Trezor raises wallet passphrase limit to 128 characters

Trezor raised its hardware wallet passphrase limit from 50 to 128 characters in its November 1, 2026 Suite update. The change responds to user concerns following July 2026 Coinkite Coldcard seed generation flaws, which led to over $100 million in stolen bitcoin. Model T, Safe 3, Safe 5, and Safe 7 devices support the update with new firmware, while Model One retains the 50-character cap.

Trezor passphrase update compatibility and rollout

• ▪Trezor Model T, Safe 3, Safe 5, and Safe 7 hardware wallets support 128-character passphrases, whereas the Trezor Model One maintains a 50-character limit
• ▪Trezor increased the maximum passphrase length on supported hardware wallets to 128 characters in its Trezor Suite update
• ▪Trezor's core firmware 2.13.0 changelog dated October 21, 2026 lists Trezor's passphrase limit as 128 bytes, which rolled out in Suite desktop version 26.10.3 and mobile version 26.10.2
• ▪Using a 128-character passphrase on a Trezor device requires both the latest Trezor Suite app and updated device firmware, while older Trezor firmware retains a 50-character limit

Passphrase security warnings

• ▪Trezor designated Trezor's passphrase feature as an advanced feature and warned users that a mistyped or forgotten passphrase can result in lost funds
• ▪Trezor warned in August 2026 that length alone does not guarantee entropy because automated cracking tools systematically test dictionary words, leaked passwords, and common patterns

Trezor statements on Coldcard flaw

• ▪Trezor stated in August 2026 that its own hardware wallets were unaffected by the July 2026 Coldcard seed generation flaw, but advised users to move wallets created on a Coldcard and restored on a Trezor
• ▪Trezor stated that increasing Trezor's passphrase length was prompted by user inquiries following the July 2026 Coldcard seed generation flaw

Coldcard seed generation vulnerability and mitigation

• ▪A March 17, 2021 firmware migration error caused Coinkite Coldcard devices to run seed generation on a software generator instead of hardware, producing weak recovery phrases
• ▪Attackers reconstructed weak Coldcard recovery phrases to access wallets, but users with strong, unique passphrases were protected from the Coldcard attacks
• ▪Coinkite advised that Coldcard wallets were vulnerable unless created with 50 independent dice rolls or protected by a strong, unique passphrase

Financial losses from Coldcard vulnerability

• ▪Galaxy Digital's Alex Thorn estimated that the Coldcard seed vulnerability resulted in over 1,596 BTC stolen across roughly 7,300 addresses, totaling over $100 million in losses
• ▪On August 2, 2026, X account BTC Sessions reported the first confirmed loss from the July 2026 Coldcard seed flaw thefts involving a device using a weak two-word passphrase