What Is a 24-Word Recovery Phrase?
A 24-word recovery phrase — also called a mnemonic phrase or seed phrase — is the master backup for a Bitcoin wallet. It consists of 24 ordinary English words drawn from a standardized list of 2,048 words defined by the BIP39 specification. These words encode the random number your wallet started from, and every private key in your wallet is derived from them. Lose access to your hardware wallet, and these 24 words are your path to full recovery. Lose the words themselves, and your bitcoin may be gone permanently.
The recovery phrase is not a password you choose. Your wallet makes it from random numbers, following a precise standard, and every word matters — including the order they appear in. Understanding exactly how this works, and how to protect it, is foundational to self-custody security.
How BIP39 Generates a 24-Word Phrase
The process behind your 24-word phrase follows the BIP39 standard (Bitcoin Improvement Proposal 39), published in 2013. Here is exactly what happens inside your hardware wallet when it generates a new seed phrase:
Step 1 — Entropy generation. The wallet’s random number generator produces 256 bits of entropy. This is raw randomness — a string of 256 ones and zeros. The quality of this entropy is critical. A flawed random number generator means a predictable seed phrase. Hardware wallets typically draw on a hardware random number generator for this job, but a good chip is not enough on its own: the firmware has to use it correctly. In July 2026 a Coldcard firmware flaw showed what happens when it does not (see “Word count is the ceiling, not the strength” below).
Step 2 — Checksum calculation. The wallet computes a SHA-256 hash of the 256-bit entropy. The first 8 bits of this hash become the checksum. This checksum is appended to the original entropy, producing a total of 264 bits.
Step 3 — Splitting into groups. The 264-bit string is divided into 24 groups of 11 bits each. Each 11-bit group represents a number between 0 and 2,047.
Step 4 — Word mapping. Each number maps to a specific word in the BIP39 word list. The English word list contains exactly 2,048 words, chosen to be unambiguous (no two words share the same first four letters). The result: 24 words in a fixed order.
The checksum in the final word means that random collections of 24 words from the list will rarely form a valid seed phrase: only about 1 in 256 does. This provides basic error detection — if you make a transcription mistake, wallet software will usually flag it immediately, though BIP39 itself notes that about 1 error in 256 slips through.
12-Word vs 24-Word Phrases: Security Comparison
Not all seed phrases are 24 words. Many wallets default to 12-word phrases. The difference comes down to the amount of initial entropy:
| Feature | 12-Word Phrase | 24-Word Phrase |
|---|---|---|
| Entropy | 128 bits | 256 bits |
| Checksum bits | 4 bits | 8 bits |
| Total bits encoded | 132 bits | 264 bits |
| Possible combinations | 2128 (~3.4 x 1038) | 2256 (~1.16 x 1077) |
| Brute-force resistance | Computationally infeasible; Grover’s algorithm on a future quantum computer would cut it to 64 bits | Computationally infeasible; Grover’s algorithm on a future quantum computer would cut it to 128 bits |
| Transcription effort | Lower — 12 words to record | Higher — 24 words to record |
| Error detection | 4-bit checksum (weaker) | 8-bit checksum (stronger) |
A 12-word phrase with 128 bits of entropy is already beyond any brute-force attack using classical computers. Against a future quantum computer, Grover’s algorithm would halve a seed’s bits: 128 would become 64, still an enormous quantum workload, and 256 would become 128. The bigger quantum risk is a different algorithm, Shor’s, which would work out a private key from its public key; a 24-word seed protects no better than a 12-word one against it. No quantum computer can do either yet (November 2026). For long-term cold storage of significant amounts, 24 words is the conservative choice; our 12 vs 24 words guide weighs the two in detail.
Word count is the ceiling, not the strength
Twenty-four words can hold 256 bits of randomness. They only do if the random number generator worked when it made them. A Coldcard firmware flaw disclosed in July 2026 had produced seeds far weaker than their word count suggested, and attackers emptied wallets made with them. The words were all there. What was missing was the randomness behind them. Our Coldcard advisory explains who is affected, and our security advisories list known flaws by device.
Two extra protections exist. Both are options with a cost, not defaults:
- Your own dice rolls. Several hardware wallets let you add dice rolls when you create the seed. Each roll of a fair die is worth about 2.58 bits, so 99 rolls carry about 256. Coinkite’s advisory puts seeds made with at least 50 fair, independent, private rolls outside the risk from its flaw. The cost: some wallets mix your rolls with their own randomness, but others, or a “dice only” mode, build the seed from your rolls alone. There, a loaded die, too few rolls or rolls someone else saw give you a weaker seed than the device would have made. Our dice entropy tool shows how many rolls you need.
- A passphrase. A strong, unique passphrase adds a second lock. The same advisory says funds behind one were not at risk from the weak seed alone, although Coldcard still tells owners of weak seeds to move to a new one: a passphrase is a barrier, not a repair. The cost: forget the passphrase and those funds are gone for good. See our passphrase guide.
