Steel seed storage is the standard for backing up Bitcoin seed phrases against environmental hazards — fire, flood, time, mechanical damage. The premise is straightforward: paper degrades, ink fades, and even archival paper has decade-scale failure modes, while stainless steel or titanium plates that the holder etches or stamps with the seed words survive heat, water, corrosion, and physical impact at levels that materially exceed paper. The complication, established empirically by Jameson Lopp's Metal Seed Storage Stress Tests (four rounds: 2018, 2020, 2022, 2024): roughly half of products marketed as "indestructible" fail one or more of the standard tests — sustained 1,400°F heat (typical of a house fire), acid-immersion corrosion, and mechanical deformation. Specific product choice matters; marketing language is not a guide. The downstream practice covers which products actually survive, stamping versus etching, helpful versus counterproductive labeling, and the discipline of testing before trusting.
Why this note matters
Steel storage is treated as the easy part of seed backup — buy a product, etch the words, store it. The synthesis’s reading is sharper: product selection is non-trivial, the discipline of testing matters, and the failure modes (specific products that fail specific tests) are well-documented. The note matters because:
- It surfaces Lopp’s stress-test results as the empirical foundation. The product landscape is not uniform; specific products have specific failure modes.
- It establishes the testing discipline — testing the product against a sacrificial seed before trusting it with the real one.
- It corrects the “all steel is the same” intuition that newcomers often have when buying their first metal backup.
What this is
A steel seed storage product is a metal substrate (typically stainless steel; some titanium) onto which the holder records the 12 or 24 BIP-39 seed words. The recording method:
- Stamping — using a hammer and individual letter stamps to permanently indent the metal. The classic approach.
- Etching — using a laser-engraved or pre-etched plate where the holder follows pre-cut grooves. Easier; less time-intensive.
- Tile assembly — pre-stamped letter tiles arranged in slots. Some products use this approach.
- Cylindrical capsules — wrapping a printed/etched strip inside a cylindrical housing (Cryptosteel Capsule pattern).
The product market has settled around a few dozen mainstream options ranging from 300+ premium products. Lopp’s stress tests cover most of them.
What metal protects against
- Fire — sustained high temperatures (a typical house fire reaches 1,000–1,400°F sustained for hours). Stainless steel melts at ~2,500°F; structural integrity holds up to that point. Words remain readable if the product was designed for fire survival.
- Water — immersion, flood, prolonged moisture. Stainless steel does not rust meaningfully on relevant timescales.
- Time — paper degrades over decades; ink fades; binding weakens. Steel does not.
- Mechanical damage — drops, impacts, crushing. Steel is harder than paper to destroy through casual force.
- Pests — insects, rodents that can damage paper. Steel is unaffected.
- Chemical exposure — within reason. Stainless steel resists most common chemicals.
What metal does not protect against
- Finding — a steel plate is a steel plate. If found, the seed is exposed. Steel does not provide secrecy; it provides durability.
- Cryptographic compromise — the seed itself is the secret; metal storage doesn’t add cryptographic protection.
- Inheritance failure — a metal backup heirs cannot identify or use is still functionally lost.
- Some specific failure modes — Lopp’s tests have surfaced specific products that fail under specific conditions. See below.
When to use this
Steel storage is appropriate for:
- Any hardware-wallet setup — Tier 1+ holdings should have metal backup. Paper alone is not adequate for substantial holdings.
- Long-term cold storage — the multi-decade discipline that paper cannot sustain
- Inheritance scenarios — metal survives the holder for the duration heirs may need to find it
- Multisig — each key’s seed should be on metal; this is non-negotiable for Tier 2+
Steel storage is less critical for:
- Tier 0 hot wallets — paper is fine; the wallet’s expected lifespan is short and the value at risk is small
- Truly temporary setups — testing a new device, a short-term spending wallet
- Memorized-and-rehearsed seeds — some holders maintain memorized seeds with regular rehearsal; metal is still recommended but the urgency is lower
How steel storage works in practice
Product categories
Stamping-based plates
The classic approach. The product is a stainless steel plate with marked positions; the holder uses a hammer and individual letter stamps (typically 1/8” or 3/16” stamps) to indent each letter of each word into the plate.
Pros:
- Maximum durability — stamped indentations survive nearly anything
- No moving parts; nothing to fail
- Easy to inspect after the fact
Cons:
- Time-intensive (24 words × first 4 letters of each word × stamp-and-hammer for each letter)
- Requires manual dexterity and good lighting
- Each character takes ~10 seconds of focused work; a 24-word seed takes 30+ minutes
- Mistakes are difficult to correct (some products have erasable mistake-tolerance; many don’t)
Representative products: Blockplate, Cryptotag (titanium variants), older Cryptosteel models.
