What a seed phrase is
A seed phrase is a human-readable encoding of the secret a wallet is built from. Rather than ask you to copy long strings of random characters, a wallet turns its root secret into a sequence of common words — typically twelve or twenty-four — drawn from a fixed, standardized list. The words are not decorative: their order and identity encode the exact bits of the underlying secret, and a checksum baked into the phrase lets a wallet detect most typos when you re-enter it.
From that root secret a wallet derives keys deterministically. One phrase seeds a tree of private keys, one per address, generated by a repeatable formula. That is why restoring a wallet on a new device needs only the words: feed the same phrase back in and the wallet recomputes the identical keys and addresses, with the same balances, without contacting any server. The phrase is the wallet — the app around it is just an interface to the keys the phrase produces.
Because the phrase regenerates the keys, it inherits every property of the keys themselves. It cannot be reset, because there is no account behind it to reset. It cannot be recovered if lost, because no one else ever held it. And it grants total control to whoever reads it: a leaked phrase lets a stranger rebuild the wallet and drain every address it covers, while a lost phrase with no other backup strands the funds permanently. The words look harmless, which is precisely what makes mishandling them dangerous.
Seed phrase, private key, and wallet
A private key authorizes spending from one address. A seed phrase sits one level up: it regenerates the whole set of private keys a wallet manages, so it is strictly more powerful than any single key. Exposing one private key risks one address; exposing the seed phrase risks the entire wallet. The two are related but not interchangeable, and the phrase is the more sensitive of the pair.
The seed phrase is a property of self-custodial wallets — software or hardware that holds keys for an individual or a business. It is not a universal account credential, and it is never something a payment provider, an exchange, or a counterparty needs from you. Any request to type a recovery phrase into a website, share it with support, or send it to confirm a transaction is a theft attempt, because the only thing a phrase is ever used for is rebuilding the wallet that owns the funds.
Why it matters for crypto payments
A business that self-custodies the wallets it receives into and pays out from carries the seed phrases for those wallets, and each phrase is a single point of total compromise. Whoever obtains it can reconstruct the wallet and move funds before anyone notices, with no central party able to freeze the address or reverse the transfer. Protecting the phrase — offline, backed up against loss, and out of reach of staff who do not need it — is not an extra precaution; it is the core of keeping the funds safe.
halfin signs on a merchant's behalf, so the blockchain keys and any seed material that backs them stay inside the platform rather than on a merchant's premises. The guarantees on offer are about how keys are used — payouts are signed only after approval, API keys carry scoped permissions, and signing events are auditable — and halfin does not advertise custody assurances beyond signing, permissions, and audit. A merchant integrating against the API never handles a halfin seed phrase, and should never be asked for one.
The credential a merchant does hold is the API key, and it deserves seed-phrase-grade discipline within the integration. It is the secret that authorizes calls against the account, so keep it server-side, never ship it to a browser or a customer's device, scope it to the permissions the integration actually needs, and rotate it the moment it might be exposed. As with a phrase, treat it as something that can move value — because in the context of the integration, it can.
- A seed phrase is a human-readable backup that regenerates every private key — and therefore every address and balance — in a wallet.
- It is more powerful than any single private key: exposing one key risks one address, exposing the phrase risks the whole wallet.
- It cannot be reset or recovered, and no legitimate party — provider, exchange, or counterparty — ever needs you to enter or share it.
- On halfin, seed material stays internal and money movement is approval-gated, permission-scoped, and auditable; the merchant guards the API key with the same care.