Most people who arrive at this page have one of three problems: (1) they wrote down 24 words but cannot read part of their handwriting, (2) they wrote down 22 or 23 words and forgot the rest, or (3) they wrote the words in a column but cannot tell the original order. Each of these has a different feasibility profile.
BIP39 mechanics — why partial recovery works
Ledger uses standard BIP39 24-word seeds. The bit layout:
24 words x 11 bits each = 264 bits total
= 256 bits entropy + 8 bits checksum
# Checksum is the first 8 bits of SHA-256(entropy_256_bits)
# Word 24 partially encodes the checksum, so 7 of its 11 bits are
# constrained -> only 8 valid choices instead of 2048.
# This is why a totally random 24-word phrase has only
# 1 in 256 chance of being a valid BIP39 mnemonic.Feasibility table
| Scenario | Search space | RTX 3090 runtime |
|---|---|---|
| 1 word missing (position known) | 2,048 | < 1 sec |
| 1 word missing (position unknown) | 2,048 × 24 | ~2 sec |
| 2 words missing (positions known) | ~4M | ~2 min |
| 3 words missing (positions known) | ~8.5B | ~3-12 hrs |
| 4 words missing | ~17.5T | infeasible (years) |
| All 24 in unknown order | 24! = 6.2e23 | infeasible |
| Misread letter (4+ letter prefix clear) | 1 | instant — word unambiguous |
| 2 swappable adjacent pairs | 4 | instant |
Reading misread handwriting correctly
BIP39 is intentionally designed so the first 4 letters uniquely identify a word. If you can read the first 4 letters, you have the word. If only 2 are clear, build a list of all BIP39 words starting with those letters:
# Find all BIP39 words starting with "ab"
grep "^ab" english.txt
# abandon
# ability
# able
# about
# above
# absent
# absorb
# abstract
# absurd
# abuse
# Now your single misread word becomes a 10-candidate enumeration -
# trivially feasible to brute-force against a known address.btcrecover seedrecover — the practical command
# Case: 23 words known, 1 missing at position 17
python3 seedrecover.py \
--bip39 \
--mnemonic "word1 word2 ... word16 ? word18 ... word24" \
--addrs 1Lbcfr7sAHTD9CgdQo3HTMTkV8LK4ZnX71 \
--addr-limit 20 \
--bip32-path "m/44'/0'/0'"
# Case: 22 words known, last 2 unknown, address is for ETH
python3 seedrecover.py \
--bip39 \
--mnemonic "word1 ... word22 ? ?" \
--addrs 0x742d35Cc6634C0532925a3b844Bc9e7595f0bEb1 \
--addr-limit 20 \
--bip32-path "m/44'/60'/0'/0"
# Case: 24 words but 4 swappable pairs
python3 seedrecover.py \
--bip39 \
--mnemonic "..." \
--addrs ... \
--no-dupchecks \
--typos-swap --typos 4Common Ledger derivation paths
| Asset | BIP32 path | Address format |
|---|---|---|
| Bitcoin (Native SegWit) | m/84'/0'/0'/0/0 | bc1q... |
| Bitcoin (P2SH SegWit) | m/49'/0'/0'/0/0 | 3... |
| Bitcoin (Legacy) | m/44'/0'/0'/0/0 | 1... |
| Ethereum / EVM | m/44'/60'/0'/0/0 | 0x... |
| Ledger Live ETH (older) | m/44'/60'/0'/0 | 0x... |
| Litecoin | m/84'/2'/0'/0/0 | ltc1... |
Recoverable vs not
Recoverable
- • 1-3 missing words at known positions
- • Misread letters with first-4 prefix clear
- • 2-3 swappable adjacent pairs
- • Known address as oracle
Not recoverable
- • 4+ missing words, no constraints
- • All 24 in unknown order
- • No known address to verify against
- • PIN unknown AND seed unknown → device bricked
Related guides
- BIP39 missing words deep-dive
- Trezor passphrase recovery — sister problem on Trezor.
- Hardware wallet recovery overview.
- btcrecover full tutorial.
Frequently asked questions
Is the Ledger PIN recoverable?
No. Wipe device after 3 wrong attempts; restore from seed.
Wrong word order?
24! = 6.2e23 is infeasible. Recovery requires constraints (small swappable groups + known address).
Missing 1-3 words?
Highly recoverable with btcrecover seedrecover and a known address oracle.
Some letters unreadable?
BIP39 first-4-letter rule makes most words unambiguous. Build small per-position candidate lists.
Does this apply to Ledger Recover?
No. Ledger Recover is a custodial shard backup; recovery via identity verification with custodians.
Recover a partial Ledger seed
Send the words you have, mark unsure positions, list any address from your wallet. Our farm runs the full BIP39 brute-force tree across multiple derivation paths. Pay only on success.