Trezor Raises Passphrase Limit to 128 Characters

Hardware wallet manufacturer Trezor has increased the maximum length of the optional passphrase from 50 to 128 characters. On Sunday, the company announced that the change is available in Trezor Suite with the updated device firmware; the limit remains 50 characters on the old firmware.

The passphrase acts as an additional password that the user sets along with the wallet recovery phrase. Even if an attacker obtains the recovery phrase, they would need the correct passphrase to access the funds.

Trezor referred to the July attacks on Coldcard, where a firmware vulnerability caused some devices to generate recovery phrases with insufficient randomness, allowing attackers to recover them. According to the company, strong unique passphrases protected some users whose wallet recovery information was compromised. The incident involved damages of around $100 million.

The update followed a separate warning about Trezor's own devices. On Friday, the company advised customers who purchased wallets from former authorized reseller CryptoBilis since March to transfer their funds to new wallets.

An Indonesian customer reported a suspicious implant inside a Trezor Safe 5, which could read information from the screen, including recovery phrases, and transmit it via the cellular network. Trezor stated that the device has not yet been examined and no reports of related losses have been received.