Trezor increases wallet passphrase limit to 128 characters
Trezor raises passphrase limit to 128 characters
Trezor, a maker of hardware wallets that store cryptocurrency offline, has increased the maximum length of optional wallet passphrases from 50 to 128 characters. The company said the change is available in its Trezor Suite app when paired with updated device firmware. Devices running older firmware remain limited to 50 characters.
Key details from the update
- The optional passphrase limit rose from 50 characters to 128 characters.
- Users need updated device firmware and Trezor Suite to use the longer limit.
- A passphrase works as an extra password added to a wallet's recovery phrase.
- Trezor pointed to July attacks on Coldcard wallets as a reason for the change.
- Trezor also issued a separate warning about wallets bought from reseller CryptoBilis since March.
What Trezor says about passphrases
According to Trezor, a passphrase acts like an additional password that users set alongside their wallet's recovery phrase, which is a set of words used to restore access to a crypto wallet. Someone who obtains the recovery phrase would still need the correct passphrase to reach the funds in that wallet. Trezor said strong, unique passphrases protected some users affected by the Coldcard attacks.
Coldcard attacks and Trezor device warning
Trezor cited attacks in July in which a Coldcard firmware flaw caused some devices to create recovery phrases with insufficient randomness, allowing attackers to reconstruct them. The update also follows a separate warning from Friday. Trezor advised customers who purchased wallets from former authorized reseller CryptoBilis since March to move their funds to new wallets. An Indonesian customer reported a suspected implant inside a Trezor Safe 5 that could capture on-screen information, including recovery phrases, and send it over a cellular network. Trezor said it had not examined the device and had received no reports of related losses.
What is confirmed
- Trezor raised the optional passphrase maximum from 50 to 128 characters.
- The longer limit works only with updated firmware in Trezor Suite; older firmware stays at 50 characters.
- Trezor linked the change to July Coldcard attacks involving weak randomness in recovery phrases.
- Trezor warned CryptoBilis customers who bought devices since March to move funds to new wallets.
- A customer reported a possible implant in a Trezor Safe 5; Trezor has not examined it and reports no related losses.
What is still unclear
The source does not say how many users were affected by the Coldcard attacks or whether any funds were lost through the suspected Trezor Safe 5 implant. Trezor said it has received no reports of related losses.
Why a longer passphrase matters
A longer passphrase gives users more space to create a strong extra layer of protection. Trezor said this can matter when a recovery phrase is exposed, because the passphrase is still required to access the wallet.
What users need to do
Users who want the 128-character limit must update their device firmware and use Trezor Suite. Those on older firmware remain limited to 50 characters.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.