Letter-tile assembly
Pre-stamped letter tiles fit into slots on a base plate. The holder arranges tiles to spell out the seed words.
Pros:
- Faster than stamping
- Easier to correct mistakes (just remove and replace tiles)
- No specialized tools needed
Cons:
- Tiles can come loose; assembly depends on the housing integrity
- Some products fail Lopp’s drop tests (tiles dislodge under impact)
- Heat performance varies
Representative products: Cryptosteel Capsule (cylindrical tile-housing variant), some BillFodl models.
Etched / engraved plates
Pre-laser-cut plates where words are already inscribed; the holder follows pre-defined paths to indicate seed words by hammering or punching specific markings.
Pros:
- Very fast (minutes rather than tens of minutes)
- Easy to learn
- Wide product variety
Cons:
- Some products fail heat or corrosion tests
- The product’s quality varies substantially
Representative products: SafePal Cypher, COBO Tablet, various budget plates.
Cylindrical capsules
A printed metal strip is wrapped inside a cylindrical capsule. The capsule provides physical protection; the strip carries the seed.
Pros:
- Compact; easy to store
- Capsule survives some impacts well
Cons:
- Performance varies considerably across products
- Lopp’s tests have surfaced specific failures in this category
Representative products: Cryptosteel Capsule (Solo and Duo variants).
Lopp’s stress-test framework
The empirical foundation. Lopp tests each product against:
- Fire test — sustained 1,400°F for one hour (simulates structural house fire)
- Corrosion test — immersion in hydrochloric acid
- Mechanical test — drop tests, crush tests
- Specific product quirks — e.g., for capsule products, whether the seed remains readable after the capsule is opened post-test
The 2024 round (the most recent) tested approximately 30 products. The general findings:
- High-quality stamped stainless steel plates (Blockplate, similar) survive nearly all tests
- Titanium products (Cryptotag) survive all tests but cost substantially more
- Letter-tile products show variable performance; some Cryptosteel models do well, some don’t
- Budget etched plates fail more often than premium options
- Approximately 40-50% of products marketed as “fire-proof” or “indestructible” fail at least one test in the 2024 round
The implication: marketing language is not a guide. Specific product choice should reference Lopp’s tests directly.
The “first stamp on a sacrificial seed” discipline
Before stamping the real seed onto the product, do a practice run with a different (sacrificial) seed:
- Stamps require some hand-strength and accuracy; first attempts are often uneven
- Some products have failure modes that only surface in actual use (the stamps don’t impress deeply enough, the tiles don’t seat properly, etc.)
- The discipline catches product-specific issues before the real seed is committed
This is operationally simple — generate a dummy seed (any hardware wallet can do this), stamp it onto the product, evaluate the result, then wipe and proceed with the real seed.
Labeling pattern
A common decision: whether to label the metal backup with descriptive text (“Bitcoin seed phrase, generated 2026”), wallet identification (“BTC primary wallet”), or to leave it deliberately ambiguous.
Arguments for labeling:
- Heirs can identify what the object is
- The holder can identify which wallet the seed belongs to (relevant for multisig with multiple seeds)
- Makes finding the right backup faster
Arguments for ambiguity:
- An unlabeled metal plate found by a burglar is less obviously “money”
- Plausible deniability against casual discovery
- Less easy to social-engineer information about the holding
The synthesis’s read: for inheritance-integrated setups, labeling helps. For the strongly privacy-conscious or those concerned about local-physical-attacker threats, ambiguity helps. Both are defensible; the right choice depends on threat-model priorities.
A common pattern: minimal labeling on the metal itself (perhaps a small wallet-fingerprint code), with the full identification in the inheritance documentation that references each backup.
Tradeoffs and considerations
Product price vs survival
Lopp’s data: more expensive does not always mean better survival, but the most-survival-tested products are typically in the 200 range. Premium products (30-$60) have variable performance; some survive, many fail.
The synthesis recommendation: choose a product Lopp has specifically tested and that passed all tests. Don’t optimize on price beyond the threshold of “tested-and-passed.”
