Monero seed phrase Twenty-five words. Your whole wallet.

Your Monero seed phrase is 25 ordinary words that are your wallet. Not a password for it, not a backup of some account somewhere: the wallet itself. Whoever holds the words can open it on any device and spend from it. Whoever loses them, along with every device that held the wallet, loses the money for good.

That sounds heavy. It is also the best news in this guide, because it means no bank, no company and no support desk stands between you and your money. Get these 25 words right once, and you are in full control for life.

Let's get started.

Under the hood, a Monero wallet is a pair of secret numbers called keys. Each is 256 bits long. Written out, a key is 64 random-looking characters, which is hopeless to copy by hand without a mistake.

A seed phrase is a friendlier way to write the same secret. Instead of a wall of characters, you get 25 words from a fixed list, in a fixed order. The words and the key are two spellings of the same number, and a wallet can turn one into the other in an instant. The Monero glossary puts it plainly: the phrase has all the information needed to view and spend your funds.

You will see the same thing under several names: seed, mnemonic seed, recovery phrase and recovery words. They all mean the 25 words. MonkStash calls them recovery words on screen.

What the words let you do

• Survive a lost or broken devicePhones die and browsers get cleared. The words bring the wallet back.
• Open your wallet anywhereRestore the same wallet on a laptop, a phone or a second browser.
• Switch apps without askingNo account to migrate. Any wallet that reads your format opens it.
• Plan for your familyA sealed copy in the right place lets someone you trust reach the funds.

The flip side is the reason this guide exists. The words work for anyone who has them, and nobody can reset them, freeze them or reverse a payment made with them.

The 25 words are really 24 plus one. According to the Monero documentation, the first 24 words carry the seed and the last word is a checksum. The wallet works it out from the first three letters of each of the other 24 words, then picks one of those 24 words as the 25th.

That is why the official restore guide warns that some words may repeat. The 25th word is always a copy of one of the first 24. It is not a mistake on your paper.

Words in a standard seed

25

Words on the list

1,626

Languages available

12

Checksum word

1

Who may ask for it

Nobody

The Monero seed word list

Every word comes from a fixed list of 1,626 words, chosen at random by your wallet. The list exists in 12 languages, including English, Spanish, German, French, Russian, Japanese and Chinese, and the English list is public in the Monero source code. On the English list, no two words share the same first three letters, which makes a sloppy handwritten word easier to identify. Still write every word out in full.

What the checksum does for you

If you copy a word wrong, skip one or swap two, the final word usually stops matching and the wallet refuses the phrase instead of quietly opening an empty wallet. Think of it as a spell checker for your money.

It has a limit. The checksum catches most slips, not every one. If a restore succeeds but shows an address you do not recognize, recheck every word against your paper before you assume anything else. Chapter 8 covers how to check.

The 25-word seed is the standard, and most Monero wallets use it. But the Monero documentation lists three formats, and some wallets add a fourth. The quickest way to know yours is to count the words.

16 words: Polyseed

Polyseed is a newer format with 16 words. Its big idea is that the words also store the wallet's creation date, to within about a month, so a wallet never has to ask you for a restore height. Feather's documentation says it uses Polyseed for its 16-word seeds, and Cake Wallet's documentation says new Monero wallets there use it by default.

The catch is compatibility. Not every wallet reads Polyseed, and the conversion only goes one way. Feather explains that a Polyseed wallet can show you its 25-word equivalent, but a 25-word wallet can never become a Polyseed one, because Polyseed runs the words through a one-way step to make the key. MonkStash cannot restore a Polyseed directly yet, so a Polyseed owner would restore here with that 25-word version, or keep the wallet in Feather or Cake Wallet.

14 words: an old Feather seed

Before Polyseed, Feather made its own 14-word seeds. Its seed documentation says versions before 2.0.0 used them, and that current Feather can still restore 14 and 25 word seeds. If you have 14 words, restore them in Feather; from there you can move the funds anywhere.

13 words: MyMonero

The old MyMonero web wallet used a shorter phrase: 12 words plus a checksum. According to the Monero documentation, it turns words into keys differently from the 25-word format, so a wallet must support it specifically. MyMonero shut down in January 2026, and MonkStash restores 13-word phrases in your browser using MyMonero's own key derivation. Our guide to restoring a MyMonero seed walks through it.

12 words: usually Exodus

Exodus used one 12-word phrase for every coin in the app, Monero included, until it ended Monero support in 2025. MonkStash converts an Exodus 12-word phrase into the matching 25-word Monero wallet in your browser. Our guide to getting your Monero back from Exodus walks through it, including how to check you landed on the right address.

