Passphrase Entropy: Why Ledger and OneKey May Have an Edge Over Trezor

Passphrase Entropy and Hardware Wallets: Rethinking Trezor’s Approach

Trezor has long taken one of the cleanest approaches to passphrase security in the hardware-wallet industry.

The philosophy is straightforward: the passphrase is not stored on the device.

Each time a passphrase-protected wallet is accessed, the user provides the passphrase again. Trezor combines that passphrase with the wallet backup to derive the corresponding wallet. A different passphrase derives a different wallet.

From a security-design standpoint, the appeal is obvious. If the passphrase is never retained by the hardware wallet, compromising the device does not automatically provide that additional secret.

It is a disciplined and defensible model.

But the discussion changes once the passphrase is considered through the lens of entropy rather than simply password complexity.

That is where Ledger and OneKey deserve a closer look.

Why Passphrase Entropy Changes the Hardware-Wallet Debate

A passphrase should not simply be another password.

Something like:

MyWAllet2046$

may look complicated, but complexity is not the same thing as unpredictability.

A stronger model is to construct a passphrase from words selected independently and randomly from a sufficiently large word list.

Using a 7,776-word 5 Diceware-style list, each randomly selected word contributes approximately 12.9 bits of entropy:

Entropy = number of words × log₂(7,776)

That produces a very different security profile.

*Illustrative average assuming 10 million guesses per second and that the correct passphrase is found after searching 50% of the total keyspace. Actual attack speeds vary by implementation, hardware, key derivation, and future technology.

The most important number in that table may not be the estimated crack time.

It is 7,776.

Every additional independently random word multiplies the search space by another 7,776 times.

That is the power of entropy.

Six Random Words Are Already Formidable

This is an important correction to the way passphrase strength is sometimes discussed.

A six-word truly random Diceware passphrase is not merely “moderately strong.”

It provides approximately 77.5 bits of entropy.

Under the illustrative assumptions above, an exhaustive attack would average roughly 350 million years.

The precise number of years is not the point. Faster or slower guessing assumptions can move that estimate dramatically.

The underlying entropy does not change.

The attacker still faces approximately:

221,073,919,720,733,357,899,776 possible combinations.

That makes six properly generated random words an extraordinarily substantial secret for most realistic self-custody threat models.

Seven words push the passphrase beyond 90 bits.

Eight push it beyond 100 bits.

At that point the practical problem is no longer simply:

How do we make the passphrase stronger?

It becomes and HEAR ME OUT...

How do we make a passphrase this strong practical to use?

And that is where the hardware-wallet architectures begin to diverge.

Trezor Keeps the Passphrase Outside the Device

Trezor's answer is security separation.

The wallet does not permanently retain the passphrase, so the user must provide it again whenever that passphrase-derived wallet is accessed. There is no doubt this approach has a lot of merit. 

In fact, it creates an extremely clean boundary:

Wallet backup + passphrase = hidden wallet

Neither component alone is sufficient.

Without hesitation, there is considerable security value in that architecture.

BUT, BUT, imagine routinely using a seven- or eight-word random passphrase.

A passphrase might look something like:

harbor velvet canyon orbit lantern fossil meadow

The words are intentionally random. They are not a sentence, quotation, name, date, or memorable personal phrase.

Now enter that sequence every time the wallet needs to be accessed. Using your thumb. Even on a Trezor Safe 7 2.5" diagonal screen. Let's not even go there with the Safe 3 or Safe 5. Do you see and feel the challenge?

That is where cryptographic strength begins colliding with human usability.

Ledger and OneKey Solve the Usability Problem Differently

Ledger and OneKey allow a passphrase-derived wallet to be associated with a PIN.

The strong passphrase can be created once and protected as an important offline secret.

The user can then access the corresponding passphrase wallet using the associated PIN.

Conceptually:

Recovery seed + high-entropy passphrase > passphrase wallet

Then:

Associated PIN > access that wallet

This separates two jobs that are often incorrectly expected to be performed by the same secret.

The passphrase provides the entropy.

The PIN provides convenient device access.

That is a surprisingly elegant solution.

It allows the passphrase to become longer and more random without making routine wallet use increasingly painful.

And that may actually encourage better security behavior.

There Is a Security Tradeoff  - But It Needs to Be Put in Context

Trezor's architectural advantage should not be dismissed.

If the passphrase is not stored on the device, then defeating the device's PIN protections does not automatically reveal the independent passphrase.

Ledger and OneKey expand the device's security boundary by retaining what is necessary to reopen the passphrase-derived wallet after the associated PIN is entered.

That is a real difference.

The more useful question, however, is whether that tradeoff outweighs the operational advantage of making very high-entropy passphrases practical.

PIN-protected hardware wallets also employ protections designed to prevent unlimited PIN guessing. A stolen wallet is not intended to function like a website login page where an attacker can simply try every PIN indefinitely.

That does not make physical compromise impossible.

Sophisticated hardware attacks, firmware vulnerabilities, supply-chain compromises, implementation errors, side-channel attacks, or failures in secure-element protections remain part of the threat model.

No architecture removes every risk.

But neither should hardware-wallet security be evaluated as though the human using the device does not exist.

Convenience Can Be a Security Feature

Security discussions sometimes treat convenience as the enemy.

That is too simplistic.

Suppose two users begin with the same eight-word random passphrase providing more than 100 bits of entropy.

One enters a short PIN during normal use.

