A recovery phrase is useful only when it can recreate the intended wallet and remains secret. Many owners discover a problem only after losing a device, because they never tested the backup, forgot a passphrase, or restored the wrong account path. A controlled drill turns recovery into a documented procedure. It should use no meaningful funds, no cloud copy, and a separate test environment.
Map the wallet configuration
Before the drill, record the wallet brand, software version, network, account type, derivation path, address format, and whether a passphrase or multisignature policy is used. Keep these notes separate from the phrase. A phrase can restore multiple accounts depending on path and passphrase; an empty first account does not automatically mean the backup is invalid.
Create an isolated test
Use a spare device or a clean, offline setup following the manufacturer’s instructions. Do not paste the phrase into a web form, command shell history, screenshot tool, or shared document. If a passphrase is used, enter it only through the documented device flow. The test environment should not have access to the funded wallet’s signing session or browser extensions.
Restore and compare public data
Restore the phrase, select the documented network and path, and compare the first several receive addresses with the original wallet’s public records. Address equality is stronger evidence than a familiar account label. For a multisig wallet, verify the descriptor, cosigner fingerprints, quorum, and script policy. Keep only public addresses and a pass/fail result in the drill report.
Use a small proof transaction
If the policy allows, receive a tiny test amount and send it to a separate test address. Verify the receive address on the device, the fee, and the transaction id. This proves that the restored wallet can derive and sign the intended path, but it does not test every account or future firmware version. Do not reuse a funded address merely to make the test convenient.
Test passphrase and human factors
A passphrase is not a recovery phrase extension that can be guessed later. Test the exact capitalization, spacing, and entry sequence, then record a non-secret hint about the procedure. If trusted successors are involved, rehearse roles without revealing the phrase to everyone. A backup plan that depends on one person’s memory is a single point of failure.
Seal the result
After the drill, wipe temporary device data and return the test device to a known state. Store the phrase on durable material in a controlled location and inspect it periodically for damage without photographing it. Update the public procedure when the wallet version, path, or multisig participants change. If the restore produces different addresses, stop using the suspected backup and investigate before moving funds.
Recognize false confidence
A cloud password manager, a phone photo, or a “support backup” may be convenient but expands the attack surface. Conversely, a metal plate does not prove the words were written correctly. The drill is the evidence: it demonstrates that the exact secret, configuration, and instructions work together without exposing the secret to an unauthorized system.
Worked example: wrong derivation path
A restored phrase can appear empty when the wallet opened account path m/44 rather than the original m/84 or a platform-specific path. Compare several public receive addresses before concluding that the phrase failed. For a passphrase wallet, test the exact capitalization and spacing; the wrong passphrase creates a different valid wallet. Keep the public comparison in the drill report and destroy temporary exports. If the restored addresses never match, stop using the suspected backup and move no funds until the configuration and phrase are independently reviewed.
Operational handoff
The drill record should also state the test date, device model, software version, and who observed the comparison. That detail lets the owner distinguish a damaged backup from a changed wallet configuration. Keep the report public-data-only and store the secret in its normal protected location. If a trusted successor needs to know where the backup is, write access instructions without writing the words themselves. Review those instructions after a move, a new household member, or a change in the multisignature policy.
Frequently asked question
How often should a recovery drill run?
Run one after initialization and repeat it after a material change such as a new passphrase, wallet software, derivation path, or multisig participant. The interval should reflect the value and the physical durability of the backup.