Is a 24-word phrase easier or harder to recover than a 12-word?

With the same number of missing words, 24-word is actually easier to validate because the checksum is 8 bits instead of 4 — fewer false positives. But the total entropy is higher (256 vs 128 bits) so more missing words become infeasible faster. In practice both are recoverable up to 4 missing words.

BIP39 Seed Phrase Recovery With Missing Words

Q: Can I recover a BIP39 seed phrase with missing words?

Yes, if you are missing 1–4 words out of 12 or 24. The BIP39 checksum (last 4–8 bits of the final word) filters invalid guesses so only phrases that produce a real wallet address survive. Four missing words from a 12-word phrase is about 2,048^4 = 1.76 × 10^13 combinations, which is feasible on a GPU in a few days. Five or more missing words is mathematically out of reach.

Q: How does the BIP39 checksum work?

BIP39 phrases encode entropy plus a checksum. A 12-word phrase carries 128 bits entropy + 4 bits checksum; 24-word is 256 + 8. The checksum is the first N bits of SHA-256(entropy). When you try candidate seed combinations, any wrong guess has a 1-in-16 (12-word) or 1-in-256 (24-word) chance of a false checksum match, which is why 24-word phrases are much faster to validate.

Q: Which tool recovers BIP39 missing words?

btcrecover (Python, open-source) is the standard tool for BIP39 seed recovery. It supports unknown-word positions, typo rules, and derivation checking against a known address. For Slip39/Shamir share recovery use seedtool-cli from Blockchain Commons.

Q: I remember words but not the order — can that be solved?

Yes. 12! = 479 million permutations, 24! = 6.2 × 10^23. For 12 words: trivially brute-forceable against the checksum in seconds. For 24 words: only feasible if most positions are known and only a few are swapped. btcrecover supports position-unknown and swap ranges.

Short answer (featured snippet)

You can recover a BIP39 seed phrase if you are missing 1 to 4 words. With 4 missing words from a 2048-word list, the search space is 2048⁴ ≈ 1.76 × 10¹³ combinations. The BIP39 checksum filters 93.75% of guesses (12-word) or 99.6% (24-word), and derivation-to-known-address filters the rest. A modern GPU completes this in 1–5 days. Five or more missing words is computationally infeasible — do not pay anyone who claims they can do it.

How BIP39 actually encodes entropy

BIP-0039 defines how random entropy is turned into a human-memorable mnemonic. A 12-word phrase encodes 128 bits of entropy plus a 4-bit checksum; a 24-word phrase encodes 256 + 8. Each word maps to 11 bits (2048 = 2¹¹).

# 12-word construction
entropy   = 128 random bits
checksum  = first 4 bits of SHA-256(entropy)
combined  = entropy || checksum          # 132 bits
words     = split(combined, 11)          # 12 groups of 11 bits each
            # each group indexes the 2048-word list

# 24-word construction
entropy   = 256 random bits
checksum  = first 8 bits of SHA-256(entropy)
combined  = entropy || checksum          # 264 bits
words     = split(combined, 11)          # 24 groups

From the seed, a PBKDF2-HMAC-SHA512 with 2048 iterations and an optional passphrase produces the 64-byte master seed used by BIP-0032 to derive all child keys.

What "missing words" actually costs

Each missing word multiplies the search space by 2048. After the checksum filter, only 1-in-16 (12-word) or 1-in-256 (24-word) candidates survive. Here is the concrete math:

Missing	Raw combos	After 12w checksum	After 24w checksum	Feasibility
1	2,048	128	8	Trivial (seconds)
2	4.2 M	262 k	16 k	Easy (minutes)
3	8.6 B	537 M	33 M	Hours on CPU
4	1.76 × 10¹³	1.1 × 10¹²	6.9 × 10¹⁰	1–5 days GPU
5	3.6 × 10¹⁶	2.3 × 10¹⁵	1.4 × 10¹⁴	Weeks–months
6	7.4 × 10¹⁹	4.6 × 10¹⁸	2.9 × 10¹⁷	Infeasible

"Feasible" assumes you also know the derivation path (e.g. m/44'/0'/0'/0/0) and a destination address to check against. Without an address, every checksum-valid candidate is a potentially valid wallet and you cannot tell which is yours.

