The seed phrase, shown once
At sign-up Pigeon shows you 24 words. They are the only way to take your account back from a thief, and Pigeon shows them exactly once.
What the words are Built
- 24 words from the standard BIP39 English list.
- They encode the 32-byte seed of your account's next key, and nothing else.
- They don't contain your account id: whoever finds the words shouldn't learn whose account they open.
- The checksum uses a Pigeon-only label, so a cryptocurrency wallet rejects a Pigeon phrase, and Pigeon rejects a wallet's, in 255 cases of 256.
Why only once
Your devices don't keep the words. After sign-up a device holds only a hash of the next key, so a thief with your unlocked laptop finds nothing there that can take over your account. If the app could show the words again, so could anyone holding the device.
So the words stay in memory only until you've confirmed them, and are then wiped. There's no “show my seed phrase” button anywhere, and going back to the words counts as a second showing, so it isn't offered. The screen says it plainly: Pigeon does not keep these 24 words. After you leave this screen, they cannot be shown again.
The sign-up check Built
- Enter your invite code, then choose a name.
- The 24 words appear in a numbered grid. You can copy them (the clipboard is cleared after 60 seconds, if it still holds them) or save them to a file.
- You're asked for 3 of the words, at random positions. The first four letters of each are enough.
- After 3 wrong tries you get a new phrase and start again.
The step can't be skipped. The account is created only after the check, so quitting halfway leaves nothing behind. Blocking screenshots of the words on Windows is Planned; Linux offers no way to block them, and the screen says so.
What the words can do
- Rotate your keys Built: entering them makes a new account key and cuts out every device you don't keep. You then get a new phrase, shown once.
- Quarantine a stolen device at once Planned: part of time-locked rescue.
If you lose them
Your account keeps working on your devices. But you can't make a fresh phrase without the old one (a new next key needs a rotation, and a rotation needs the phrase), and if every device is lost too, the account is gone. Pigeon runs no account recovery: nobody, including us, can restore it.
Restoring with the words brings back your identity, not your history: old messages stay on your old devices.
Keep the words on paper, away from your devices. A phrase stored on a device counts as part of that device: whoever has the device has it.
Sources: docs/specs/seed-phrase-v2.md, docs/ui/seed-phrase-signup.md, ADR-0005 (decision 3, amendments 2 to 4).
Related: identity and the key log, how the desktop app keeps the words off its bridge.