Temporary Seed

Video: How to Use Temp Seed & Seed Vault

Temporary seed (renamed in 5.2.0 from Ephemeral seed) is a temporary secret completely separate from the master seed, typically held in COLDCARD^® RAM and not persisted between reboots in the Secure Element. Temporary seeds completely defeat the design of Coldcard's security model, based on secure elements. Enable the Seed Vault feature to store these secrets longer-term. Read more about Seed Vault feature below.

Make sure you know what you're doing!

This feature is intended for those one-off signings, like recovering a lost seed from some other system or importing some seed as a balance check. We do not recommend handling unencrypted seed material on a regular basis!

"Temporary" describes how the secret is held by the device; it does not make a weak or exposed seed safer. If a generated Temporary Seed will protect an amount whose loss would be materially harmful to you, use the standard Dice Rolls option and a strong, unique BIP-39 passphrase. Back up the seed and passphrase separately, record the wallet fingerprint, and test recovery before depositing funds. Seed Vault is a convenience copy, not an independent backup.

Usage#

if temporary seed is already in use, first home menu option [<xfp>] is visible with fingerprint of temporary master secret
go to Advanced/Tools > Temporary Seed

generate_temporary_menu

temporary seed words can be generated with device and user entropy
- Advanced/Tools > Temporary Seed > Generate Words
- choose 12 Words or 24 Words
- choose Mash Keys, Dice Rolls, or Coin Flips, then complete the required inputs; the COLDCARD combines them with randomness from the STM32 TRNG and both Secure Elements
- choose 12 Word Dice Roll or 24 Word Dice Roll from the Generate Words Menu to generate from dice rolls only, without hardware-generated randomness

generate_temporary_menu

temporary seed words can be imported
- Advanced/Tools > Temporary Seed > Import from QR Scan (QR-scanner hardware only)
- Advanced/Tools > Temporary Seed > Import Words

main_temporary_menu

importing extended private keys and backups
- Advanced/Tools > Temporary Seed > Import XPRV
- Advanced/Tools > Temporary Seed > Tapsigner Backup
- Advanced/Tools > Temporary Seed > Coldcard Backup to restore from an encrypted .7z backup file
temporary seed can be activated from BIP-85 derived secrets - go to Advanced/Tools > Derive Seed B85 and pick types of secret. Keep in mind that only word based and xprv based secrets can be used as temporary seed.
- 12 words
- 18 words
- 24 words
- XPRV (BIP-32)
- pick derivation Index in next prompt, or just press ✔ for index 0
- Press 2 in next prompt to activate derived secret as a temporary seed
temporary seed can be activated from Duress Wallet
- go to Settings -> Login Settings -> Trick PINs
- add new Duress Wallet trick pin and save it
- choose newly created trick pin in trick pins menu and use Activate Wallet option
- if Seed Vault is enabled, duress wallet can be stored there upon activation as temporary seed
temporary seed can be obtained from SeedXOR
- go to Advanced/Tools > Temporary Seed > Restore Seed XOR
- or go to Advanced/Tools > Danger Zone > Seed Functions > SeedXOR > Restore Seed XOR
- provide all XOR parts
- Press 2 to activate restored seed as temporary seed
BIP-39 passphrase is from version 5.2.0 handled internally as temporary seed

Ability to generate and use Temporary seed is available on Coldcard when:

no PIN chosen and no secret chosen (newly unpacked Coldcard)
PIN set up but no secret chosen yet
with both PIN and secret already picked

Generate#

After selecting 12 Words or 24 Words, generated Temporary Seeds require the same user-entropy step as a new Master Seed: Mash Keys, 50 fair physical die rolls, or 128 fair physical coin flips. Follow the linked instructions when using Mash Keys. Back up the generated words or press 6 to skip the quiz. If Seed Vault is enabled, the COLDCARD then offers to save the Temporary Seed there.

Import#

import_temporary

Import via NFC#

Import temporary seed via NFC. This is mostly for testing purposes as you need to have seed on mobile device which is very insecure.

Trick PIN Notes#

If you intend to use the temporary seed feature frequently, you can define a "Trick PIN" which takes you to a "look blank" trick wallet (i.e. no seed set appears to be set). Then you may then safely unlock your Coldcard, without revealing the true PIN, and perform all your temporary seed work in that state.

Restore Master#

(new in v5.2.0, requires Mk4)

From version 5.2.0 users no longer need to reboot COLDCARD to return to their "master seed" (one stored in SE2). Once COLDCARD has temporary seed active, first item in home menu is [xfp] and is a clone of Ready To Sign. Last item in home menu is Restore Master.

Restore Master offers two options. First, if user presses ✔, COLDCARD wipes temporary seed settings and switches back to master seed and its settings. If user presses 1 temporary seed settings are preserved for later use and COLDCARD only switches back to master seed and its settings.

If current temporary seed is also saved in Seed Vault, option to wipe settings is not available. Seed Vault entries can only be deleted in Seed Vault menu.

Verify Master Seed#

Knowledge of master seed can be verified without wiping it first, by trying to activate it as a temporary seed:

go to Advanced/Tools -> Temporary Seed
choose how to import - i.e. Import Words, Import XPRV, or Import from QR Scan
expect failure - master seed cannot be used as temporary

master_as_tmp

Seed Vault#

(new in v5.2.0, requires Mk4)

Video: SEED VAULT: Store Many Bitcoin Seeds On A Single Coldcard

Seed Vault adds the ability to store multiple temporary secrets into encrypted settings for simple recall and later use (AES-256-CTR encrypted with your master seed's key). Users can capture and hold a master secret from any Temporary Seed source, including generated words with required user entropy, dice-only words, Seed XOR, TAPSIGNER backups, BIP-85 derived values, BIP-39 passphrase wallets, and duress wallets.