The tools that actually work

btcrecover (Gurnec fork)

The btcrecover project is the de-facto standard for BIP39 recovery. It handles:

Unknown word positions (? placeholders)
Swap two adjacent words, reverse order
Typo substitution (words that sound or look similar)
Derivation against BTC, ETH, LTC, BCH, and more
GPU acceleration via OpenCL for PBKDF2 (the slow step)

# 4 unknown words in a 12-word phrase, BTC address known
python seedrecover.py \
    --mnemonic "abandon ? ? ability ? access ? action actor add adult" \
    --addrs 1PKN98VN2z5gwSESbmhbLBSeXDzY5ortXu \
    --wallet-type bip39 \
    --addr-limit 10 \
    --language en

seedtool (Blockchain Commons)

For SLIP-0039 Shamir share recovery (common with Trezor T). Handles threshold math and per-share checksums differently from BIP39.

Common user mistakes

Similar-word confusion

BIP39 authors deliberately avoided pairs like "board/boat" — each word's first 4 letters are unique. But users still mix up dash/dawn, march/marine. btcrecover's --typos 2 handles this.

Wrong word list

BIP39 has 10 languages. If you used a Trezor in English but think the words look French — always try the English list first. Mixing languages in one phrase is invalid.

Transposed words

"Did I write them bottom-up or top-down?" Both directions are worth trying. Also check column-first for grid paper backups.

Forgotten passphrase ("25th word")

Trezor and Ledger support an optional BIP39 passphrase. If set, the real wallet is at seed + passphrase. This is a separate recovery problem — the seed alone will derive an empty wallet. See wallet recovery.

When to stop trying

Keep trying

• 1–4 missing words from 12 or 24
• Word order uncertain but all words present
• 1–3 typos suspected
• You have a destination address for verification

Stop

• 5+ missing words
• No idea what derivation or address to target
• Passphrase set AND unknown AND seed incomplete
• You only have fragments that may not be BIP39 at all

Scam warning

If you post any of your known words on Reddit, Telegram, or Discord asking for help — your remaining balance will be drained within hours. Bot scrapers run btcrecover with the partial phrase and sweep the wallet. Never share even partial BIP39 words publicly. Submit to a legitimate recovery service under NDA, or run btcrecover yourself offline.

Frequently asked questions

Can I recover a BIP39 seed phrase with missing words?

Yes, if 1–4 words are missing. The BIP39 checksum filters most invalid guesses and derivation against a known address confirms the real one. 5+ missing words is computationally out of reach.

How does the BIP39 checksum work?

The last N bits of the final word are SHA-256(entropy)[0:N] — 4 bits for 12-word, 8 bits for 24-word. A wrong guess has a 1-in-16 or 1-in-256 chance of a false checksum match.

Which tool recovers BIP39 missing words?

btcrecover (Python, open-source) — supports unknown positions, typos, and derivation matching for BTC/ETH/LTC/BCH and more.

Is a 24-word phrase easier or harder to recover than 12?

With the same number of missing words, 24-word validates faster (8-bit checksum filters 255/256 guesses vs 15/16 for 12-word). But total entropy is doubled, so the infeasibility wall arrives at similar missing-word counts.

I remember words but not the order — can that be solved?

For 12 words, 12! ≈ 479 M permutations — brute-forceable in under a minute. For 24 words, only feasible if most positions are known and only a few are swapped. btcrecover has an --big-typos swap mode.

Need help running the recovery?

If you'd rather not run btcrecover yourself, we offer signed-NDA remote recovery — you share partial words and addresses, we never ask for known-good words. Pay only if we succeed.

Start seed recovery Avoid scams guide

BIP39 Seed Recovery With Missing Words