12 vs 24 Word Seed Phrase: Which Is More Secure?

A 24-word seed phrase holds 256 bits of entropy and a 12-word phrase holds 128, so on paper 24 words are stronger. In practice both are far beyond brute force, and the keys a Bitcoin wallet derives from either one sit on the secp256k1 curve, which offers about 128-bit security whatever the phrase length. For a randomly generated phrase that stays secret, 12 words are enough; 24 words earn their place when part of a backup might be exposed, for example seen in a photo or copied without its order. This guide compares the bits, counts the candidates left when words are missing, lists wallet defaults and recommends a length for each use. For the standard itself, start with what BIP39 is and how it works.

12 vs 24 Words at a Glance

Each BIP39 word stands for an 11-bit number, its position from 0 to 2047 in the word list. The BIP39 specification allows 128 to 256 bits of entropy in steps of 32 bits and appends a checksum: the first ENT/32 bits of the entropy’s SHA-256 hash, where ENT is the entropy length. That gives five lengths:

The last word carries the leftover entropy bits plus the whole checksum. In a 12-word phrase it holds 7 bits of entropy and 4 of checksum, so once the first 11 words are fixed, exactly 2⁷ = 128 of the 2,048 words can end the phrase. In a 24-word phrase it holds 3 bits of entropy and 8 of checksum, which leaves 8. After 23 × “abandon”, the start of a public BIP39 test vector, the eight valid endings are:

art  diesel  false  kite  organ  ready  surface  trouble

The last word calculator lists the valid endings for any test prefix. Two more details matter here:

• The checksum adds no secrecy. It is computed from the entropy, so there are 2¹²⁸ valid 12-word phrases, not 2,048¹² = 2¹³².
• Both lengths give a seed of the same size. BIP39 stretches the words with PBKDF2, 2,048 rounds of HMAC-SHA512, into a 64-byte seed. The length only decides how many different seeds are possible.

Is a 24-Word Seed Phrase More Secure?

Mathematically, yes: 2²⁵⁶ possible phrases against 2¹²⁸. In practice the difference rarely matters, for two reasons.

Both Lengths Are Beyond Brute Force

2¹²⁸ is about 3.4 × 10³⁸ and 2²⁵⁶ about 1.16 × 10⁷⁷. No attacker can try a meaningful share of either number; our guide on whether a seed phrase can be guessed works through the math and the real-world risks. Trezor’s comparison of backup lengths rates 12 words at 128-bit security, equivalent to the strength of a Bitcoin private key, and calls the 256 bits of 24 words “vastly more than needed” (Trezor).

The Curve Caps Practical Security Near 128 Bits

The seed is only one way into a wallet. Bitcoin addresses are controlled by private keys on secp256k1, and SEC 2, the standard that defines this curve, rates it at 128 bits of strength: solving the discrete logarithm problem on a curve of its size is believed to take about 2¹²⁸ operations (SEC 2, Table 1). An attacker who sees one of your public keys can attack that key directly, and the curve, not the seed, decides how hard that is.

So a 24-word phrase makes the seed far harder to guess than any single key, but it cannot lift a key above the curve’s roughly 128 bits. A 12-word phrase already matches that level.

Where 24 Words Still Help

Length starts to matter once an attacker, or you, already knows part of the phrase. The work then depends on how many words are still unknown.

Candidates Left When Words Are Unknown

Each unknown word multiplies the search by 2,048, and the checksum then rejects most combinations: 15 of every 16 for 12 words, 255 of every 256 for 24 words. Here is what remains when you know which positions are missing:

The counts are exact when the last word is among the unknown ones and averages otherwise: with word 5 of the 12-word test phrase blanked out, 131 words pass the checksum; in the 24-word test vector, 10 do. The checksum test costs a single SHA-256 hash, so only the survivors need the slow PBKDF2 step.

For the same number of missing words, a 24-word phrase leaves fewer candidates, because its checksum is twice as long. If you lose one or two words of your own backup, either length leaves a search that recovery software can finish; see how to fix seed phrase errors.

What Counts Is How Many Words Stay Hidden

The advantage of 24 words shows when someone sees a fixed part of your backup: a photo of one column, a glimpse of a sheet, one half of a split. The part still hidden is then much longer:

About a trillion candidates is a large but finite job, 2⁸⁸ times less work than guessing a whole 12-word phrase; 2¹⁶⁸ is out of reach. In the last row, the checksum trims the 12-word case to about 30 million orders worth testing. Trezor gives a related reason for the Model One’s 24-word default: its recovery relies on entering words on a computer, and 24 words add safety to that process (Trezor).

