Why the backup method matters more than the wallet
Writing your bank PIN on a scrap of paper and hiding it would strike most people as a bad idea. Yet that is roughly what a seed phrase backup is. Anyone who finds the 12 or 24 words has the account, and if the paper is lost, so is the money. It works, but it puts the whole weight of your security on one sheet of paper.
Tangem takes a different approach. Instead of asking you to write down a secret, the cards copy the private key from one secure chip to another without ever exposing it. This article walks through how that copy actually happens, because once you understand it, the “no seed phrase” idea stops sounding like a gimmick.
Where seed phrases go wrong
A seed phrase is “something you know” security, and it fails in two ways:
- Exposure. If the words are seen, photographed or captured digitally at any point, the wallet is compromised. There is no way to tell that it happened until the funds move.
- Loss. Water, fire, a house move or a tidy-up can destroy the only copy. The funds are then gone for good.
Tangem replaces this with “something you have”. Access is tied to a physical chip in your possession, and the backup isn’t a readable secret but a second chip holding the same key. The problem changes from guarding information to looking after a card, which most people are already good at.
How the backup process works, step by step
The copy is a short cryptographic handshake between two cards (or a card and a ring). Here is what happens between unboxing and a finished backup.
Step 1: the key is generated inside the card
Out of the box, Tangem cards are cryptographically blank. No private key for your wallet exists anywhere until you activate it. On the first tap, the secure element in the primary card uses a certified true random number generator to create your private key inside the chip. At that moment exactly one copy exists, and it is in that card.
Step 2: the cards prove they are genuine
When you tap a blank backup card, the two cards first have to prove to each other that they are real Tangem devices. This is mutual authentication.
Every card leaves the factory with its own cryptographic identity, a key pair (Kcardpriv/Kcardpub) signed by Tangem’s manufacturer key. The result is a certificate, a bit like a passport issued by a government you trust.
The cards exchange these certificates and check them against the chain of trust. If either card fails the check, the process stops. A counterfeit or tampered device can’t get as far as receiving a key.
Step 3: they agree on a secret without transmitting it
Once authenticated, the cards still need a private channel. They can’t simply send the key across, even to a trusted peer, because your phone is in the middle. So they do a Diffie-Hellman key exchange.
Each card generates a temporary key pair and shares only the public half. Using its own private half and the other card’s public half, each card independently arrives at the same shared secret (Ktrans). That secret is never sent anywhere. Someone recording the whole exchange would see only public keys and could not reconstruct it.
The usual analogy: two people each mix a private paint colour with the same public colour and swap the results. Both end up with an identical final shade, but nobody watching can work out the private colours that went in.
Step 4: the encrypted copy
With Ktrans known only to the two cards, the primary card encrypts your private key and sends the package to the backup card. The backup card decrypts it with its own copy of Ktrans and writes the key into its secure element.
The private key is never readable outside a secure element. It exists in encrypted form for the fraction of a second it takes to cross, protected by a key that itself was never transmitted. Once your set is finalised, the firmware won’t allow further backups to be made from it, which is why you choose a 2-card or 3-card set up front rather than adding cards later.
Seed phrase backup and Tangem card cloning compared
| Aspect | Seed phrase backup | Tangem card cloning |
|---|---|---|
| Backup form | Words on paper or in a file | A second secure chip holding the same key |
| Main risk | Someone sees or copies the words | Losing every card in the set (which is why sets have 2 or 3) |
| Transfer | You transcribe words by hand | Encrypted chip-to-chip, automated |
| During backup | Key is visible to you and anything watching | Key never leaves a secure element in readable form |
| Verification | You check the words yourself | Cards authenticate each other cryptographically |
What this means day to day
For someone holding crypto in New Zealand, the practical upshot is fairly simple.
- There is nothing to write down, so no misspelt word 17, no wrong order, no missing line.
- If you lose a card, you tap a backup card to your phone and carry on. No 24-word re-entry.
- Inheritance is easier. A backup card plus the access code, left with someone you trust, is a workable plan without them having to learn seed phrase handling.
- Malware, screen recording or someone looking over your shoulder during setup can’t capture the key, because it is never on screen.
The trade-off, stated plainly
Tangem moves the job from guarding a secret to keeping hold of a device. That is easier for most people, but it does mean the cards themselves are the backup. Keep them in separate places, remember your access code, and if you want a belt-and-braces option the app can also generate a seed phrase for your wallet. Most owners don’t bother, and that is a reasonable choice as long as all the cards aren’t in one drawer.
If you’d like to see the process for yourself, Tangem NZ is an authorised New Zealand seller with 2-card and 3-card sets in stock in Auckland, priced in NZ$ including GST. Setup, including the backup, takes a few minutes.
