KeepKey Device Recovery
How to restore your wallet onto a new or wiped KeepKey using your recovery phrase and KeepKey Vault Desktop.
What you need
- A KeepKey device that is uninitialized (new, or wiped — see How to Wipe Your KeepKey)
- Your 12, 18, or 24-word recovery phrase from the original setup
- KeepKey Vault Desktop — download from keepkey.com/desktop
If your device is already set up and unlocking with a PIN, you do not need this guide. This is for restoring an existing seed onto a blank device.
Step 1 — Plug in and open Vault Desktop
Connect the KeepKey to your computer and launch Vault Desktop. An uninitialized device is detected automatically and you'll be offered a choice between creating a new wallet or recovering one.
Click Recover Wallet.
Step 2 — Pick your seed length
KeepKey supports 12, 18, and 24-word phrases. Match the length of the phrase you wrote down originally — guessing wrong will fail the recovery, not silently produce an empty wallet.
If you generated your KeepKey originally and you're not sure how long the phrase is, count the words. There is no security advantage to a 24-word seed for the vast majority of users; 12 words is the standard.
Step 3 — Set a new PIN for this device
The PIN is device-specific, not seed-specific. You're choosing a new PIN for this KeepKey now, even if you had one before.
KeepKey uses a scrambled 3×3 grid. The device shows the digit positions on its screen; the desktop app shows a blank grid in the same layout. You click the positions that match the digits of your PIN.
You'll be asked to enter the same PIN twice to confirm:
Pick a PIN between 4 and 9 digits. The grid reshuffles every unlock, so anyone watching your screen learns nothing useful.
Step 4 — Enter your recovery phrase via the cipher
This is the security-critical part. Instead of typing your seed words directly, you use a scrambled letter cipher that only the device understands.
Average completion time: 5–10 minutes for a 12-word seed.
How the cipher works
Your KeepKey screen shows two rows of letters:
- Top row: A through Z in order
- Bottom row: A scrambled mapping of the alphabet
To enter the letter A, you find A in the top row and look at the letter directly below it in the scrambled row. That's the key you press on your keyboard.
After every keystroke the cipher reshuffles, so even if someone watches your keyboard they cannot reconstruct the seed. Only the KeepKey itself can interpret what you typed.
Tips that save time
- Autocomplete: Most BIP39 words are unique after 3–4 letters. The device shows the matched word and you can press the button to accept it.
- Backspace: You can correct mistakes within the current word.
- Going back to a previous word: Possible, but you must re-enter from that word forward — you can't skip back.
- No mid-flow validation: A misspelled word doesn't fail until the whole phrase is entered. Take your time.
- BIP39 word list reference: github.com/bitcoin/bips/blob/master/bip-0039/english.txt — bookmark this if you need to verify spelling.
Step 5 — Confirm and finish
When the last word is entered and accepted, the device verifies the seed checksum. If everything is valid, you'll see the recovery progress and then completion:
Vault Desktop reconnects to the device, derives your addresses, and drops you into the portfolio. Same wallet, same addresses, same balances — just on a new device.
If recovery fails
Three common causes:
- Wrong word count. You picked 12 but the phrase is 24, or vice versa. Restart and pick the correct length.
- Misspelled word. A non-BIP39 word fails the checksum. Cross-check each word against the official BIP39 English word list.
- Words out of order. The order matters. The phrase only works in the exact sequence you wrote it down.
Unplug and reconnect your KeepKey, then start over. The device does not "remember" failed attempts — it's safe to retry as many times as you need.
Why the cipher exists
A naive recovery flow would have you type your seed words straight into the desktop app. That's exactly the wrong shape for a hardware wallet: the words would touch your computer's keyboard buffer, RAM, and potentially keylogger malware. The cipher solves this by ensuring the desktop app never sees your actual seed words — it only ever sees scrambled letter positions, which mean nothing without the rotating cipher running on the KeepKey screen.
This is the same principle behind the scrambled PIN grid: keep the secret on the device, keep the computer ignorant.
Related
- Recovery Phrase basics — what the phrase is and how to store it
- Updating your KeepKey — keep firmware current after recovery
- BIP39 Passphrase — adding a 25th-word hidden wallet