The same math explains why splitting a phrase by words is weak. Each piece narrows the search, and Trezor warns that keeping the first and last 12 words in different places does not protect the way real secret sharing does. For a backup in pieces, use SLIP-39 shares or multisig rather than cutting the words apart.

The Trade-Offs of 24 Words

• Twice the writing and checking. Every paper copy, metal plate and backup check takes twice as long, and each extra word is one more chance to miscopy.
• A tighter typo filter in return. A random one-word mistake still passes the checksum about 1 time in 16 with 12 words (4 checksum bits) but only about 1 time in 256 with 24 words (8 bits). A simulation of 200,000 random one-word mistakes per length agreed: about 6 percent got through with 12 words and about 0.4 percent with 24.
• Slower entry on hardware wallets. Devices that take the words on their own screen or buttons need twice as many entries.
• Fewer places to restore it. Not every wallet accepts 24 words: Exodus says its secret keys are always 12 words. Phantom creates 12 words but can import a 24-word BIP39 phrase.

Default Lengths in Popular Wallets

Each entry below comes from the vendor’s own help pages or documentation as of October 2026:

When you create a wallet on a Trezor, Trezor Suite’s setup lets you pick another format from the Backup format dropdown. A 20-word SLIP-39 share still holds a 128-bit secret: the extra words carry share data and a stronger checksum.

You Cannot Turn 12 Words Into 24

BIP39 feeds the words themselves into PBKDF2 as the password, so any change to them, twelve extra words included, produces an unrelated seed. The two public test phrases show it. Both start from entropy made only of zero bits, yet their first native SegWit addresses, at the BIP84 path m/84'/0'/0'/0/0 with no passphrase, have nothing in common:

12 words  abandon ×11 about  →  bc1qcr8te4kr609gcawutmrza0j4xv80jy8z306fyu
24 words  abandon ×23 art    →  bc1qzmtrqsfuaf6l6kkcsseumq26ukaphfj9skkug6

Both phrases are published test vectors, so never send funds to them. To change length, create a new wallet with a freshly generated phrase and send your funds to it. Wallet makers say the same: Phantom notes that a recovery phrase is generated once and cannot be changed, and Trezor says a BIP39 backup cannot be converted to SLIP-39, only replaced by a new wallet.

A Passphrase Is the Other Option

If your worry is someone finding the written words, more words do not help: a thief with the whole sheet has the whole phrase. A BIP39 passphrase does help. BIP39 mixes it into the seed, every passphrase opens a valid but different wallet, and only the right one opens yours. The trade-offs:

• It is a second secret to back up. Lose it, and the words alone open only the wallet without a passphrase.
• Your future wallet must support it. Check that any app or device you might restore in has a passphrase option.
• Adding one later creates a new wallet. Like changing the length, it means moving your funds.

Which Length Should You Choose?

Match the length to how your backup could fail, not to how secure the number sounds:

• Everyday software wallet: keep the 12 words the app creates. The realistic risks are phishing, malware and careless storage, and length helps with none of them.
• Hardware wallet: use the device’s default, such as 24 words on a Ledger or the 20-word backup on a new Trezor Safe.
• A backup that might be partly seen, or recovery through a computer, as on the Trezor Model One: prefer 24 words. They tolerate a glimpse or a lost order far better. No length helps if you type the phrase into a wallet app on an infected computer, which sees every word in order.
• Large or long-term holdings: 24 words add margin at the cost of more writing. Against someone finding the written words, a passphrase helps more; for a backup kept in pieces, use SLIP-39 shares or multisig. See how to store a seed phrase and, for heirs, crypto inheritance planning.
• You already have 12 words: keep them. Switching means a new wallet and on-chain transfers, and buys little.

Whatever the length, the phrase must come from a proper random generator on a device you trust. The seed phrase generator on this site is for practicing with test phrases only.

Frequently Asked Questions

Is a 24-word seed phrase twice as secure as a 12-word one?

No. It is 2¹²⁸ times harder to guess, not twice. But guessing a 12-word phrase is already out of reach, and the secp256k1 keys behind Bitcoin addresses offer about 128-bit security, so against brute force both lengths are equally safe in practice.

Why does Ledger use 24 words while MetaMask uses 12?

Each vendor sets its own default. Both are standard BIP39 lengths, so either phrase can be restored in another BIP39 wallet that accepts its length, though the derivation paths may differ.

Are 15-, 18- and 21-word phrases valid?

Yes. BIP39 defines all five lengths, from 128 to 256 bits of entropy. They are less common, and not every wallet accepts all of them: Ledger’s recovery offers only 12, 18 or 24 words.

How can I check that a phrase has a valid checksum?

Your wallet checks it when you restore. To see how the check works, try the checksum checker with a public test phrase, and never type a real phrase into any website.