From Seed Phrase to Private Keys: BIP32 and BIP44 Derivation
Your 24 words are not your private keys. They encode the random bits your wallet started from, plus a checksum; the seed from which private keys are derived is computed from the words and any passphrase. The derivation process follows BIP32 (Hierarchical Deterministic wallets) and BIP44 (multi-account structure).
First, BIP39 converts your mnemonic words into a 512-bit seed using PBKDF2-HMAC-SHA512 with 2,048 rounds of hashing. If you use an optional passphrase (sometimes called the “25th word”), it is mixed in at this stage, producing a completely different seed from the same 24 words. This is detailed in our guide on wallet passphrases and recovery.
The 512-bit seed is then fed into HMAC-SHA512 to produce a master private key and a master chain code. From there, a tree of child keys is derived using the hierarchical deterministic wallet mathematics defined in BIP32. Each branch of this tree can generate about 2 billion unique Bitcoin addresses, all recoverable from the same 24-word backup.
BIP44 adds structure to this tree with a standardized derivation path: m/44'/0'/0'/0/0 for the first receiving address of a BIP44 wallet. The path encodes the purpose (44' for BIP44, whose addresses start with “1”), the coin type, the account number, whether the address is for receiving or change, and the address index. Newer wallets use the same layout with 84' (addresses starting “bc1q”) or 86' (“bc1p”) in place of 44'. This structure is what lets a single seed phrase manage several accounts and practically unlimited addresses, rebuilt the same way every time.
Security Best Practices for Your Recovery Phrase
Your 24-word recovery phrase is the single point of failure for your entire Bitcoin holdings. Every security decision you make about it matters.
Physical Storage Is Non-Negotiable
Write your seed phrase on paper or stamp it into metal. Never store it digitally — not in a text file, not in a password manager, not in an encrypted note on your phone. Digital storage exposes your seed to malware, cloud breaches, and device compromise. A metal backup resists fire and water damage that would destroy paper. For a detailed comparison of metal storage solutions, read our seed phrase storage best practices guide.
Location and Redundancy
Store your backup in a secure location: a home safe, a bank safety deposit box, or another place with controlled access. Consider creating a second backup stored at a geographically separate location to protect against localized disasters. However, every additional copy increases the attack surface — someone finding any copy gains full access to your funds.
Never Share Your Seed Phrase
No legitimate service, wallet manufacturer, or support representative will ever ask for your seed phrase. Anyone who asks for it is attempting to steal your bitcoin. This applies to phone calls, emails, social media messages, and in-person requests without exception.
Consider a Passphrase for Additional Protection
Adding a passphrase (the so-called 25th word) creates an entirely separate set of wallets derived from the same 24 words. Even if someone finds your seed phrase backup, they cannot access funds protected by the passphrase. The trade-off: if you forget the passphrase, those funds are unrecoverable. This is a powerful tool, but it requires its own careful backup strategy: our 25th word guide covers setup and testing.
Common Mistakes That Compromise Recovery Phrases
These are the errors that lead to real-world bitcoin losses:
Taking a screenshot or photo. Your phone syncs images to iCloud or Google Photos automatically. A seed phrase photo sitting in cloud storage is exposed to every breach that hits that cloud provider, plus anyone who gains access to your account.
Typing it into a phone or computer. Keyloggers, clipboard hijackers, and screen-capture malware exist specifically to capture cryptocurrency credentials. The moment your seed phrase touches a general-purpose operating system, it is potentially compromised. That includes typing it into a “checker” tool or a website, even one that looks official. Words go into a hardware wallet, on the device itself, and nowhere else.
Storing it in email or messaging apps. Sending your seed phrase to yourself “for safekeeping” puts it on email servers, potentially in plaintext, subject to subpoenas, breaches, and unauthorized access.
Splitting the words between places. Some people keep words 1-12 in one place and 13-24 in another. That doubles the ways to lose the seed: lose either half and everything is gone. Others use a “two of three” split, with 16 of the 24 words in each of three places. Then whoever finds one place has only 8 words to guess: about 80 bits instead of 256. With a 12-word seed the same split leaves about 40 bits, roughly what Coinkite estimated for the weakest Coldcard seeds of July 2026, made on the Mk2 and Mk3. If you want your backup in pieces, use a scheme built for it: SLIP-39 shares (Trezor calls it Multi-share Backup) or a multisig wallet with keys from different manufacturers. Our seed split risk tool shows the numbers.
Keeping the words only in your head. Memorizing 24 words without a physical backup is a gamble against your own memory, health, and mortality. Always keep a backup on paper or metal.
How to Verify Your Backup Works
Writing down 24 words means nothing if you copied them wrong. The test has to start from your paper: your device keeps its own copy of the seed, so it shows the right addresses even when the paper is wrong.
Method 1 — The device’s built-in check. Trezor’s Check backup and Ledger’s Recovery Check app have you type the words from your paper on the device, which then tells you whether they match the seed it holds. Nothing is erased.
