Trezor increases wallet passphrase limit to 128 characters

Hardware wallet manufacturer Trezor has increased the maximum length of optional wallet passphrases from 50 to 128 characters. The update, included in the October Trezor Suite release, is available for Model T, Safe 3, Safe 5, and Safe 7 devices following firmware updates. The Model One device remains limited to a 50-character cap.

Trezor cited recent security incidents involving Coldcard devices as a primary motivation for the change. In those instances, a firmware flaw reportedly allowed attackers to reconstruct recovery phrases due to insufficient randomness. Trezor noted that strong, unique passphrases helped protect some users during those attacks.

A passphrase functions as an additional layer of security alongside a recovery phrase. If an attacker obtains a recovery phrase, they still require the correct passphrase to access the specific wallet. However, Trezor warns that passphrases cannot be changed or recovered if lost, which would result in a permanent loss of access to those funds.

Separately, Trezor advised customers who purchased devices from former authorized reseller CryptoBilis since March to move their funds to new wallets. This follows a report from an Indonesian customer regarding a suspected implant in a Trezor Safe 5 device designed to capture and transmit sensitive information.