A Monero wallet, or account, is built on two key pairs: a spend key and a view key. Each has a private half you guard and a public half you can share. Your seed sits above all of them.

• The seed is the private spend key. For a standard seed, the 25 words are another way of writing your private spend key, the key that signs payments.
• The view key comes from the spend key. Your wallet makes the private view key by hashing the spend key. One secret produces the other, so the 25 words cover everything.
• The address comes from the public halves. The public spend key and public view key together form your primary address, the one that starts with a 4.

Every arrow runs one way. Nobody can work backwards from your address to your keys, or from your view key to your spend key.

The view key: a window, not a door

The private view key lets a wallet find payments coming in, but it cannot spend them. Give a wallet your address plus your view key and you get a view-only wallet: handy for watching a balance on a device you do not fully trust, or for showing income to an accountant. MonkStash can import one as a watch-only wallet.

Two honest limits. The Moneropedia view key entry notes that outgoing payments cannot be reliably seen with it, so a view-only balance can be wrong once you have spent. And a view key still reveals every payment you receive, so it is private information too.

Restoring from keys instead of words

Wallets such as the Monero GUI and CLI can also restore from keys: your address, private view key and private spend key. It works, but 64-character keys are much harder to copy by hand than 25 words. For most people, the words are the better backup.

The goal sounds simple: you can always get the words back, and nobody else can. Those two aims pull in opposite directions. More copies make loss less likely and theft more likely. Good storage is a balance, and for most people the balance looks like this:

1. Write the words by hand, on paper

   Use a pen, number them 1 to 25, and write each word in full. Check the spelling against the screen, word by word.

2. Add the date you made the wallet

   Not secret, but very useful. A date is all you need for a fast restore later (chapter 7).

3. Make a second copy, and keep it somewhere else

   A home safe plus a trusted relative's home, or a bank deposit box. One fire, flood or burglary should never end your access.

4. Test that the words work

   Before you put real money in, prove the paper restores the right wallet. Chapter 8 shows how.

Paper or metal?

Paper is cheap, offline and easy to check. Its weakness is water and fire. A stamped or engraved metal plate survives both, which makes it worth it for larger amounts. Whichever you choose, keep it out of sight and away from anything labeled "crypto".

What never to do

• Screenshots and photos. They sync to cloud albums and linger in backups and recycle bins for years.
• Email, chat apps and cloud notes. Anyone who breaks into that account gets your money too.
• Typing it into websites, including "check", "sync" or "validate" pages. That is how phishing works.
• Splitting it into halves kept in different places. It doubles the ways to lose it, and homemade schemes are easy to get wrong.
• A single copy. One copy in one drawer is one accident away from gone.

The words vs the wallet file

Desktop wallets such as the Monero GUI also save a wallet file, often with a .keys file beside it. That file holds your keys, encrypted with your wallet password, and the official guide notes you can read your keys back out of it if you know the password. It is a handy extra, but it is not a substitute for the words: lose the password or the disk, and the file is useless. MonkStash keeps its encrypted copy inside your browser instead, so the same rule applies. The 25 words are the backup; everything else is convenience.

Password managers: an honest take

A password manager encrypts what you put in it, which is a big step up from a screenshot. The trade-off is that your whole wallet then depends on one master password and a device connected to the internet. If malware sits on that device, both the vault and your seed are exposed. For most people an offline paper or metal copy is the main backup, and a password manager is at most an extra.

One more thing to plan for: the people you leave behind. A sealed copy with simple instructions, kept where a trusted person will find it, means your money does not vanish with you.

Yes, as an option. Standard Monero seeds support a seed offset, also called a seed passphrase. The documentation describes it as hashing a passphrase you choose and adding the result to the wallet's keys, then subtracting it again when you restore with the same passphrase.

The effect: the 25 words alone open a different wallet from the one that holds your money. That protects you if someone finds the paper. But a wrong passphrase does not produce an error. It simply opens another valid wallet, which looks empty. Forget the passphrase and nobody can help you.

Which wallets support it

The Monero GUI and CLI both ask for an optional "seed offset passphrase" when you restore from a seed. Cake Wallet offers a seed passphrase under its advanced settings, and the Polyseed documentation recommends seed offsets for Polyseed wallets. MonkStash does not offer a seed passphrase today.

Three things people mix up

Restoring is the moment your backup pays off. You open a Monero wallet, choose to restore, type the 25 words and set a new password. The wallet rebuilds your keys in seconds. Then it has to find your payments on the blockchain, and that part takes longer.

