Steel backups for a 2 of 3 multisig

Last checked 4 November 2026. We do not recommend or rank any backup product, and we have no commercial link with any maker. If anything here conflicts with the linked source, the source wins.

A 2 of 3 multisig is only as strong as its backups. Each of the three keys comes from a recovery phrase, usually 12 or 24 words, and the wallet itself is defined by a wallet configuration file called a descriptor. Paper is fine for a first copy, but paper burns, gets wet and fades. Many companies therefore stamp or engrave each recovery phrase onto stainless steel. This page explains what to put on steel, what must be backed up as well, where each backup should live, and how to check them during the yearly recovery drill.

1. What goes on steel
2. The descriptor backup
3. What independent tests show
4. Where each backup lives
5. Making the plates
6. Checking them in the drill

What goes on steel

Each signer has one recovery phrase. A 2 of 3 wallet therefore has three phrases, and each one needs its own backup. The BIP 39 word list is designed so that the first four letters of each word are enough to identify it, which is why many metal backups store only four letters per word.

Source: Bitcoin BIPs: BIP 39: Mnemonic code for generating deterministic keys, Bitcoin BIPs: BIP 11: M of N standard transactions (multisig).

• One plate per key. Never put two recovery phrases on the same plate or in the same place. Two phrases together are enough to move the funds.
• The words, in order, and nothing else secret. Number each word. Do not add PINs or device passwords.
• A passphrase, if you use one, is a separate secret. Some set-ups add an optional passphrase to a phrase. If yours does, back the passphrase up separately, in a different place from its words, or the key cannot be restored.
• A neutral label. Mark each plate with its key letter (A, B or C) and the key fingerprint from the key register, not with the company name, the word bitcoin or an address.

Source: Bitcoin BIPs: BIP 32: Hierarchical deterministic wallets (extended keys), NIST: SP 800-57 Part 1 Rev. 5: Recommendation for key management.

Why the descriptor must be backed up too

Watch the 60 second version on YouTube.

A single key wallet can be rebuilt from its recovery phrase. A multisig cannot. To find and spend the funds, wallet software needs to know all three public keys, the 2 of 3 rule and the script type. That information is in the wallet descriptor, the short text record defined in BIP 380. Two recovery phrases on their own are not always enough to rebuild the wallet, because the third public key and the exact set-up would be missing.

Source: Bitcoin BIPs: BIP 380: Output script descriptors, general operation (wallet backups and exports).

The descriptor is too long to stamp by hand. It is normally kept as a printed sheet, a QR code, or a file on an encrypted USB drive, sealed with each key backup and also kept in the company records. Some companies also engrave it. Whichever form you choose, test that it can be read back in the recovery drill.

What independent tests show

The most cited independent tests of metal backups are by Jameson Lopp, who stress tested 75 devices. Each was heated with a flame of about 1,093°C for up to 10 minutes and then quenched in water, left in 16% hydrochloric (muriatic) acid for 12 hours, and crushed in a 20 tonne hydraulic press, then checked to see whether the words could still be read. He describes his grading as not highly scientific and his tests as more extreme than most real risks.

Source: Jameson Lopp: Metal bitcoin seed storage reviews: independent stress tests of 75 devices, Jameson Lopp: Stress test methodology: heat, corrosion and crushing, Jameson Lopp: Why stress test metal seed storage devices?.

His results and his design notes point to features rather than brands:

• Solid stainless steel, with the words stamped or engraved into the metal, generally survived better than designs that rely on loose tiles, plastic parts or ink.
• Fewer moving parts means fewer ways for words to fall out or get mixed up.
• Whatever the design, a plate only helps if the words on it are correct, which is why the drill below matters more than the product.

Source: Jameson Lopp: A treatise on bitcoin seed backup device design.

Read the full results and methodology yourself. Prices, models and makers change, and we do not recommend any of them.

Where each backup should live

The point of 2 of 3 is that no single loss, theft or person can lose or move the funds. Backups follow the same rule: one event should never reach two of them.

• Never keep a device and its own backup in the same place, or two backups in the same place.
• Use tamper evident bags with serial numbers and write the numbers in the key register.
• Record the location by role in the key register and treasury policy, never the words themselves.
• Think about who can reach each location if a keyholder is ill, leaves or dies. See keyholder continuity.

Source: NIST: SP 800-57 Part 1 Rev. 5: Recommendation for key management.

Making the plates safely

1. Do it at the key ceremony

   Stamp each plate during the key ceremony, offline, with no phones or cameras in the room.

2. Check every word

   Compare each plate letter by letter with the device or paper copy. A second person can check order and spelling without seeing the other keys' words.

3. Destroy temporary copies

   Once the plate is checked and tested, destroy any scrap paper or decide which paper copy stays as part of the backup. Never photograph a phrase or type it into a computer or phone.

4. Seal and record

   Seal each plate with its descriptor copy, record the bag serial number, location and date in the key register.

Source: Bitcoin BIPs: BIP 39: Mnemonic code for generating deterministic keys, NIST: SP 800-57 Part 1 Rev. 5: Recommendation for key management.

Checking the backups in the recovery drill

The yearly recovery drill is where a steel backup proves itself. For each backup being tested:

• Confirm the sealed bag is where the key register says, intact, with the same serial number.
• Load the wallet watch only from the descriptor copy and check the first receiving address matches the key ceremony record.
• Restore the key from the steel plate onto a reset spare device and check its fingerprint matches the register. This proves the plate is correct and readable.
• Look for rust, damage or worn stamping, and replace a plate that is hard to read.
• Reseal in a new bag and record the new serial number. Rotate which plates you open so every one is checked over three years.

Source: Bitcoin BIPs: BIP 380: Output script descriptors, general operation (wallet backups and exports), Bitcoin BIPs: BIP 32: Hierarchical deterministic wallets (extended keys).

Our judgement, not a rule: steel is worth it for a company treasury, but most losses come from wrong, missing or untested backups, not from fire. A tested descriptor and correct, separated plates matter more than which product you buy.

Read next

• Key ceremony walkthrough: create the keys and backups.
• Recovery drill guide: test the plates every year.
• Multisig for a company: how a 2 of 3 set-up works.

Sources

Primary sources only. Each link was checked on 4 November 2026. Rules change, so confirm the current version with your adviser.

1. Bitcoin BIPsBIP 39: Mnemonic code for generating deterministic keys
2. Bitcoin BIPsBIP 11: M of N standard transactions (multisig)
3. Bitcoin BIPsBIP 32: Hierarchical deterministic wallets (extended keys)
4. NISTSP 800-57 Part 1 Rev. 5: Recommendation for key management
5. Bitcoin BIPsBIP 380: Output script descriptors, general operation (wallet backups and exports)
6. Jameson LoppMetal bitcoin seed storage reviews: independent stress tests of 75 devices
7. Jameson LoppStress test methodology: heat, corrosion and crushing
8. Jameson LoppWhy stress test metal seed storage devices?
9. Jameson LoppA treatise on bitcoin seed backup device design