Option for advanced users
The passphrase is like a 25th word on your 24 words seed, but one that you should remember and never write down. It scrambles your seed and generates a new identity: there is no right or wrong passphrase, each one will always derive a unique seed and set of accounts.
It is mainly used for two reasons:
- protection of your backup seed: if someone gets physical access to your 24 words seed, it’s game over. If your accounts are behind a passphrase then you are protected since it would be computationally extremely expensive (and not feasible) to try all possible combinations.
- plausible deniability: in case of a $5 wrench attack, you would give out a passphrase unlocking accounts containing spare change. Of course, this has some limits: if the attacker is very well informed he can continue to hit you with the wrench until you give the “real” password.
As entering a passphrase on your Nano S each time you plug it would be highly impractival, Ledger’s approach is to use an alternative PIN (or “duress PIN”) which would be locked to a fixed passphrase.
Note that all your apps (Bitcoin, Ethereum, FIDO…) are affected by the passphrase identity change.
Firmware 1.3.1 and above
The options are now available directly under the Settings menu on the Nano S. Make sure that you remember your passphrase if you use one. Forgetting the passphrase will result in a loss of funds eventually.
Only for 1.0 to 1.2 firmware
Using older firmware versions, setup of the passphrase requires the use of Python scripts. Upgrading your firmware is recommended in order to use the more user-friendly internal Settings menu.
Setup Python environment
Execute the following commands in your Linux or MacOS shell:
pip install ledgerblue
Set passphrase and alternate PIN
Use the following command:
python -m ledgerblue.derivePassphrase [--persistent]
It will request your passphrase on your computer, request your current PIN on your Nano S and generate the new set of accounts. If
--persistent is set then you’ll be asked to enter an alternate PIN and these accounts will be attached to it. Otherwise, these new accounts will be active on the device until it is powered off.
With an alternate PIN activated, when you power on the device, the usual PIN will give you access to your normal accounts, and the alternate PIN will activate the accounts behind the passphrase.
How to best use the passphrase feature
Our recommendation is to use your current PIN for your day to day accounts, holding reasonable assets, and your alternate PIN for your savings account, holding higher value assets. This way, not only will your backup seed be protected by the passphrase, but your “duress” PIN will in fact be a real account with real transactions. This would be much more effective in a plausible deniability scenario.
SECURITY NOTICE - ALTERNATE PIN AND PHYSICAL ACCESS
If you provide one PIN to an attacker keeping control of the device for some time, it can be leveraged to try to brute force the other PIN, as the counter is reset during a successful PIN input, and both PINs share the same retry counter in current firmware versions. The best course of action is to restore and transfer your assets to a different seed quickly if this happens.