Here's a very common scenario: someone goes to log into their crypto wallet, and they realize that they no longer know the password to their wallet.
- Perhaps they upgraded to a new phone, and their old phone just remembered the password for them.
- Perhaps they haven't logged into the wallet for a year, and they threw away the scrap of paper where their password was written.
Either way, they don't panic, because they know that they wrote down their mnemonic phrase. And with that phrase you can recover your wallet at any time.
But when they type in all the words they wrote down, they realize that they're missing one: they have either 11 of 12 words or 23 of 24 words. Crisis! That missing word is absolutely critical to recovering the wallet.
If you're in that situation, we can almost certainly help you recover your wallet. If you'd like professional help, contact us.
Understanding the Seed Phrase
These mnemonic phrases go by a lot of different names: seed phrase, recovery seed, recovery phrase, mnemonic code. They all mean the same thing: a series of randomly selected words that generate the private keys that control your wallet. Most modern wallets follow the BIP39 standard, where every word comes from a fixed list of 2,048 English words and part of the last word is a checksum.
If you want the basics first, see our guide to how a 24-word recovery phrase works, which covers how the words are generated, 12 vs 24 words, and how to store them safely.
Which Wallets and Blockchains use Seed Phrases?
With a few exceptions, pretty much every modern self-custody wallet since the 2015/2016 timeframe uses BIP39 recovery seeds, whatever blockchain you hold: Bitcoin, Ethereum, Solana, Dogecoin, or the latest memecoin.
The main exceptions:
- Bitcoin Core (also known as Bitcoin Qt) and the wallets derived from it (Dogecoin Core, Litecoin Core, etc.) don't use BIP39 seed phrases. Your wallet.dat file is your backup instead.
- Electrum uses its own seed format. It looks like a BIP39 phrase but isn't one.
- Older Blockchain.com wallets used legacy phrases of unusual lengths. See our guide to recovering Blockchain.com legacy mnemonics.
- The IoPay wallet gives you a private key as a backup instead of a seed phrase.
- Update, Jan 31, 2024: I have also discovered that the Argent wallet is a self-custody wallet that uses a different backup mechanism than a seed phrase.
How Big of a Problem are Missing Words?
An incomplete recovery phrase cannot recover your wallet, period, full stop.
You have to find the missing words, in the correct order, if you're going to use the phrase to recover your private key.
Most people's initial reaction when they realize that they have a word missing is that they're probably missing the last word. We have even had clients who manually tried every word in the 2,048-word BIP39 dictionary in that last position.
However, while this may seem like a reasonable idea, if you try it you will soon realize that:
- This is a long, boring, and potentially mistake-ridden process.
- There's no guarantee that the missing word is in the last position. It could be in the 3rd position, or the 7th, or the 22nd (in a 24-word seed phrase).
- You not only have to regenerate the 12- or 24-word phrase for each of the 2,048 words in the dictionary, but you also have to check the first few addresses that were generated for each valid phrase to see if they have had a transaction.
Another serious problem with trying to find a missing word by hand is that it's possible that the partial recovery seed that you have is for the wrong wallet, perhaps a wallet that's never had a transaction. That means that if you went through this process by hand, you could actually reconstruct the exact correct mnemonic phrase but you wouldn't know it, because the wallet has never had a transaction.
Common Error Messages When You Have an Incomplete Mnemonic Phrase
These are the messages we've seen wallets show for an incomplete phrase. Wallets change their wording from time to time, so yours may differ slightly.
- Blockchain.com: Invalid phrase
- Coinbase Wallet: Enter a valid 12-word recovery phrase.
- Electrum: BIP39 (checksum: failed)
- Exodus: won't let you import the wallet with a partial phrase, but doesn't give you an error message.
- Ledger: Invalid recovery phrase
- MetaMask: Secret Recovery Phrases contain 12, 15, 18, 21, or 24 words
- Phantom: won't let you import the wallet with a partial phrase, but doesn't give you an error message.
- Trezor: Recovery failed. Error details: Mnemonic is not valid
- Trust Wallet: Secret Phrases must contain 12 or 24 words
How to Recover Your 12th or 24th Word by Hand
Practically speaking, to recover a missing word in your seed phrase you need to use software. However, you can learn a lot about how these mnemonics work by trying to recover one by hand.
There are 2,048 words in the BIP39 dictionary, and there are 12 possible positions for the missing word in a 12-word recovery seed, or 24 possible positions in a 24-word recovery phrase.
The basic process of finding the right missing word can be described as "brute forcing" the word.
You take your 11-word phrase and you place the first of the 2,048 words in position 1, followed by the remaining 11 words. You then check whether the 12th word is a valid checksum. Only 128 of the 2,048 words can be a valid 12th word for any given set of first 11 words. For a 24-word phrase the checksum is stricter: only 8 of the 2,048 words can be a valid 24th word.
