Seed tools

Why you should never cut your seed into pieces

It sounds clever: write your 24 words on three cards, 16 words on each, so that any two cards rebuild the seed and losing one is not a disaster. The problem is the person who finds one card. They only need to guess 8 words, about 80 bits instead of 256. Here is the math, a calculator, and the standard ways to share a backup safely.

Last reviewed:

The scheme people try

Number the words 1 to 24 and copy them onto three cards like this:

Three cards, 16 words each: any two cards hold all 24 words
Card Words 1–8 Words 9–16 Words 17–24
A✓ Yes✓ Yes— No
B— No✓ Yes✓ Yes
C✓ Yes— No✓ Yes

It looks like a sensible 2-of-3 backup. Against loss, it is: any one card can go missing. Against theft, it is not, because every card gives away two thirds of your seed.

What one card gives away

Every seed word is one of 2,048 words, so each word carries 11 bits (2 to the power of 11 = 2,048). A 24-word seed is 24 × 11 = 264 bits: 256 random bits plus an 8-bit checksum, as the BIP-39 standard sets out.

Someone with one card knows 16 words and is missing 8. Eight words are 8 × 11 = 88 bits. The checksum is not secret, though: it is worked out from the other bits, so it helps the finder throw away wrong guesses. Take away its 8 bits and about 80 bits are left to guess.

80 bits sounds like a lot. Compare it:

  • Your whole 24-word seed: 256 bits. One card makes the search 2 to the power of 176 times smaller.
  • The smallest seed BIP-39 allows, 12 words: 128 bits. A one-card search is still about 281 trillion times (2 to the power of 48) smaller than that.
  • NIST, the US standards body, classes cryptographic protection weaker than 112 bits as Disallowed for new use, and asks for at least 128 bits from 2031 (SP 800-57 Part 1, Table 4).

This does not mean a lost card gets cracked tomorrow. It means one card has thrown away the safety margin your seed was designed around, and you cannot know who picked it up.

How the numbers are worked out

Bits left to guess = 11 × words missing − checksum bits, and never less than zero.

The checksum is 8 bits for a 24-word seed and 4 bits for a 12-word seed (BIP-39 makes it one bit for every 32 bits of randomness).

Why take the checksum away?

The finder tries combinations for the missing words. One quick hash tells them whether a guess has a valid checksum. With 24 words, 255 out of every 256 guesses fail it and are thrown away at once. Only the rest need the slow test of building the wallet and looking for coins. That remaining number is 2 to the power of bits left.

What the formula assumes

  • The finder knows which positions are missing. Most backups number the words, so this is the safe assumption.
  • Your seed had full randomness to begin with. If its generator was weak, as with the 2026 Coldcard flaw, there is even less to guess.
  • No BIP-39 passphrase. A strong passphrase kept apart is an extra lock. It is not a reason to cut your seed: a forgotten passphrase loses the funds for good.
  • The numbers are averages. With one word missing, for example, about 8 of the 2,048 words fit the gap on average, and exactly 8 when the missing word is the last one.

A check you can see for yourself: with 23 of 24 words known, the formula gives 3 bits, which is 8 possible words. BitBox's dice guide describes exactly that: after you enter 23 words, the device offers eight valid options for the final word.

The numbers in full

24-word seed (256 bits + 8-bit checksum)
Words the finder reads Bits left (and valid guesses) Example
0 of 24, 24 missing 256 about 1.2 × 10 to the power of 77 guesses Full strength
8 of 24, 16 missing 168 about 3.7 × 10 to the power of 50 guesses
12 of 24, 12 missing 124 about 2.1 × 10 to the power of 37 guesses One half of a seed cut in two
16 of 24, 8 missing 80 about 1.2 × 10 to the power of 24 guesses One card of the three-card split
18 of 24, 6 missing 58 about 2.9 × 10 to the power of 17 guesses
20 of 24, 4 missing 36 68,719,476,736 guesses
22 of 24, 2 missing 14 16,384 guesses
23 of 24, 1 missing 3 8 guesses One word missing
24 of 24, 0 missing 0 1 guess The whole seed
12-word seed (128 bits + 4-bit checksum)
Words the finder reads Bits left (and valid guesses) Example
0 of 12, 12 missing 128 about 3.4 × 10 to the power of 38 guesses Full strength
4 of 12, 8 missing 84 about 1.9 × 10 to the power of 25 guesses
6 of 12, 6 missing 62 about 4.6 × 10 to the power of 18 guesses One half of a seed cut in two
8 of 12, 4 missing 40 1,099,511,627,776 guesses One card of a three-card split
10 of 12, 2 missing 18 262,144 guesses
11 of 12, 1 missing 7 128 guesses
12 of 12, 0 missing 0 1 guess The whole seed

Cutting also makes losing your bitcoin easier

Pieces add ways to lose access, not only ways to be robbed. Cut a 24-word seed in two halves and you need both: lose either one and the wallet is gone. Meanwhile each half still leaves only 124 bits for whoever finds it, less than a 12-word seed. The three-card scheme survives one lost card, but now there are three hiding places to protect instead of one.

If you have already cut your seed

A cut backup is not the same as stolen bitcoin. Work through this calmly:

  1. Check that you can still put your hands on every piece. Do not type any of them into a computer, a phone or a website to "test" them.
  2. If every piece is safe and nobody else has seen one, you have time. Plan a move to one of the options below.
  3. If a piece is missing, or someone else may have seen it, move your funds to a wallet with a brand-new seed. Don't reset your hardware wallet to make it: with a piece missing, that device may be your only working copy. Make the new seed on a second hardware wallet, back it up whole, test it, send a small amount first, then the rest. Destroy the old pieces only when everything has arrived.

What to do instead

1. For most people: keep the seed whole

One complete copy, written clearly and kept somewhere safe. If you worry about fire or loss, add a second complete copy in a different safe place. Each copy is a full key to your wallet, so protect each one that way. Then test it with the seed backup checkup.

If you hold a modest amount, this is usually the safer choice: every extra part is one more thing to lose or get wrong.

2. Share it properly: SLIP-39

SLIP-39 (often called a Shamir backup) splits a secret into shares so that a number you choose, such as 2 of 3, rebuild it. The difference from cutting words is the whole point: Knowledge of fewer than the required number of parts does not leak information about the master secret. One share on its own tells the finder nothing.

Shares use their own word list and are 20 words long for a 128-bit secret or 33 words for 256 bits. SLIP-39 is not BIP-39: you cannot turn your 24 words into shares by cutting them. Converting an existing BIP-39 seed is possible, but every share is then 59 words long. The SLIP-39 authors advise moving your funds to a new wallet backed up with SLIP-39 instead, which also retires the old words. Only some wallets support it, so check yours before you start.

3. Split the power to spend: multisig

A 2-of-3 multisig wallet uses three separate seeds, ideally from different makers. Any two can spend; one found seed cannot spend anything. The cost is complexity: you also need a backup of the wallet's setup (its descriptor), and each extra step is a chance to make a mistake.

Check yourself

You cut your 24 words into two halves of 12 and hide them in two places. Someone finds one half. How many bits are left to guess?

124 bits (11 × 12 − 8). That is less than a 12-word seed. And if you lose either half, you lose the wallet.

Does the checksum make a cut-up seed harder to guess?

No. It is worked out from the other words, so it helps the finder discard wrong guesses. That is why the formula subtracts it.

What does a single share from a 2-of-3 SLIP-39 backup tell the person who finds it?

Nothing about your secret. Fewer shares than the threshold reveal no information. That is the difference between sharing a seed with SLIP-39 and cutting it into pieces.