The numbers
Every BIP39 phrase is random entropy plus a short checksum, written 11 bits per word:
| Words | Entropy | Checksum | Possible phrases |
|---|---|---|---|
| 12 | 128 bits | 4 bits | 2128 |
| 24 | 256 bits | 8 bits | 2256 |
15, 18 and 21 words are also valid BIP39, but fewer wallets support them.
Can a 12-word phrase be brute-forced?
No. 2128 is about 3.4 × 1038. Each guess also requires 2048 rounds of PBKDF2-HMAC-SHA512 to turn the words into a seed. Even an attacker testing a trillion phrases per second would need vastly longer than the age of the universe to cover a meaningful fraction of the space.
There is also a ceiling from the cryptography wallets use afterwards. Bitcoin and many other chains use the secp256k1 curve, whose private keys offer roughly 128 bits of security. Above that level, the phrase is no longer the weakest link.
When 24 words does help
The real advantage of 24 words is margin if part of the phrase leaks.
- If someone sees 6 words of a 12-word phrase, the remaining 6 words carry about 62 bits of unknown entropy (after the 4 checksum bits). That is still hard to brute-force, but no longer astronomically so — especially because each guess can be checked quickly once the seed is derived.
- If someone sees 6 words of a 24-word phrase, about 190 bits remain unknown, which is out of reach.
So 24 words helps against a partially photographed, partially overheard or split-and-lost backup. It does not help if the whole phrase is exposed.
What actually causes losses
Almost all seed phrase losses come from:
- The full phrase being photographed, typed into a website or cloud note, or entered into a fake wallet.
- The backup being lost, damaged or unreadable.
- Weak randomness — phrases chosen by people or generated by buggy software.
Neither 12 nor 24 words protects against any of these. Word count is a small decision compared with where the phrase is generated and how it is stored.
Practical trade-offs
| 12 words | 24 words | |
|---|---|---|
| Time to write and check | Shorter | Twice as long |
| Chance of a transcription error | Lower | Higher (but the checksum catches most) |
| Margin if some words leak | Smaller | Much larger |
| Wallet support | Universal | Universal |
Recommendation
- Let your wallet decide. Use whatever length a reputable hardware wallet generates.
- Choose 24 words if your backup might be split, partially exposed, or stored in several places.
- Choose 12 words if a shorter backup means you will actually verify it carefully.
- Either way, the checksum only catches typos — test a restore before sending significant funds.
You can compare the two sizes with official test vectors in the generator and see where the checksum bits sit on the checksum page.
Never type a real recovery phrase into any website, including this one. Use test data online, or the offline tool on a disconnected device.