verify the written list against the screen before dismissing the wallet setup screen. Do not take a photo of the paper. Do not type the words into any device to "double-check" them. The paper is your backup. Treat it like one.
Never do this: take a screenshot of your seed phrase during setup, paste it into a notes or messaging app, store it in your email, or save it as a text file anywhere on your computer or phone.
Step 2: Use a Strong, Unique Passphrase
Step 02Kaspa Wallet allows you to set an optional passphrase (sometimes called a "25th word") on top of your seed phrase. This is separate from your wallet file's encryption password. The passphrase is combined with your seed phrase during key derivation, meaning the same 12 or 24 words produce a completely different set of addresses depending on which passphrase is used.
A passphrase provides a critical layer of protection if your physical seed phrase backup is ever discovered. Without the passphrase, the words are useless to an attacker. This is a meaningful defense against physical theft or loss.
Choose a passphrase that is long (at least 20 characters), not a dictionary word or phrase, and not something guessable from your life. A string of four or five random, unrelated words — chosen randomly, not selected — is a reasonable baseline. Do not reuse passwords from other accounts. Do not use your birthday, your name, or anything a person who knows you might guess.
You must remember this passphrase exactly. Unlike a password on a website, there is no reset mechanism. If you forget the passphrase, the funds are inaccessible. Store a note of the passphrase separately from your seed phrase — never in the same physical location.
Step 3: Test Your Recovery Before Sending Large Amounts
Step 03Most people never test whether their seed phrase backup works until they actually need to recover their wallet — which is exactly the wrong moment to discover an error. A single transposed word, a misread letter (b vs. 6, for instance), or a missing word renders the backup useless.
Before transferring a large amount of KAS into your wallet, run a recovery test. The process is straightforward:
- Note your wallet's receiving address.
- Remove the wallet file from Kaspa Wallet (or use a second installation).
- Import the wallet using only your written seed phrase and passphrase.
- Verify that the same receiving address appears after import.
If the addresses match, your backup is correct. If they do not, do not send funds to that wallet until you identify and fix the discrepancy. This test takes five minutes and is the single most effective way to avoid catastrophic loss from a transcription error.
Step 4: Store Your Backup Physically Secure and Away From Your Computer
Step 04A paper backup stored in the same room as your computer provides limited protection. If your home is burgled, if there is a fire, or if someone gains physical access to your workspace, both your computer and your backup are compromised simultaneously.
Consider the following for your seed phrase backup storage:
- A fireproof and waterproof safe at home, separate from your primary workstation area.
- A second copy stored at a different physical location — a family member's home or a safety deposit box.
- Metal backup plates (stamped or engraved steel) are available for under twenty dollars and survive conditions that destroy paper.
- If you use multiple locations, ensure each location stores only partial information (seed phrase in one place, passphrase in another) if you have reason to distrust one location over the other.
The goal is to ensure that no single physical event — theft, fire, flood — can simultaneously destroy all copies and that no single person stumbling across a backup can immediately access your funds.
Step 5: Verify Downloads With SHA256 Checksums
Step 05Every Kaspa Wallet release publishes SHA256 checksums alongside the installer files on the GitHub releases page. Before running any downloaded wallet software, verify that the checksum of the file you downloaded matches the published value exactly.
This takes about thirty seconds on any operating system. On macOS and Linux, the command is shasum -a 256 KaspaWallet-installer.dmg. On Windows, use Get-FileHash in PowerShell. Compare the output character by character against the published checksum.
If the checksums do not match, do not run the file. Download it again from the official source. A mismatched checksum can indicate a corrupted download or, in a targeted attack, a modified installer designed to steal your seed phrase.
Always download Kaspa Wallet from the official GitHub repository or the official website. Do not install versions distributed through unofficial channels, third-party app stores, or links shared in social media messages.
One Final Reminder
Legitimate wallet software and legitimate support channels will never ask for your seed phrase. Not to "verify your wallet." Not to "help with a transaction." Not ever. If anyone — in a chat, a support ticket, a forum, or a direct message — asks you to provide your seed phrase or import it into a third-party tool, stop and close the conversation. This is always a theft attempt.
Self-custody is powerful precisely because it removes intermediaries. The practices above are how you preserve that power over the long term.