Your BitBox device password protects your hardware wallet against unauthorized physical access. It is required every time you unlock your BitBox and confirms that only you can use the device.

This guide explains how the BitBox device password works, how BitBox limits password attempts, and how to choose a password that is both secure and easy to use.

What is the BitBox device password?

The device password unlocks your BitBox hardware wallet. Without it, no transactions can be confirmed and no wallet data can be accessed on the device.

The device password:

• Protects your BitBox against unauthorized physical access
• Is required every time you unlock the device
• Is not the same as the optional passphrase (see below)

How BitBox protects your device password

BitBox devices are designed to strictly limit password guessing attempts. This means your device password does not need to be extremely long to be secure.

BitBox02 (standard model)

The BitBox02 uses two independent protection mechanisms:

• Firmware limit:
  After 10 incorrect password attempts, the device automatically resets to factory settings. Your funds remain safe as long as you have your backup, but the device must be restored.
• Secure chip protection:
  The secure chip includes an internal counter that permanently locks the device after approximately 730,000 unlock attempts (successful and unsuccessful combined).
  This equals roughly 100 attempts per day for 20 years.

Even if one protection layer were bypassed, the other would continue to limit password attempts.

BitBox02 Nova

The BitBox02 Nova introduces an additional improvement:

• The 10-attempt limit is enforced directly in hardware by the secure chip, not only by firmware.

This makes physical attacks even harder, because the password attempt limit cannot be bypassed by firmware manipulation.

Shared protection (defense in depth)

Both BitBox02 and BitBox02 Nova use a defense-in-depth design:

• Firmware layer (main microcontroller): limits password attempts and handles user interaction using open-source code.
• Secure chip layer: enforces hardware-level limits and protects sensitive data.

Together, these layers ensure that password guessing remains strictly limited, even under physical attack scenarios.

To learn more about how BitBox achieves this layered approach, see our detailed blog post:
Best of both worlds: using a secure chip with open source firmware 

Recommendations for your device password

Because BitBox strictly limits password attempts, security depends mainly on randomness, not extreme length.

We recommend:

• Length:
  Use 5 or more random characters
• Character variety:
  Combine:
  • Uppercase letters (A–Z)
  • Lowercase letters (a–z)
  • Numbers (0–9)

Why this is sufficient

Even if an attacker could somehow bypass the first protection layer, the probability of guessing your password before hitting the secure chip’s limit is extremely low:

• 5 random characters: ~0.08 %
• 6 random characters: ~0.012 %
• 7 random characters: ~0.00002 %

A password with 5 or more random characters offers an excellent balance between security and usability.

If you use multiple BitBox devices or different hardware wallets, always choose a unique device password for each one.

Important: Device password vs. optional passphrase

Do not confuse the device password with the optional passphrase (also called the BIP-39 passphrase).

Device password

• Unlocks your BitBox hardware wallet
• Protects against unauthorized physical access
• Covered by this article

Optional passphrase

• Creates additional, separate wallets
• Must be much longer and more complex
• Follows different security rules

For a detailed comparison, see:
Device password vs. optional passphrase: what’s the difference and when to use each 

FAQ

What happens if I enter the wrong password too many times?

After 10 incorrect password attempts, the BitBox02 and BitBox02 Nova reset to factory settings.
Your funds remain safe as long as you still have your backup (microSD card or recovery words).

Does the BitBox02 Nova add new password protection features?

Yes. The BitBox02 Nova enforces the 10-attempt limit directly in hardware, making physical attacks even more difficult.

Do I need a longer password for extra safety?

Not necessarily. Because password attempts are strictly limited, randomness matters more than length.
A short but random password (5 or more mixed characters) is already very secure.

For more details about BitBox security design, see:
Security on every level