Your recovery phrase

Your recovery phrase is twenty words. Every key that names your node or holds its funds comes from them, so they are your only backup of who your node is and of the keys to its funds. This page explains what is in the words and where they go.

Twenty words

The words come from the BIP-39 English list that many wallets use, but the phrase is Dassie's own, and only Dassie reads it. A BIP-39 phrase of 12 to 24 words, from another wallet or an older Dassie, is refused.

Dassie's 0.2 releases used BIP-39 phrases, and those don't work from 0.3.0 on. A node from those releases is set up again, from a fresh database, with a new phrase. A node from the 0.2 releases has the steps.

Its twenty words hold four things:

• Its kind, which says the phrase's layout and its realm: test or live.
• When it was made, to the hour. The wallet shows the date with a new phrase, as in Generated 2026-02-19.
• A secret of 128 random bits, which everything else derives from.
• Six check words, which let Dassie find and fix mistakes.

The wallet shows a new phrase in two numbered columns of ten, the way a metal backup plate lays them out, with the first four letters of each word in bold: those four letters are all a plate keeps, and all Dassie needs. Then it asks you to type one of the words back. Back up your phrase walks through it.

Why it works this way rather than as a BIP-39 phrase

Test or live

A phrase names its realm, and the realm goes into every key. The same secret is one node in the test realm and a different node in the live realm, with different accounts, so a phrase you test with never puts real money behind the same keys. A node refuses a phrase of the other realm, at setup and at login.

Dassie takes test money only, so every node runs in the test realm, and every phrase your wallet makes is a test phrase.

Mistakes it forgives

When you enter your phrase, you can type each word whole or just its first four letters, in any case. The wallet shows what each word reads as while you type, and flags a word that is not on the list.

• If you cannot read a word, mark it as unreadable, or type ? in its place.
• The check words fix up to two wrong words. With words marked unreadable, they fix those too, as long as twice the wrong words plus the unreadable ones come to five or fewer. Past that, the phrase is refused as too damaged.
• A phrase is never fixed behind your back. The wallet shows the corrected words, marked, and takes the phrase only once you confirm them.

A phrase says when it was made, so a phrase dated more than a day after the reader's clock is refused, with its date. Most often the reader's clock is behind; set it right and try again.

What your node gets

The words stay with you. Your node never sees them.

1. At setup, your browser turns the phrase into your node's key, with the same code the node runs, compiled to WebAssembly.
2. It sends the node that key, and nothing else of the phrase. The node keeps the key in its database, so it can sign and settle on its own.
3. When you log in later, your browser derives a proof from the phrase and sends only that.

The phrase is never stored, in the browser or anywhere else. In the desktop app, the same happens in its window.

What it recovers

Every secret that names your node or holds its funds derives from the phrase: your node's key and node ID, its accounts on the XRP Ledger, its accounts in settlement hubs, the key other wallets know it by, and the secrets its payment requests use. So the same phrase, entered again on a new install, gives the same node ID and the same accounts on the XRP Ledger, with the funds in them.

What the phrase does not hold is what your node learned while it ran: its books, what peers owe it and it owes them, its settings. Those live in its database. Back up and move a node covers that.

One node ID over two keys

Your node has two public keys. Its Ed25519 key signs everything it signs today. Beside it is an SLH-DSA key, a kind of key that quantum computers are not expected to break, which signs nothing yet.

Your node ID is a hash of both keys, written as 39 characters of lowercase letters and the digits 2 to 7: the name your node goes by in its addresses, its DNS name and its logs. Because the ID commits to the second key, your node can one day prove it is still itself with that key, should Ed25519 stop being safe, and keep its ID, its names and its place with its peers.

Proving a node's identity with its SLH-DSA key is not there yet. What's next

Why it works this way

A node nobody logs in to

Some nodes have no browser in their setup: a server you set up by script, or a market maker's node. For those, and only those, the phrase lives in a file on the node's own host, and dassie setup does what the browser would. A market maker reads the same file, for the keys of its node's account on the XRP Ledger.

$sudo dassie setup --passphrase-file phrase.txt

• It reads the phrase once, derives the node key, and wipes the phrase from memory. Still only the key reaches the node.
• It takes the realm from the phrase, and is refused by a node set up with another phrase or in the other realm.
• With no one there to confirm a correction, it refuses a phrase that needs one, and names the positions of the words, never the words. It refuses a phrase dated more than a day after the host's clock, so make sure the clock is set before you run it.

The file stays where you put it, and anyone who can read it holds your node, so keep it readable by you alone. Headless setup has the steps.

Why this exception exists