Stainless steel vs titanium
- Stainless steel: standard; melts at ~2,500°F; survives typical house fires; most products use grade 304 or 316
- Titanium: higher melting point (~3,000°F); more expensive (~5× steel); marginal improvement for most realistic threats
For most holders, stainless steel is adequate. Titanium is appropriate at Tier 3 or for holders with specific reasons (industrial-fire risk near the storage location, etc.).
The “etched + filled” question
Some products use etching followed by ink-filling — the etching provides the physical record; the ink improves readability. Under sustained heat, the ink burns away; the etching remains, but readability degrades. This is a real consideration: a backup that survived a fire but is illegible is structurally lost.
The mitigation: choose products where the inscription is etched deep enough to be readable without ink-fill, or where the post-heat state has been Lopp-tested for readability.
Multi-backup product economics
For multisig, the holder may need 3-5 metal backups. The per-backup cost compounds:
- Tier 1 single-sig: 2 backups × 160
- Tier 2 2-of-3 multisig: 3 backups × 240
- Tier 3 3-of-5 multisig: 5 backups × 400
- Plus descriptor backups (paper or simpler) alongside each
For Tier 2+, the total backup cost is non-trivial but small relative to the holding it protects. The principle: don’t economize on the backup discipline; the cost is bounded.
Disguise and “in plain sight”
Some products are deliberately disguised — a metal-card the size of a credit card; a metal box that looks like a household item. The argument: a burglar searching a home is less likely to identify a disguised backup.
The counter-argument: a sophisticated attacker knows the major hardware-wallet products and the major metal-backup products. The disguise works against casual discovery but not against motivated attackers. The defence’s effectiveness depends on the threat model.
For most holders, the choice is product-quality-first; disguise is a secondary feature.
Storage container considerations
The metal backup itself is durable; the storage container affects findability and additional protection:
- Fire-resistant safe — adds resistance against extended fires; some products are rated specifically for media (paper-resistant ratings are stricter than steel-resistant ratings)
- Bank safe deposit box — institutional security; geographic constraint
- Discrete storage — at a non-residential address; with a trusted party
- Specific-purpose containers — some metal-backup products ship with their own housing
The general principle: the storage container is secondary to the backup itself. A high-quality metal backup in a basic container is structurally safer than a budget backup in a premium safe.
Comparison with alternatives
| Approach | Fire survival | Water survival | Decade-scale survival | Cost | Setup time |
|---|---|---|---|---|---|
| Paper (standard) | None | Poor | Poor | $0 | Minutes |
| Paper (archival) | Poor | Poor | Adequate | $5 | Minutes |
| Standard stainless steel plate | Good | Excellent | Excellent | $80 | 30 min |
| Titanium plate | Excellent | Excellent | Excellent | $200 | 30 min |
| Pre-etched ink-filled (budget) | Variable | Good | Adequate | $30 | 10 min |
| Cylindrical capsule | Variable | Excellent | Good | $100 | 15 min |
| Memorized only | N/A | N/A | Poor (holder unavailability) | Free | Variable |
| Encrypted digital | N/A | N/A | Excellent (with infrastructure) | Free | 5 min |
The clear winner for substantial holdings: high-quality stamped stainless steel plate. The clear loser: paper alone for any holding past Tier 0.
Tiered application
Tier 0: Paper is adequate; metal is fine if the holder wants it.
Tier 1: Two metal backups; high-quality stainless steel; verified before funding.
Tier 2: Three or more metal backups across geographic locations; consider some titanium for the most critical key; the descriptor backed up on paper alongside each.
Tier 3: Same as Tier 2 with attention to jurisdictional distribution; possibly titanium throughout; some holders use SLIP-39 with each share on metal; trust-vehicle integration.
In all tiers, the discipline: the metal backup must have been tested before being trusted. Practice stamping on a dummy seed; verify the product holds up to what you need it to.
Common pitfalls
Choosing the cheapest product available. Budget products vary substantially in survival. Lopp’s stress tests are the empirical guide; products that fail tests should be avoided regardless of price.
Trusting marketing language. “Indestructible,” “fire-proof,” “1000-year survival” — these claims are not validated by any standards body. Lopp’s tests are the most reliable independent verification.
Skipping the practice-stamping step. First-time stampers often produce uneven results; some products have failure modes that only surface in actual use. Practice on a dummy seed.
Not verifying the backup against the device. Some holders stamp the seed and never re-verify against the hardware wallet. The wipe-and-restore test (see Recovery rehearsal practice) catches transcription errors at setup.
Co-locating metal backups. Two metal plates in the same home is one location. Geographic distribution is the structural requirement.