Enable Seed Vault#

Enable this functionality in Advanced/Tools -> Danger Zone -> Seed Vault -> Enable. Once seed vault is enabled new menu item is visible in home menu Seed Vault.

sv0

Below is empty Seed Vault menu which offers shortcut to Temporary Seed menu

sv1

To disable Seed Vault user needs to remove all entries from Seed Vault first.

Add Seed to Vault#

After Seed Vault is enabled, users will see a new prompt, after creation of temporary seed, asking whether to save this temporary seed to Seed Vault. Press 1 to save or any other key to ignore.

If option to save was chosen, confirmation prompt is shown - Saved to seed vault.

if Seed Vault is empty (none saved yet) is the first menu item followed by shortcut to Temporary Seed menu.
if not empty, saved seeds are listed in menu as [xfp]
if current active temporary seed is stored in Seed Vault - it has checkmark next to it
if temporary seed is active - last menu item of Seed Vault menu is Restore Master

Seed Vault entry submenu#

by default [xfp] but can be renamed to allow user labeling and leads to additional information about the seed
Use This Seed allows to switch to the saved temporary seed. If it is already active Seed In Use is shown instead.
Rename allows to change 1. menu item to something personalized to user (limited to 40 characters)
Delete allows to remove temporary seed from Seed Vault and optionally to completely wipe its settings.

Seed Vault Workflow#

install firmware version 5.2.0
enable Seed Vault Advanced/Tools -> Danger Zone -> Seed Vault -> Enable
back in main menu with Seed Vault item visible
choose any option to generate a temporary seed. Here we will use generated words with key-mashing entropy.
go to Advanced/Tools -> Temporary Seed -> Generate Words -> 24 Words -> Mash Keys, follow the Mash Keys instructions, and press ✔/ENTER after completing at least 65 presses
backup generated words or press 6 to skip quiz
press 1 to save entry to Seed Vault
just a confirmation message that seed was saved to Seed Vault - press ✔ to continue
looking at the master fingerprint of new temporary wallet - press ✔
back in home menu, and we can see temporary wallet master fingerprint at the top
go to Seed Vault and you will see fingerprint from above steps listed there with checkmark next to it - meaning currently active
add another seed to Seed Vault by applying a BIP-39 passphrase to the word-based Temporary Seed that is currently active
go back to the home menu, select Passphrase, and enter a passphrase:
- Mk4/Mk5: use Edit Phrase, Add Word, or Add Numbers. Verify the completed value with Edit Phrase, press ✔, and select APPLY.
- Q: type the passphrase with the keyboard, or press QR to scan it, then press ENTER. Q proceeds directly to the confirmation screen and does not have an APPLY menu item.
the confirmation screen shows the new wallet's master key fingerprint at the top and says the passphrase is being added to the current active temporary seed [XFP]. Compare that parent XFP with the Temporary Seed fingerprint from the previous steps. Scroll down to reveal and verify the exact passphrase.

A passphrase entered while a word-based Temporary Seed is active is always applied to that Temporary Seed, not to the Master Seed. There is no parent-seed choice on this screen.
press X if any value is wrong, or press ✔/ENTER to activate the new passphrase wallet
at the next prompt, press 1 to save the new Temporary Seed to Seed Vault (same as step 7.)
a confirmation message says the seed was saved to Seed Vault - press ✔/ENTER to continue
back in home menu, and we can see temporary wallet master fingerprint at the top
go to Seed Vault and you will see both fingerprint from above steps listed there - last added with checkmark next to it - meaning currently active
choose entry from previous step in the menu to see seed entry submenu
choose first menu item with master fingerprint in it which leads to the info about the seed
press ✔ to go back to seed entry submenu, choose Rename and pick new name for this entry and press ✔
top item of submenu is changed from master fingerprint to whatever name was chosen - in my case it is GRANDMA
Go back to Seed Vault menu and see the Rename effect
Pick the seed entry that we created first (generated words with key-mashing entropy). Options to Rename and Delete are not present because we are currently in different temporary seed. Seed Vault entries can only be modified if entry to be modified is currently active temporary seed or if no temporary seed is active.
choose Use This Seed to switch to this temporary secret
go back to Seed Vault and choose current active temporary seed (one with checkmark next to it)
choose Delete and press 1 to only remove seed entry from Seed Vault, but not wipe its settings
Deleted entry is no longer in Seed Vault, but temporary seed is still active as we have not wiped its settings.
Go back to home menu, choose Restore Master and press 1 to preserve settings again. Now we are in home menu again and no temporary seed is active (first item of home menu is not fingerprint)
Go to Seed Vault, choose the other saved seed entry, hit Use This Seed and press ✔ to confirm
Go to Seed Vault again, choose current active seed entry, hit Delete and press ✔ to not just delete from Seed Vault but also wipe its settings and completely forget about it. After this is done user is respawned in home menu with no temporary seed active. Once you decide to wipe settings COLDCARD needs to switch back to master settings.

Last update: August 31, 2026