Method 2 — Restore on a second device. Restore from the paper on a second hardware wallet. Use your only device only after Method 1 has passed and any passphrase is tested, or while every wallet on it is still empty: a wipe also erases anything kept only on the device, such as a passphrase attached to a Ledger PIN. Then check that the first receiving address, or the master fingerprint, matches the one you noted beforehand.
Never check the words by typing them into a phone, a computer or a website, not even in an “offline” tool. Our guide on how to test your seed phrase backup has the steps, including how to test a passphrase. For the broader security architecture around wallet recovery, see our piece on cold storage and risk management.
What Happens If You Lose Words
Losing one or two words from a 24-word phrase is not necessarily catastrophic, but recovery becomes a computational challenge. Since each word encodes 11 bits of information, a single missing word means 2,048 possible combinations to try, and three missing words roughly 8.6 billion. If your device still works, you don’t need to recover the missing words at all: create a new seed on the device, write it down, test it and move your funds to it. If the device is gone, software can search for one or two missing words, but it means typing the rest of your seed into a computer, so treat it as a last resort. Be wary of anyone who offers to do it for you: the FBI keeps warning about fake recovery services that target people who have already lost money (FBI IC3, 13 Aug 2025).
If words are present but their order is scrambled, the problem grows factorial. Reordering 24 words has 24! (about 6.2 x 1023) permutations, about 279. Like the 280 guesses of a split seed, that is out of reach: every order that passes the checksum has to go through 2,048 rounds of HMAC-SHA512, so no one can search them to recover a wallet. This is why recording the words in the exact order matters.
If a restored wallet shows zero
Don’t assume your bitcoin is gone, and don’t start experimenting on your own. The usual causes are a passphrase that was left out or mistyped, or a wallet that looks at a different address type or derivation path. Wallets Recovery keeps a reference of the paths each wallet uses. Never type your words into a phone or a connected computer to try fixes, and contact your wallet’s manufacturer only through its official website.
For those storing significant value in Bitcoin, the risk of seed phrase loss underscores the case for multisignature setups, where no single seed phrase is a single point of failure. Our guide on transitioning from single-sig to multisig covers this approach.
Frequently Asked Questions
Can someone guess my 24-word recovery phrase?
No. A 24-word BIP39 phrase encodes 256 bits of entropy. The number of possible valid phrases is approximately 2256, which is roughly 1.16 x 1077. To put that in perspective, the estimated number of atoms in the observable universe is around 1080. Even if every computer on Earth dedicated all processing power to guessing your phrase, the expected time to find it would exceed the age of the universe by many orders of magnitude. The seed phrase is unguessable assuming it was generated by a proper random number generator. A Coldcard flaw disclosed in July 2026 showed that it can fail: see “Word count is the ceiling, not the strength” above.
Is a 12-word phrase secure enough?
For most practical purposes today, yes. A 12-word phrase provides 128 bits of entropy, which is considered secure against all known classical attacks. A future quantum computer running Grover’s algorithm could cut that to 64 bits, still an enormous quantum workload; a 24-word phrase would drop to 128. The bigger quantum risk is a different algorithm, Shor’s, which would work out a private key from its public key, and a 24-word seed protects no better than a 12-word one against it. No quantum computer can do this yet (November 2026). If you are planning long-term cold storage measured in decades, 24 words is the more conservative choice.
What is the difference between a seed phrase and a private key?
A seed phrase is a human-readable encoding of the random bits your wallet started from; together with any passphrase, it produces the seed from which an entire tree of private keys is derived using BIP32 hierarchical deterministic derivation. A private key is a single 256-bit number. Wallets normally use each key for one address, though the same key can also sign for other address types made from it (legacy, SegWit, Taproot). One seed phrase can generate billions of private keys. Backing up the seed phrase backs up all current and future keys derived from it. This relationship is explored in our guide to seed phrases and private keys.
Can I change my recovery phrase?
You cannot modify an existing recovery phrase. The phrase is a deterministic encoding of the entropy generated at wallet creation. To get a new phrase, you must create a new wallet, which generates new entropy and a new set of 24 words. You would then need to transfer all funds from the old wallet to addresses derived from the new seed phrase. The old phrase remains valid and would still recover the old (now empty) wallet.
Should I store my recovery phrase in a bank safety deposit box?
A bank safety deposit box provides physical security against theft and home disasters, making it a reasonable storage location for a seed phrase backup. However, there are trade-offs to consider. You lose immediate access — banks have operating hours, and boxes can be sealed during legal proceedings. The bank itself does not know or have access to your phrase’s contents, but employees could theoretically observe you accessing it. For high-value holdings, combining a safety deposit box with additional strategies like inheritance planning and geographic distribution of backups provides stronger protection than any single storage method.
Sources
- The BIP-39 standard, its English word list, and SLIP-39.
- Coinkite, Coldcard Security Advisory (updated 1 Aug 2026), and Coldcard, BIP-39 Passphrase.
- Trezor, Check wallet backup; Ledger, Recovery Check.
- Wallets Recovery, and FBI IC3, fictitious firms offering to recover funds (13 Aug 2025).
Last reviewed: 8 November 2026.
