What is a recovery phrase?

Published 31 August 2026 by Nyra

A recovery phrase, also called a seed phrase, is a list of common words, usually 12, that encodes the secret key to your account. Whoever holds it controls the account, so keep it private and offline. In an app with no email or phone number, losing it means the account is gone forever.

A recovery phrase is how you prove an account is yours when there is no password to reset and no email on file. It is a short list of ordinary words that stands in for a long secret key, written in a form a person can actually copy down by hand.

What a recovery phrase is

A recovery phrase, sometimes called a seed phrase, is a list of common words, usually 12, that encodes the secret key to an account. Instead of asking you to memorize a long string of random characters, the app turns that secret into plain words that are easier to write down without a mistake.

The words are not decorative. They are the key, expressed in a friendlier alphabet. Anyone who has the phrase, in the right order, can rebuild the key and take control of the account. That is the whole point of it, and it is also the whole risk.

How a recovery phrase works

When an account is first created, the app generates a large random number from real randomness on your device. That randomness is the seed. The app then maps the seed onto words drawn from a fixed dictionary.

The most common standard is BIP39, which uses a list of exactly 2048 words. Each word stands for a specific chunk of the underlying number, and a built-in checksum means a phrase with a typo is usually rejected rather than silently loading the wrong account. Twelve words from a 2048-word list carry enough randomness that guessing a phrase is not realistically possible.

Because the phrase is generated on your device from local randomness, the secret never has to be sent anywhere. The app can rebuild your keys from the phrase alone, on any device, without a server ever holding the secret.

Why apps use a recovery phrase

This is the same idea crypto wallets have used for years, and it is spreading to privacy tools for one honest reason: it takes the company out of the middle of your security.

A traditional account leans on a password plus a reset path, usually an email address or a phone number. That reset path is convenient, and it is also a way in for anyone who can compromise your inbox or your carrier, and a record the provider can be compelled to hand over. A recovery phrase replaces all of that with a single secret only you hold. There is no password database to breach and no reset link to intercept.

How to store a recovery phrase safely

Because the phrase is the account, storing it well is the entire job. A few plain rules cover most of it:

• Write it down on paper, in order, and check the spelling. Something physical cannot be reached from the internet.
• Keep it offline. Do not screenshot it into a cloud photo library, paste it into notes that sync, or email it to yourself. A phrase in the cloud is only as private as that cloud account.
• Keep it private. Nobody legitimate will ever ask for your full phrase. Anyone who does is trying to take the account.
• Store a spare copy somewhere separate and safe, so a single lost note or a house fire does not end the account.
• Never type it into a website or a form. You only ever enter a recovery phrase inside the app you are recovering.

The blunt trade of self-custody

Holding your own key is called self-custody, and it is a real trade, not a slogan. You get total control: no company sits between you and your account, and nobody can lock you out or quietly hand your identity to someone else.

You also get total responsibility. In an app that never collected a phone number or an email, the recovery phrase is the only way back in. There is no reset link to send, no support agent who can verify you some other way, and nobody, including the provider, who can restore it. Lose the phrase and the account is gone forever.

That sounds harsh, and it is meant to. The same wall that stops a company from restoring your account is the wall that stops anyone else, that company included, from taking it over. You cannot have one without the other.

How Nyra uses a recovery phrase

Nyra uses a recovery phrase for exactly this reason. Nyra is an anonymous, end-to-end encrypted messenger, and it is still in development, so read this as how the app is designed to work rather than a finished track record. Because Nyra asks for no phone number and no email, your identity is a username and keys derived from your recovery phrase, and that phrase is the one thing that can bring the account back. We say the hard part out loud: keep it, or the account is gone. You can read how the keys are actually used on our security page, why there is no phone number to fall back on, and plain definitions of these terms in our glossary.

Frequently asked questions