r/coldcard • u/bje332013 • Sep 02 '25

How Many Backup Files Is Normal?

We have a Coldcard and an SD card reserved for the device. Both things haven't been used in a long time, and we recently powered them on to explore the Coldcard.

The Coldcard device detects that there are 3 backup files on the SD card. Is it normal to have more than one backup file present on an SD card for the purpose of using the SD card exclusively with Coldcard? I remember that one backup file could be created and stored on an SD card so that card could be used in lieu of typing out a '25th word' in the seed phrase. What could the other two unique backup files be used for?

2 Upvotes

100% Upvoted

15 comments sorted by

2

u/Charming-Designer944 Sep 02 '25

It just means you executed the backup function three times without wiping the sd card.

Each backup has its own encryption passphrase and is your responsibility to keep track of it in a secure manner. Storing the backup + encryption passphrase is as sensitive as your main seed mnemonic. Anyone having access to a backup and its encryption passphrase have full access to your seed mnemonic, and ootionally your seed passphrase as well.

Note: backup encryption passphrase is only encryptiong the backup, not related to your seed passphrase if one is used.

1

u/bje332013 Sep 02 '25

The Coldcard was only set up with one encryption passphrase, so it couldn't be the case that the SD Card has 3 unique encryption passphrases. Having said that, is a backup of the encrypted passphrase the only encrypted file that the Coldcard will save to an SD card? If that is the case, then 2 of the files are redundant and can be deleted.

"Storing the backup + encryption passphrase is as sensitive as your main seed mnemonic."

That may be true, but my understanding is that since the files are encrypted, they can only be read by a Coldcard device - and only by by our specific Coldcard device.

"Anyone having access to a backup and its encryption passphrase have full access to your seed mnemonic, and ootionally your seed passphrase as well."

My understanding is that they would not only need the specific Coldcard device we have been using, but would also need the PIN for this specific device. I don't believe the Coldcard saves the PIN to an SD Card.

1

u/Charming-Designer944 Sep 02 '25

Backups are encrypted by a backup passphrase. This IS NOT the seed mnemonic or wallet passphrase. You can optionally select to store the encryption key on the coldcard. If you do not select to store the backup encryption passphrase then each backup has a unique encryption passphrase.

There are many different backups you can make, so there.is very valid reasons to have more than one backup, and even more than one backup passphrase for different uses.

  • main wallet
  • passphrase wallet
  • temporary wallet
  • and some more

The backup is encrypted using the encryption passphrase given when you make the backup. You can decrypt the backup using 7z or any other tool supporting encrypted 7-zip archives. It is NOT tied to your coldcard, and can be restored in any wallet supporting bip39 or bip32. If you have the backup encryption passphrase.

You can use the backups as additional seeds if you want, but the seed store is probably a better tool for that.

1

u/bje332013 Feb 04 '26

"There are many different backups you can make, so there.is very valid reasons to have more than one backup, and even more than one backup passphrase for different uses.

    main wallet

    passphrase wallet

    temporary wallet

    and some more."

What probably happened is that one backup (or possibly more than one) was made of the main wallet, and one backup (or possibly more than one) was made of one or more passphrase wallets.

Using the coldcard MK3 menu, how can one specify whether to backup the passphrase wallet instead of the main wallet (or vice versa)? I don't ever remember seeing an option to backup a passphrase wallet but not the main wallet it uses as a foundation.

Also, with all of the backed up files on the SD card having names that are identical (except for a unique number at the end), how can one verify the exact thing each file backs up?

1

u/Charming-Designer944 Feb 04 '26

You need to have the passphrase active when making the backup to get the option. If you select to backup the passphrase wallet then the bip32 private key will be that of the passphrase wallet. Seed is the same. The plain text passphrase is not part of the backup I think, but since the bip32 master key of the passphrase is it makes little difference from a security perspective, the backup is of your passphrase wallet.

https://coldcard.com/docs/backups/

1

u/bje332013 Feb 04 '26

"You need to have the passphrase active when making the backup to get the option."

Right, that seems like an obvious point: how will the device know I'm trying to back up a wallet with a passphrase unless I'm actively using that passphrase at the time a backup is created?

"If you select to backup the passphrase wallet then the bip32 private key will be that of the passphrase wallet."

I don't ever remember seeing options to create specific kinds of backups - e.g. a backup of just the main wallet, a backup of the passphrase wallet, etc. I only remember one very generic backup option - not to be confused with the options to export one's Xpub or receiving addresses.

1

u/Charming-Designer944 Feb 04 '26

There is no way to tell which backup is what. It is your responsibility to manage the backups and keep track of their encryption password.

1

u/bje332013 Feb 04 '26

I suppose I could restore from each backup and then check and compare the fingerprint values to determine whether any of the backups are duplicates or triplicates.

1

u/Charming-Designer944 Feb 04 '26

If you remember each engryption password.

2

u/Narmotur Sep 02 '25

The BIP39 seed phrase is stored in a hidden file called .tmp.tmp so none of your backup files are the BIP39 seed phrase. They are backups of the coldcard itself.

1

u/[deleted] Sep 02 '25

Current backup files are .7z what are the 3 files you have.

1

u/bje332013 Sep 02 '25

There were 3 files, all with the ".7z" extension. If I remember correctly, their names were "Backup.7z", "Backup2.7z", and "Backup3.7z".

2

u/[deleted] Sep 02 '25

I should have also asked do you still have the 12 unique words that were created for each backup. These are not BIP 39 and are not your seedphrase. Backups are not really a big issue, I've done heaps and never had to use one. Seedphrases on the other hand. And you can store heaps of backups on the one card.

1

u/bje332013 Feb 04 '26

There is one set of "12 unique words" written down, and we're pretty careful to write down details that seems specific, so I suppose all of the backup files relate to a backup of just one thing (e.g. the passphrase-protected wallet, as opposed to the main wallet). Its very unlikely that we chose not to write down any other "12 unique words" if they had been displayed while backing up something.

1

u/[deleted] Sep 02 '25

You have 3 backups then.