Twelve Words
Around 500 BC, the poet Simonides of Ceos was hired to perform at a banquet in Thessaly. As Cicero tells it, the host, a nobleman named Scopas, was irritated that much of the ode praised the twin gods Castor and Pollux instead of himself. He offered only half the fee and suggested the twins could pay the rest.
Midway through the meal, a servant told Simonides that two young men were waiting outside to see him. He stepped out. Nobody was there.
Behind him, the roof of the banquet hall came down.
The guests were crushed beyond recognition. Families came to claim their dead and could not tell one body from another. Simonides could. He closed his eyes and walked the hall in his mind, recalling where every guest had been sitting: this one by the door, that one beside the host, a third at the far end of the table. Seat by seat, he named the dead, and each family had someone to bury.
Tradition credits that night with the invention of the art of memory. It was the discovery that an ordered structure, held in a single mind, can rebuild a room that no longer exists. The Greek root of the idea is mnēmē, memory, and the English word for the technique, mnemonic, descends from it.
So it is quietly remarkable that when the cryptography world needed a name for twelve ordinary words that can regenerate a person’s keys, it chose “mnemonic phrase,” and then almost entirely forgot where the word came from.
Every Device Is a Roof
I think about that banquet hall more than I’d like to admit, because every device you own is a roof.
A phone goes into the sea. Or onto a train seat nobody notices. Or into a drawer in a country you’ve just left. What follows is not dramatic. It is administrative, and it lasts about a week.
You reclaim your number: one queue, one identity check at the carrier. You try to sign in to your email and are asked for a code, sent to the phone that no longer exists. You try the backup email, which asks for a code, sent to the phone that no longer exists. Every service you built your life on has its own recovery ritual: a form, a photo of yourself holding an ID, a wait of three to five business days, a support agent who can see your account and is not allowed to give it back. The thirty small keys in your authenticator app, each enrolled separately and none of them transferable, start again from zero.
A week of evenings, gone. And through all of it, one thing stays true: every one of those recoveries is being run by someone else. Someone else holds the seating chart. You are asking them, politely, to remember where you were sitting.
That is the time tax in its most concentrated form, not a thousand small cuts but one deep one. It exists because recovery, on almost every platform, is a favour, and it lasts only as long as the platform is willing to extend it.
Coopa was built on the opposite premise. When the roof falls, the seating chart should be in your own head.
The Sentence I Got Wrong
Last week ended with a question: what happens the day you can no longer produce the signature? This is the answer. But before I give it, I owe you a correction.
In an early piece in this series, I wrote that from twelve words “everything else derives,” your identity included. In the Quarterly Review, I admitted that one early description of our identity system had run ahead of the engineering. That was the one.
Here is the accurate version. The part of Coopa that says this is me rests on your fingerprint and, separately, on your wallet. Two channels, two jobs. The twelve words are a third thing: the root from which the keys that guard your files are born, and the way back to them when everything else is gone.
Not your name. Your keys’ birthplace. None of the three can stand in for another, and that separation is not an accident, as you’ll see in a moment.
Dealt, Not Chosen
The words are dealt to you, not chosen by you. A phrase you invent is a password in disguise. A phrase drawn at random from a fixed list is something else entirely. Twelve words from a list of 2,048 carry 128 bits of unpredictability, a number with thirty-nine digits. They follow an open standard called BIP-39, used across the industry, so no engineer in any decade needs us to explain what those words are. Nobody gets there by guessing.
They are generated on your device, shown to you at setup, and never sent to us. We do not store them, log them, or keep a copy in some vault for emergencies. We don’t have them to lose.
From them, your keys are born and then packaged, sealed under the words and a passphrase you choose.
That sealed package is written to the same permanent network that holds everything else you trust to Coopa. To everyone but you, it is noise, and that includes us. Even where the backup lives is something only the words and passphrase can point you to.
Get Coopa Assistant’s stories in your inbox
Join Medium for free to get updates from this writer.
So here is the sentence this whole series keeps circling. If you lose the words and the device, we cannot help you. Not because a policy forbids it, but because there is nothing on our side to help with. The shape of the system doesn’t contain a door.
The Day We Stopped Making You Type Them
I want to tell you about a mistake that looked like a feature.
In an earlier version, Coopa treated the twelve words like a key you carried everywhere. Signing out wiped everything your device had remembered, so signing back in meant going through the words again. It felt rigorous. It was wrong in a way that took us a while to name: a recovery phrase you use every day is not a recovery phrase. It is a password with extra steps, and every use is another chance for the words to be photographed, pasted into the wrong window, or read over a shoulder.
So we changed it. Day to day, you never touch the words. Your device keeps a sealed working copy of your keys that only your fingerprint opens. Signing out clears what’s held in memory but leaves that sealed copy alone. The words went back to their proper job: the thing you hope never to need, kept somewhere safe, and left alone.
Coming Home Without Becoming Everyone
Now the scenario all of this exists for. The wallet is gone. The device is gone. You have twelve words and the passphrase you set beside them.
You enter them. If your device holds no copy, Coopa fetches your sealed backup from the permanent network and opens it on your device. We have run this end to end, live, and your stored files are there.
You can see them. You can download them.
What you cannot do is change anything. No uploads, no sharing, nothing that writes. For that, you bring your wallet back. That is deliberate. The session you receive is short-lived and does not renew itself, and it is strictly read-only, because we designed recovery around one uncomfortable question: what if somebody else has your twelve words? A stolen phrase should be able to return you home. It should not be able to rearrange the house.
The recovery path even uses a key of its own, isolated from your wallet’s, so a leak of one can’t open the other.
There are limits, and I would rather name them than have you discover them. Today, this door opens onto your stored files, not every room in Coopa. Which other rooms recovery should reveal is a decision we are making deliberately, one at a time, rather than by default. And one limit no engineering removes: the words have to be born while you still have everything else. A recovery phrase created after the loss is just a new phrase.
No Partial Credit
The first time we tested recovery end to end, it failed.
The words were right. The passphrase was right. What broke was that the words had been pasted with their list numbers still attached (“1.”, “2.”, a line break after each), and the system, correctly, derived a completely different key from the slightly different text. Nothing about it was close. A key made from almost the right words is not almost right. It is entirely wrong, and the error it throws tells you nothing.
Worse, the screen only said the login hadn’t worked, with no trace of why.
We fixed both. Recovery now forgives how the words were written down, whether numbers, line breaks, or stray spacing, because humans copy things badly. The setup screen has a copy button so the words travel clean. And a failed recovery no longer vanishes without leaving a trail.
In the Quarterly Review I wrote that encryption does not care what you meant. This was the day we felt it. Mathematics offers no partial credit, so the system has to be generous everywhere mathematics is not.
What Else Is Born Here
There is one more thing the words are the birthplace of. I’ve left it for last because it changes what a lost phrase would mean.
Among the keys born from those twelve words are keys that don’t only protect. They sign.
One of them is built to outlast the cryptography most of the internet runs on today.
That means the words are not only how you get back to what you’ve hidden. They are, quietly, how you will be able to say something to the world: this existed. And have the world check it without asking you, or us.
But a signature, as we saw last week, proves who spoke. It says nothing about when. Anyone can claim a file existed last year. Anyone can sign today and say yesterday.
So what would it take for a signature to prove not just who, but when?
