Trezor has raised its passphrase limit from 50 to 128 characters on its current hardware wallets, the company said in its October Trezor Suite update, published on Sunday 1 November. The change shipped earlier: the firmware changelog lists it under core version 2.13.0, dated 21 October. Owners have to update, because a device on older firmware keeps the 50-character cap.
No attack on Trezor lies behind the change. Its post opens the passphrase section with this summer’s Coldcard thefts, and Cointelegraph’s report on Monday framed the new limit as coming “after” them. Trezor never says one led to the other. The only prompt it mentions is a question it “kept receiving”: “Is it possible to create a longer passphrase?”
What firmware 2.13.0 actually changed
The changelog entry is a single line, filed under “Changed”: “Increase maximum passphrase length to 128 bytes.” Bytes and characters are not the same thing. Trezor’s blog and its setup guide speak of characters, and the two only match for plain ASCII text, meaning unaccented Latin letters, digits and common symbols. Accented letters and emoji take more than one byte each, so a passphrase written with them reaches the ceiling before character 128.
The distinction is an old one for the company. An April 2020 entry for firmware 2.3.0 reads: “Properly limit passphrase to 50 bytes and not 50 characters.” Trezor’s passphrase guide now says 128 ASCII characters, the most exact wording of the three.
The same release added Stellar Protocol 27 delegated authentication, improved Ethereum clear signing and fixed Ripple payment requests that dropped a destination tag of 0. The Suite update announced on 1 November brings accounts on Arc, Circle’s Layer 1 network, more Soroban and SEP-41 token functions on Stellar, Cardano sending and message signing on mobile, and CSV export of trade history.
Which devices get 128 characters, and how Ledger compares
Trezor’s guide lists the Safe 7, Safe 5, Safe 3 and Model T at 128 ASCII characters. The older Model One stays at 50. The changelog line names no models, so the guide is the reference here. Ledger, the rival hardware wallet maker, says on its Academy page that the only limit is a maximum of 100 characters; we did not check that figure model by model.
| Device or firmware | Maximum passphrase length | Source |
|---|---|---|
| Trezor Safe 7, Safe 5, Safe 3, Model T | 128 ASCII characters | Trezor guide |
| Trezor device on firmware older than the update | 50 characters | Trezor blog, 1 November |
| Trezor Model One | 50 characters | Trezor guide |
| Ledger | 100 characters | Ledger Academy, updated 5 August |
Why a long passphrase may not move to other hardware
The cap belongs to each device, not to the standard. BIP-39, the common recovery-phrase standard, feeds the passphrase into the key derivation and sets no maximum length. The old 50-byte ceiling was a deliberate choice: a contributor posting as matejcik wrote on GitHub in August 2024 that it was “originally intended for compatibility with T1”, so that a Model T wallet could always be restored on a Model One.
The new limit gives that up. A 120-character passphrase is longer than Trezor’s published limit for the Model One and Ledger’s for its devices, so on those figures it could not be entered there, and the wallet behind it would stay closed on that hardware. That is our reading of the published limits. We have not tested recovery across models or brands, and Trezor’s guide does not address the case. Owners of a Trezor Safe 5 or a Safe 3 who use the full length are, in practice, tying that wallet to Trezor models on recent firmware.
Length is not the only obstacle. Many Trezor owners do not hold a BIP-39 phrase at all. Trezor says a 20-word single-share backup has been the default on Safe devices and the Model T since June 2024, and it is built on SLIP-39, whose own text says the two standards are for the most part not compatible. Trezor’s list of wallets that support it names one hardware wallet, Keystone. Anyone counting on a move to another brand should first check which type of backup they hold.
Trezor passphrase vs seed phrase vs PIN: what each one guards
A passphrase is an extra word or sentence you choose yourself. It is combined with your backup words, the seed phrase, to reach a different set of keys, which opens a separate wallet. Someone who gets hold of the backup alone, from a photo or a leak, sees the standard wallet and not the one behind the passphrase.
