Trezor Doubles Wallet Passphrase Limit to 128 Characters
The longer cap ships on four Trezor models, while Coldcard owners face weak seeds generated before the firmware fix.
Updated on Nov. 2, 2026 in Cybersecurity
Live Poll
Do you trust crypto hardware companies to keep your savings secure?
Trezor raised the maximum wallet passphrase length from 50 to 128 characters on its Model T, Safe 3, Safe 5 and Safe 7 hardware wallets, shipped in the October Trezor Suite update. The Model One stays at 50 characters.
Why it matters
A longer passphrase raises the cost of guessing a wallet's secret phrase, a key defense for self-custodied crypto holdings. The change lands days after Coinkite disclosed a separate firmware flaw that left some Coldcard devices with weak wallet backups, putting hardware-wallet entropy under scrutiny.
Trezor's new 128-character ceiling replaces the previous 50-character cap on the affected models. On the Coldcard side, the Mk3's roughly 40 bits of real randomness fell well short of the roughly 72 bits in the Mk4, Mk5 and Q, a gap the fixed firmware versions were released to address.
The players
Trezor
A hardware wallet maker whose devices store private keys offline for self-custodied cryptocurrency holdings.
Coinkite
The maker of the Coldcard hardware wallet line, which disclosed the firmware flaw affecting some of its devices.
The details
A BIP-39 passphrase is an optional extra word or phrase combined with a wallet's seed words, and the wallet derives keys from the pair using PBKDF2-HMAC-SHA512 run for 2,048 iterations. A longer allowed passphrase lets users choose a harder-to-guess secret, since guessing attempts must run through that same iterated derivation. In the Coldcard case, a call to the hardware random number generator silently fell back to a software one, and a compile-time guard meant to catch the fallback used the wrong directive and never fired.
Timeline
A commit dated 1 March 2021 introduced the Coldcard randomness regression.
Coinkite disclosed the Coldcard firmware flaw on 30 July 2026.
The longer Trezor passphrase limit shipped in the October 2026 Trezor Suite update.
Trezor announced the passphrase change on 1 November 2026.
The Tech Race
Hardware-wallet makers are competing on how much user-chosen secret material their devices accept on top of the BIP-39 standard. Coinkite's disclosure shows the competitive pressure now centers on verifiable randomness in key generation, not just passphrase length.
Owners of Trezor Model T, Safe 3, Safe 5 and Safe 7 devices can now set passphrases up to 128 characters after the October Trezor Suite update, while Model One owners remain capped at 50. Owners of affected Coldcard devices should check which firmware version their unit runs, as the fixes do not repair seeds that were already generated.
The takeaway
Watch whether Coinkite publishes an account of how many Coldcard seeds were generated with the weak entropy, since that figure will show how broad the exposure is. Owners of Coldcard devices should move funds to a freshly generated seed on fixed firmware, since existing seeds cannot be repaired in place.
Further reading
For the wider threat picture behind wallet and key-management failures, see the Cybersecurity section.
Source note: This article includes information reported by FinanceFeeds.
Live Poll
Do you trust crypto hardware companies to keep your savings secure?
