Overview

You've created a wallet — congratulations. Now comes the single most important skill in all of crypto: keeping it safe. This isn't the scary part. It's the empowering part. Once you understand a few simple ideas, you'll handle your XRP with the same calm confidence you'd handle cash in your pocket.

Here's the big shift to get comfortable with. In the traditional world, a bank guards your money for you. If you forget your password, they reset it. If a scammer drains your account, the bank can often reverse it. On the XRP Ledger, there is no bank in the middle. You are your own bank — which is wonderful for freedom, and means the responsibility for safety sits with you. This module gives you the habits to carry that responsibility lightly and well.

Your recovery phrase is the key to everything

When you set up your wallet, you were given a list of words — usually 12 or 24 of them — called a recovery phrase (also known as a seed phrase). Write this down somewhere in your mind right now: that phrase is your money.

Think of it like the master key to a safe. Anyone who has the words can open the safe and take everything inside. It doesn't matter what password or PIN you set on the app — the recovery phrase sits above all of that. Behind the scenes, those words are what mathematically prove the account is yours and authorize every transaction you make.

Two consequences follow, and they're the whole reason this module exists:

If someone else learns your phrase, they control your money — instantly, completely, and there's no undo button. Transactions on the XRP Ledger are final; no administrator can reverse them.
If you lose your phrase and lose access to your device, your money is gone for good. Nobody — not Xaman, not Ripple, not "XRPL support" — can recover it for you, because nobody else ever had it.

That sounds heavy, but it leads to one beautifully simple rule that protects you from almost everything: never, ever share your recovery phrase, and never type it into anything except your own wallet app when it's setting up or restoring. No legitimate person, website, support agent, or giveaway will ever need it. Ever.

"Not your keys, not your coins"

You'll hear this phrase constantly in the crypto world, and now you can decode it. The "keys" are your recovery phrase. The saying means: if you don't hold your own recovery phrase, you don't truly own your crypto — someone else does.

When you leave XRP on an exchange or an app where the company holds the keys for you, you're trusting that company the way you trust a bank — except it usually isn't protected like a bank. If they get hacked, freeze withdrawals, or simply disappear, your money can vanish with them. People have lost real savings this way.

Holding your own keys is called self-custody, and it's exactly what your personal wallet gives you. The trade-off is honest: more freedom and control, in exchange for taking backup seriously. The rest of this module is simply how to hold up your end of that bargain.

Backing up your phrase safely

A good backup is one that survives the bad day — a lost phone, a fire, a flood, a theft. Here's how to do it well.

Do:

Write it on paper, by hand, and store it somewhere private and durable — a safe, a locked drawer, a security deposit box. Many people make two copies kept in two different places.
Consider a metal backup plate if you're holding meaningful value — paper burns and water-damages; stamped metal survives.
Keep it offline. The strength of your phrase is that it lives nowhere a hacker can reach over the internet.

Never:

Never take a photo of it or store it in your phone's gallery, notes app, email, or cloud storage. Those sync to the internet and are exactly where attackers look first.
Never type it into a website, a "wallet validator," a support chat, or a form — that's always a scam, with no exceptions.
Never store it where one accident wipes out the only copy.

A simple test: if your phone fell in a river tomorrow, could you still recover your wallet from your written backup? If yes, you've done this right.

Phishing and the scams to know

Almost no one gets robbed by some genius breaking encryption. They get tricked into handing over their phrase or signing something they shouldn't. This is called phishing, and recognizing the patterns makes you nearly immune.

The common XRPL and crypto scams to watch for:

Fake support and "verify your wallet." A message, email, or pop-up claims there's a problem and asks for your recovery phrase to "fix," "validate," or "secure" your account. Real support never asks for it. Walk away.
Fake wallet apps and websites. A lookalike app or a site at a slightly misspelled address steals your phrase the moment you enter it. Only ever download wallets from the official source, and bookmark the real sites so you're not retyping addresses.
"Free airdrop" and giveaway scams. "Send 100 XRP and get 1,000 back!" or a surprise token appears in your wallet inviting you to a site to "claim" it. Free money is the oldest bait there is. If it sounds too good to be true, it is.
Impersonation. Scammers pose as famous people, projects, or community members on social media and in chats, often with urgency ("offer ends in 1 hour!"). Urgency is a manipulation tactic — slow down, and the trick falls apart.

Your two best defenses cost nothing: never share your phrase, and read every transaction your wallet asks you to approve before you sign it. When in doubt, do nothing.

Hardware wallets: an extra lock

A hardware wallet is a small physical device, a bit like a USB stick, that stores your keys completely offline and signs transactions inside itself — so your phrase never touches your internet-connected phone or computer at all. Think of it as moving your valuables from a wallet in your pocket to a vault.

You don't need one to start, and for small amounts your phone wallet (like Xaman) is perfectly reasonable. But as your holdings grow, a hardware wallet is the natural next step — it's one of the strongest protections available against malware and online theft. If you buy one, buy it new from the official maker, never second-hand, and always set up a brand-new recovery phrase on the device yourself.

Check

You're done when you can explain, in your own words, what a recovery phrase is (the master key that is your money), why "not your keys, not your coins" matters (only you control crypto when only you hold the phrase), and how to spot a scam (anyone asking for your phrase, or offering free money, is lying).

For your artifact, write a short personal security checklist: where your recovery phrase is backed up, how your phone or device is secured, and 5 things you will always or never do (for example: "I will never type my phrase into a website" / "I will always read a transaction before signing"). Keep it somewhere you'll actually see it.

Wallet Security & Best Practices