The PIN is a different thing: it guards the physical device, while the passphrase is part of how the keys are made. The device does not store the passphrase, which is why mistakes are unforgiving. It is case-sensitive, and a single typo produces no error. It opens another wallet, probably empty. Trezor’s guide is blunt: “Passphrases cannot be changed, removed, or recovered.”
Two consequences follow for anyone already using one. Lose it and the funds behind it are gone, as both Trezor and Ledger warn. And it cannot be edited. Trezor’s guide says any new passphrase opens a different wallet, and BIP-39 says the same in its own terms: every passphrase produces a valid seed. So going longer means a new wallet with new addresses, and moving the coins across in ordinary transactions. Updating the firmware moves nothing. The old passphrase keeps opening the old wallet, which stays as it was until you empty it.
Where you type it matters as much as how long it is. “Type your passphrase on your Trezor whenever you can,” says Trezor’s Suite guide, because anything typed on a computer or phone can be captured, and a stolen passphrase plus the backup gives an attacker full access. Ledger is stricter and says never to enter it on an internet-connected device. The Safe 7, Safe 5 and Model T take it on the touchscreen and the Safe 3 on its buttons. The Model One has no on-device entry at all, one more reason a long secret does not suit it. No website, app or support agent needs your passphrase or backup words.
The protection has limits. A passphrase will not stop a phishing page that collects it along with the backup, or a fake screen that gets you to sign a theft. Our guide to storing a recovery phrase safely covers the backup side.
The Coldcard thefts show why the setting matters, not why it changed
Trezor uses Coldcard as an illustration. According to its blog, a firmware flaw in some Coldcard devices left wallet backups with far less randomness than intended, and attackers recreated them offline and drained thousands of addresses. Not every affected owner lost funds in the first wave. Those with a strong, unique passphrase “were protected”, Trezor writes, which gave them time to migrate. It does not say its own devices are affected.
Coinkite’s advisory of 30 July makes a narrower point: “If the affected seed was used with a strong, unique BIP-39 passphrase, that passphrase adds an independent barrier.” The company also says a passphrase does not repair a weak seed, tells owners to migrate to a new seed as soon as practical, and warns that short, common or reused passphrases may be guessable. A longer passphrase on the same backup is therefore no substitute for a new seed. Loss estimates and the legal fallout are in our report on the Toronto class action against Coinkite.
The dates do not settle the cause. The GitHub request to remove the 50-character limit was opened by a user on 4 August 2024, about two years before Coinkite’s warning, and two developers on the project were open to it within a day. It was closed on 2 September 2026, roughly a month after that warning, and the firmware followed on 21 October. So the demand clearly predates Coldcard, while the timing of the fix is something Trezor has not explained.
Longer only helps if the passphrase is random
Extra length has one job: making the passphrase harder to guess. When a seed is weak, an attacker can work offline, trying candidates with no device to lock them out. Several randomly chosen words add secrecy the thief must also find. A famous line of poetry or a sentence reused from elsewhere adds much less, however long it is.
There is also a cost in daily use. Entering a long string on a small device is slow, and every extra character is another chance of landing in the wrong wallet. Trezor advises writing the passphrase down on paper and regularly testing access. That test belongs on the device, never in a website or app that offers to check it. Trezor’s post also calls the feature advanced and warns that funds can be lost if the passphrase is mistyped or misremembered.
What Trezor has not said
Nothing from the company explains why the limit changed now, or whether the Coldcard episode played any part. The blog post gives no firmware number, and the changelog line does not spell out which models receive version 2.13.0. The Model One remains at 50 characters in Trezor’s guide.
The update lands days after a separate Trezor warning, when the company told CryptoBilis buyers to move their funds following a reported implant in a Safe 5 it had not examined. That case concerns where a device was bought, and a longer passphrase does not address it.