Rehearse wallet recovery without turning the seed into a test input

Practical guide · prepared 19 September 2026. Sources were checked for this workflow; linked interfaces and policies can change. Research scope.

A recovery phrase is not a quiz answer. Typing it into a website, notes app or ordinary desktop wallet to see whether it works can convert a resilience exercise into a key-compromise event. A useful rehearsal proves three different things: the words are correct, the intended wallet is recreated, and the operator can identify the right accounts. It should not require sending funds or exposing the phrase to a general-purpose computer.

Pick the least revealing test

If the signing device offers an on-device backup check or dry-run recovery, use that feature first. Trezor's backup troubleshooting guide describes its check as a way to confirm the recorded words before a reset or firmware update. Its separate backup guidance says not to keep digital copies and not to enter the backup except when the device prompts for it. Those are vendor-specific controls, not proof that every device implements the same protection. Follow the current manual for the exact model.

Before touching the backup, close cameras, put phones away, clear the workspace and confirm that no support session or screen-sharing tool is active. Inspect the device prompt itself. A support agent, browser dialog or desktop form asking for seed words is not a recovery check.

Separate four failure cases

1. Words rejected: stop and repeat once slowly. Do not edit the paper record based on a guess.
2. Words accepted, wrong wallet appears: check passphrase use, network, account type and derivation path. An omitted passphrase can produce a valid but different wallet.
3. Correct addresses, missing labels: the cryptographic recovery may be sound while metadata is absent. The descriptor and portability checklist covers the non-secret context a seed may not restore.
4. Device cannot complete the check: preserve the existing working signer and consult the manufacturer's official procedure. Do not wipe the only functioning device merely to make the drill feel complete.

Use a spare device carefully

A full restore onto a spare signing device can test more of the path, but it increases handling. Verify that the spare is authentic, reset, supported and operating offline as the vendor instructs. Enter the phrase on the device, not its companion computer. Before funding or moving anything, compare several receive addresses against records from the original wallet. Then wipe the spare if it is not meant to become a second signer. This test creates another temporary copy of the secret in hardware, so it is not automatically superior to a built-in dry run.

Record evidence, not secrets

Write down the date, device model, firmware version, check method, whether the correct wallet fingerprint and sample addresses appeared, and any unresolved dependency. Do not record the words, passphrase or PIN in the drill log. Schedule the next rehearsal after a material wallet change, a backup relocation, a firmware migration or a change in who must perform recovery.

The earlier guide A wallet backup is a recovery plan explains why possession of words is not enough. This workflow supplies the operational test. Passing it proves that a defined recovery path worked at one moment; it does not prove the paper will survive a fire, that heirs know the procedure, or that future software will preserve every wallet-specific feature.