Is it safe to take a photo of your seed phrase?

A seed phrase, also called a recovery phrase or wallet backup, is the list of 12 to 24 words that can rebuild a crypto wallet on any device. Whoever has those words has the wallet. That’s why seed phrase storage gets so much argument online, and why the answer to “can I take a photo of it?” is more careful than yes or no. This guide sets out what wallet makers themselves say, why a photo is risky, the best way to store a seed phrase, and where a digital copy fits if you keep one anyway.

What wallet makers say about seed phrase storage

The companies that make wallets are unusually blunt about this.

Trezor’s own guide tells you not to keep any digital copy of your wallet backup, and spells out what that means: screenshots, photographs, emails, Dropbox and the like. It also says Trezor will never ask for your backup, even through customer support, and that you should never enter it anywhere unless your Trezor device asks for it.

MetaMask’s support pages say the same thing from a different angle. They tell you not to store your Secret Recovery Phrase online, because cloud storage and password managers are vulnerable to hacks, and to keep it in a secure physical place that only you can reach. They explain the reasoning plainly: a handwritten phrase can’t be stolen online, while a file in an internet-connected cloud folder could be.

When the people who build wallets agree this firmly, it’s worth taking at face value.

Why a photo of your seed phrase is risky

Photos sync automatically. With iCloud Photos on, Apple keeps every photo and screenshot you take in iCloud. Under Apple’s standard data protection, those photos are encrypted on Apple’s servers with keys Apple holds. On Android, Google Photos backup does the same, uploading your photos to your Google account. Your seed phrase is now as safe as your cloud account’s password.

Malware has been caught reading photo libraries for exactly this. In February 2025, Kaspersky’s researchers reported apps in both Google Play and Apple’s App Store carrying hidden code, which they named SparkCat, that used text recognition to scan people’s photo galleries and send images matching recovery-phrase keywords to the attackers. The infected Google Play apps alone had been downloaded more than 242,000 times. Apple and Google removed the apps, but the lesson stands: any app you’ve given full photo access can read every picture in your library.

Screenshots and notes count too. A screenshot lands in the same library as a photo. A phrase typed into a notes app usually syncs to the cloud, and keyboards can learn the words you type.

The loss is instant and permanent. Someone who reads your seed phrase doesn’t need your phone, your passcode or your wallet app. They can move everything out of the wallet from anywhere, and crypto transfers can’t be reversed.

The best way to store a seed phrase

For any amount you’d be upset to lose, the answer is offline and physical.

1. Write it by hand on paper at the moment the wallet shows it to you, in order, numbered. Check the spelling of every word against the screen.
2. Never photograph, screenshot or type it while you do this. No phone in hand is the simplest rule.
3. For meaningful amounts, add a metal backup. Stamped or engraved steel survives fire and water far better than paper. This is why the search results for seed phrase backup are full of metal plates: for this job, they’re the right tool.
4. Store it somewhere private and safe, away from where the wallet itself lives, and think about a second copy in a separate place so one fire, flood or burglary can’t take both.
5. Never share it. Nobody legitimate asks for it: not your wallet’s support team, not an exchange, not an app update.

If you keep a digital copy anyway

Some people still want a copy on their phone, often for a small wallet or as a reminder of where the real backup is. Be honest with yourself about the trade-off. A photo of recovery words is only as safe as the phone, so keep a paper or metal copy for larger amounts.

If you go ahead, the rules are short:

• Never in the camera roll, never as a screenshot. That’s the copy that syncs and that apps can read.
• Use an encrypted vault that never stores the plain image in the cloud. The file should be encrypted on the phone before any backup leaves it.
• Give it its own lock. Not your phone’s passcode, and ideally a long one.
• Remember what encryption can’t do. If your phone itself is compromised, malware can see whatever is on the screen while the vault is open.

If an old screenshot exists, delete it from your library and from Recently Deleted, where iPhone keeps deleted items for 30 days. If it ever synced to the cloud, treat the phrase as exposed and move the funds to a new wallet with a new phrase. Kaspersky’s researchers gave the same advice to people affected by SparkCat.

Using Hideroom for recovery words, honestly

None of that changes the basic rule above. If you keep a copy there, put it in a room with a long pattern, write that room’s own recovery phrase on paper and keep it apart from the phone, and keep your paper or metal seed phrase backup as the real one. The security page lists what it protects against and, as importantly, what it can’t.

The same care applies to other papers on your phone; our guide on whether it’s safe to keep a photo of your passport covers that. And if you’re worried about locking yourself out of a vault, read what to do if you’ve forgotten a photo vault password.