If it generates a valid checksum, you need to derive the first few addresses that would be generated by that 12-word phrase, and see whether any of those addresses have ever had a transaction. If they have, then you have found the correct seed phrase! If they haven't, then you likely haven't found the correct seed phrase.
Assuming that you did not find the correct seed phrase, you would now place the 2nd of the 2,048 words in the first position and repeat the process until you either find the correct word in the correct position, or exhaust the list of possibilities.
And, to be clear, there are 12 x 2,048 = 24,576 possible combinations for a 12-word seed phrase, and 24 x 2,048 = 49,152 possible combinations for a 24-word seed phrase.
One tool to try this by hand is Ian Coleman's BIP39 tool. For example, let's imagine that the correct seed phrase is: outside risk fluid inform fluid motion ice web exact small mixed usual
But we've lost a word somewhere in the phrase, and all we have recorded is: outside risk fluid inform motion ice web exact small mixed usual
So we could open the BIP39 tool in one browser tab, and the BIP39 English dictionary in another, and try the first combination, which is:
abandon outside risk fluid inform motion ice web exact small mixed usual
The BIP39 tool quickly gives us the message "Invalid mnemonic":
We can now continue with that process until we find a first word that is a valid mnemonic. (In this case, it's the 29th word, "adjust"):
The next step depends on whether you know your Bitcoin (or other crypto) address or not. If you know it, you can search for it in the BIP39 tool (under "Derived Addresses"). If the address is there, you have found the correct recovery seed! If the address is not there, you have to keep looking.
Alternately, if you don't know the address where your funds are stored, you can enter the first 5 or so addresses listed under "Derived Addresses" in a blockchain explorer to see if they have ever had a transaction.
If they have ever had a transaction, then this is likely your correct recovery phrase.
If you reflect on this process for more than a couple of seconds, you'll realize that it's not really possible to do this by hand. (And never type a seed phrase that holds real funds into a website. If you use a tool like this, download it and run it offline.)
If you have a technical background and you're comfortable working on the command line of your operating system, you could install a piece of software called seedrecover, and use that to try to brute force your mnemonic phrase.
On the other hand, if you're not confident in your technical skills, please contact us and we'll resolve this problem with you.
What if you're missing more than 1 word?
All of the same problems exist when you're missing 2 or more words: you don't know which words are missing, and you don't know which positions they're missing from. Each extra missing word multiplies the search by 2,048, and not knowing the positions multiplies it again:
| Words missing | 12-word phrase, positions known | 12-word phrase, positions unknown | 24-word phrase, positions known | 24-word phrase, positions unknown |
|---|---|---|---|---|
| 1 | 2,048 | about 24,600 | 2,048 | about 49,000 |
| 2 | about 4.2 million | about 277 million | about 4.2 million | about 1.2 billion |
| 3 | about 8.6 billion | about 1.9 trillion | about 8.6 billion | about 17 trillion |
The checksum then rules out most of those candidates before the slow step of checking addresses.
It's relatively easy to brute force up to 3 missing words. 4 missing words can be done, but it requires a substantial financial investment to complete the search in a reasonable timeframe.
More than 4 missing words is currently beyond the state of the art to solve.
Get help recovering your missing words
If you're missing words from your recovery phrase, or your phrase says it's invalid and you can't see why, this is exactly what we do. Crypto Asset Recovery reconstructs incomplete and invalid recovery phrases offline, testing every valid combination against your wallet's addresses on air-gapped machines. You only pay if we succeed.
Recovering a phrase means working with the words you still have, so you'll share your partial phrase with us. Only share it with a recovery service you've verified, never with anyone who contacts you first. We're a registered New Hampshire company run by a public father-and-son team, Chris and Charles, and you can talk to us on Zoom before you send anything.
Frequently asked questions
Can I recover my seed phrase if I'm missing one word? Almost always, as long as the rest of the words are correct and you can identify the wallet (for example, from an address it used). One missing word leaves at most about 49,000 candidates, and the checksum rules out most of them.
How many possible last words are there? For a 12-word phrase, 128 of the 2,048 words can be a valid 12th word. For a 24-word phrase, only 8 can be a valid 24th word.
What if I don't know which word is missing? Software can try the missing word in every position. That multiplies the search by 12 or 24, which is still quick for a single missing word.
What if my words are in the wrong order? A 12-word phrase in the wrong order is often recoverable, because there are about 479 million possible orderings and the checksum rules out most of them. A completely scrambled 24-word phrase generally isn't, unless you know where most of the words go.
Is it safe to use online BIP39 tools? Not with a phrase that holds real funds. Anything you type into a website could be captured. Use offline software, or work with a recovery service you've verified.