The short version:

1. Open a wallet you trust, from a bookmark or an official download, never from an ad or a link in a message.
2. Choose restore from seed (in MonkStash, "Restore from recovery words").
3. Type the words in order. If you use a seed passphrase, enter it when asked.
4. Give the date you made the wallet, or a restore height.
5. Set a new wallet password and wait for the scan to finish.

What the restore height is

Monero hides who got paid, so your wallet cannot just look up your balance. It reads the blockchain block by block and checks which payments are yours. The restore height is the block where that scan starts. A 25-word seed does not remember when it was made, which is why the date on your paper matters.

The official guide says to use the block that included your first incoming payment, and to pick a lower number if you are unsure. Lower only makes the first sync slower. Higher can hide money. So a balance that looks short after a restore is almost always a height set too high, not money gone. Rescan from an earlier date and it reappears.

In MonkStash you enter the approximate date you made the wallet, and it converts that to a height for you. Leave it empty and it scans the whole history. Your words never leave your browser while it does.

A backup you have never tested is a hope, not a backup. The good news: checking takes a few minutes, and the best time to do it is before you put money in.

1. Count and read back

   Twenty-five words, numbered, each spelled in full. Read them back against the screen one more time. MonkStash also asks for three of your words before it finishes creating a wallet, to catch a bad copy early.

2. Restore once from the paper

   Before funding the wallet, restore it from your written copy in a wallet you trust. If the words were copied wrong, the checksum will usually refuse them.

3. Compare the address

   The restored wallet must show the same primary address as before. Compare the first and last several characters carefully. A different address means a wrong word, wrong order or a different format.

If the address does not match, do not fund that wallet. Find the mistake while the original is still open in front of you, or create a fresh wallet and back it up again.

First, do not panic, and do not delete anything. Whether you can recover depends entirely on what you still have.

• The wallet still opens on a device. You are probably fine. Many wallets can show the seed again from their settings once you enter the wallet password. Write the words down today, then test them. MonkStash does not show your words again after setup today, which is why it checks your copy while you create the wallet.
• You saved your private spend key. The spend key is the seed in another form, so you can restore from keys and then write down the words the restored wallet shows.
• Only the address and view key. You can build a view-only wallet and watch money arrive, but you can never spend it. Nothing can turn a view key into a spend key.
• None of these. The money is still on the blockchain, but nobody can move it again. There is no reset and no support desk.

Missing just one word?

If only the 25th word is missing, it can be calculated from the other 24, because it is a checksum. A missing word among the first 24 is harder: there are 1,626 candidates for that spot, and finding the right one means testing which candidate opens your wallet. Be extremely wary of any "recovery service" that asks for your other words.

Forgot your password, not your seed?

That is the easy case. A wallet password only protects the copy on one device. With your 25 words you can restore the wallet and set a new password. MonkStash passwords cannot be reset for the same reason: the words are the real way back.

A seed is only ever typed into a wallet you chose to open, to restore it. Nobody else has a reason to see it. Most Monero losses do not come from broken cryptography. They come from someone being talked into typing their words.

• Fake wallet sites. Clones copy a real wallet's look, buy ads or rank in search, and wait for your words. Since MyMonero closed in January 2026, its name has been a favorite.
• Fake support. Real support never asks for your seed. A helpful stranger in your messages who needs it "to fix the sync" is a thief.
• Validation and airdrop pages. "Verify your wallet", "claim your reward", "sync your node": all of them end with a box for your words.
• Seed generator websites. A site that makes a seed for you can keep a copy. Let your own wallet create it, on your own device.
• Pre-filled seeds. Never use words someone else chose for you, including a phrase printed on a card in a box.

The defense is a habit: open your wallet from a bookmark you made yourself, and treat every request for your words as an attack, whoever it seems to come from. Our guide on spotting fake Monero wallet sites shows a 60-second check.

Maybe you photographed it, typed it into the wrong site, or someone saw the paper. Do not wait to find out whether anyone used it. Act as if they will, and move the money first.

1. Create a brand-new wallet

   It gets a new seed, so your old words give no access to it. Back up the new words properly before anything else.

2. Send everything to the new address

   Move your full balance from the old wallet to the new one. It costs a small network fee, and it is worth every bit.

3. Retire the old words

   Stop using the old wallet. A new password does not help, because the words work without it.

4. Clean up the exposed copy

   Delete the photo and empty the trash, or destroy the paper. Then check how it happened so it does not happen twice.

If only your view key leaked, your money is safe, but your incoming payments are visible to whoever has it. Moving to a new wallet ends that too.

You can do step 1 by opening a MonkStash wallet in your browser. Your 25 words are generated and encrypted on your own device and never sent to a server. MonkStash is an early preview that has not been independently audited, so start with a small amount. If you want to see what to expect first, read how to create a Monero wallet.