The other must manually enter all eight random words every time the wallet is accessed.

Which configuration is more likely to still be using the original eight-word passphrase several years later?

Which user is more likely to eventually decide that four words are sufficient?

Or substitute something easier to remember?

Or store the long passphrase somewhere less secure simply because it is constantly needed?

A security architecture that creates excessive friction can encourage users to weaken the very secret the architecture is designed to protect.

That is not a theoretical concern.

It is operational security.

And operational security matters just as much as theoretical cryptographic purity.

COLDCARD Helped Push the Entropy Conversation Forward

One valuable contribution from COLDCARD has been its emphasis on thinking about security in terms of entropy rather than appearances.

Dice-based entropy generation is a particularly useful illustration because it forces the user to confront randomness mathematically.

A secret does not become strong because it contains punctuation, capitalization, substitutions, or something that looks complicated to a human.

It becomes strong because the attacker cannot predict it.

The same principle should apply to BIP-39 passphrases.

The goal should not be:

Create something complicated.

The goal should be:

Create something sufficiently unpredictable.

Once that distinction is understood, the attraction of PIN-bound passphrases becomes much clearer.

A six-, seven-, or eight-word truly random passphrase can provide enormous entropy.

The remaining challenge is making that secret practical enough that users will actually continue using it.

Ledger and OneKey address that problem directly.

The Crack-Time Numbers Need Context

Time-to-crack estimates are useful because they translate enormous search spaces into something humans can intuitively understand.

But they should never be mistaken for guarantees.

The estimate for six random Diceware words changes depending on whether an attacker can test:

10,000 guesses per second,

10 million,

1 billion,

or vastly more.

The underlying entropy does not change.

That is why entropy and total search space are better long-term measurements than a headline claiming something will take a certain number of years to crack.

There is another complication when discussing BIP-39 wallets.

A BIP-39 mnemonic and passphrase are processed using PBKDF2-HMAC-SHA512 with 2,048 iterations. A real attack therefore involves computational work beyond simply comparing ordinary plaintext passwords.

For that reason, generic password-cracking benchmarks should be treated cautiously when applied directly to hardware-wallet passphrases.

The important lesson is not that six words are guaranteed to take exactly 350 million years to crack.

The lesson is that 77.5 bits represents an enormous search space, and every additional random Diceware word multiplies that space by another 7,776.

Trezor's Position Remains Highly Defensible

None of this diminishes Trezor's broader security philosophy.

Its commitment to open-source self-custody and transparent security remains a significant strength.

Its passphrase model is internally consistent:

The passphrase is an independent secret.

The hardware wallet should not retain that secret.

Therefore, the user provides it whenever the corresponding wallet is needed.

There is nothing irrational about that position.

But it is also reasonable to ask whether refusing to retain the passphrase creates too much friction once users begin working with genuinely high-entropy passphrases.

For someone using a short or easily entered passphrase, the inconvenience may be trivial.

For someone using seven or eight truly random words, it becomes significant.

That is precisely the kind of user for whom Ledger and OneKey's architecture becomes compelling.

Maybe There Is No Perfect Hardware Wallet

Hardware-wallet design is a continuing exercise in tradeoffs.

Trezor offers an open-source philosophy, strong transparency, and strict separation of the passphrase from the device.

Ledger makes long passphrases substantially easier to use through secondary PIN access, while making different architectural choices elsewhere.

OneKey provides similar PIN-bound passphrase functionality, including particularly convenient hidden-wallet access, while its software ecosystem introduces its own usability considerations (a different way of thinking about "accounts", "spot", "hidden wallets").

COLDCARD has pushed the industry to think more deeply about entropy but remains intentionally focused on Bitcoin.

Every design gets something right.

Every design compromises somewhere.

Perhaps there is no perfect hardware wallet.

But the ingredients of one are becoming easier to identify:

Open-source transparency. Strong modern hardware security. Broad native-chain support. Reliable account discovery across desktop and mobile. And a practical way to use genuinely high-entropy passphrases without having to manually enter them every time.

On that final point, Ledger and OneKey may have identified something important.

Trezor's model may be the cleaner security architecture.

But when passphrases move from memorable passwords to 77-, 90-, or 100-plus-bit independent secrets, usability becomes part of the security equation.

And that makes PIN-bound passphrase wallets much harder to dismiss.

A strong passphrase is only useful if it survives with you. Once you have gone to the effort of creating a truly random, high-entropy passphrase, protect it with a durable offline backup. The Black Seed Ink steel passphrase backup solution is designed to preserve that critical secret against threats that paper and ordinary digital storage may not survive, including fire, water exposure, corrosion, and long-term environmental damage. Entropy protects the passphrase from being guessed; a resilient physical backup helps ensure that same passphrase is still available when you need to recover your wallet.

Research Lab Disclaimer

This article is provided for educational and informational purposes only and does not constitute financial, investment, legal, tax, or individualized security advice. Entropy estimates assume independently and uniformly selected random words from the stated 7,776-word list. Illustrative brute-force times depend heavily on assumed attack speeds and should not be interpreted as guarantees. Hardware-wallet architecture, firmware, security features, and known vulnerabilities can change over time. No wallet or security configuration eliminates all risk. Independently verify current specifications, understand the tradeoffs of any configuration, maintain secure backups, test recovery procedures, and select a setup appropriate for your own threat model and risk tolerance. Do your own research (DYOR).