Treating metal as exposure-proof. Metal protects against environmental damage. It does nothing against finding. A discovered metal backup is structurally equivalent to a discovered paper backup — both expose the seed.
The “fancy disguise” optimization. Disguising the backup as a household item is a marginal defence against casual discovery; it is not a defence against motivated attackers. Don’t trade product quality for disguise features.
Forgetting the descriptor. For multisig, the metal-backed seeds without the descriptor are not sufficient for recovery. Back up the descriptor alongside each seed (paper or metal; paper is often acceptable for the descriptor specifically).
The “12 words save metal” pattern. Some holders argue that 12-word seeds are sufficient and reduce metal-backup cost. The argument is valid; 12 words is cryptographically sufficient (128 bits of entropy). But 24 words provides partial-loss tolerance (a 1-2 word loss is brute-forceable) that 12 words does not. The marginal metal cost ($20 difference in many products) is rarely the right place to economize.
Stamping the entire word vs first four letters. BIP-39 words are uniquely identified by their first four letters. Stamping only the first four letters saves time and reduces error surface; the four-letter representation is unambiguously recoverable. Some products are pre-laid-out for four-letter input; some require full words. Either works; four letters is the efficient pattern.
Tooling and resources
Lopp’s stress test reports (as of 2026-05-14):
- Available at blog.lopp.net under the Metal Seed Storage Stress Test series
- Four rounds: 2018, 2020, 2022, 2024
- Each round tests new products and re-tests some previous ones
- Comprehensive product-by-product survival results
Mainstream products tested in 2024:
- Blockplate (stamped stainless steel) — strong survival
- Cryptotag (titanium) — strong survival; premium price
- Cryptosteel Capsule (Solo and Duo) — variable; specific models do well
- BillFodl — adequate; some failure modes
- SafePal Cypher — variable
- COBO Tablet — variable
- Hodlinox — strong survival; lower availability
- Stamp Seed kits — depend on substrate quality
For current results, consult Lopp’s reports directly.
Other resources:
- The Blockchain Commons Smart Custody Book — backup chapter; treats steel storage substantively
- Hardware-wallet vendor documentation — most vendors recommend specific steel products
- Casa and Unchained guidance — sometimes include preferred-vendor lists
The synthesis document: Bitcoin Self-Custody & Security (LegacyCipher, April 2026) — steel storage treated within the broader backup-discipline framework, with explicit reference to Lopp’s stress tests.
As of 2026-05-14: the product landscape is mature. New products appear periodically; consult Lopp’s most recent stress test before purchasing. The general principle — stainless steel, stamped, from a tested vendor — is stable across rounds.
Open questions for further development
- Lopp’s stress tests use a specific methodology (1,400°F sustained one hour; HCl immersion; etc.). Are these tests representative of realistic threats, or do they overweight some failure modes and underweight others?
- Some products have introduced “tamper-evident” features (seals that show if the product has been opened). For some threat models this is useful; for others it is irrelevant. Should the framework engage this category?
- The labeling-vs-ambiguity question is unsettled. Is there research on actual burglary patterns that would inform the decision? The synthesis treats it as a personal threat-model choice without strong recommendation.
- Titanium products are 3-5× more expensive than stainless steel for marginal additional survival in realistic scenarios. Is this ever the right tier-3 choice, or is it always marketing-driven over-engineering?
Related notes
The framing context:
- Loss vs exposure failure modes — metal protects against environmental loss specifically
- Threat modeling for self-custody — environmental category is the primary defense metal addresses
- Self-custody configuration ladder — metal backup is the operational substrate across configurations
Adjacent discipline notes:
- Backup strategies for seeds — the broader framework metal storage fits within
- Recovery rehearsal practice — verifies the metal backup actually works
Storage and key concepts:
- Seed phrases and BIP-39 — the artifact being stored
- Passphrases and the 25th word — passphrase backup discipline differs (paper sometimes adequate)
- BIP-85 child seeds — the master seed deserves the highest-quality metal
- SLIP-39 and Shamir Secret Sharing — each share on metal
Hardware wallets:
- Hardware wallets overview
- All per-device notes generate the seeds that the metal stores
Operational practice (remaining):
- Common attack vectors — physical discovery of metal
- Common failure modes in self-custody — untested metal backup
Inheritance:
- Inheritance planning for bitcoin — heir identification of metal backups
The principal practitioner:
- Jameson Lopp — Metal Seed Storage Stress Tests are the empirical foundation
The sub-MOC home: