A 24-word seed phrase holds 256 bits of entropy and a 12-word phrase holds 128, so on paper 24 words are stronger. In practice both are far beyond brute force, and the keys a Bitcoin wallet derives from either one sit on the secp256k1 curve, which offers about 128-bit security whatever the phrase length. For a randomly generated phrase that stays secret, 12 words are enough; 24 words earn their place when part of a backup might be exposed, for example seen in a photo or copied without its order. This guide compares the bits, counts the candidates left when words are missing, lists wallet defaults and recommends a length for each use. For the standard itself, start with what BIP39 is and how it works.
Each BIP39 word stands for an 11-bit number, its position from 0 to 2047 in the word list. The BIP39 specification allows 128 to 256 bits of entropy in steps of 32 bits and appends a checksum: the first ENT/32 bits of the entropy's SHA-256 hash, where ENT is the entropy length. That gives five lengths:
| Words | Entropy bits | Checksum bits | Total bits | Valid last words |
|---|---|---|---|---|
| 12 | 128 | 4 | 132 | 128 |
| 15 | 160 | 5 | 165 | 64 |
| 18 | 192 | 6 | 198 | 32 |
| 21 | 224 | 7 | 231 | 16 |
| 24 | 256 | 8 | 264 | 8 |
The last word carries the leftover entropy bits plus the whole checksum. In a 12-word phrase it holds 7 bits of entropy and 4 of checksum, so once the first 11 words are fixed, exactly 2⁷ = 128 of the 2,048 words can end the phrase. In a 24-word phrase it holds 3 bits of entropy and 8 of checksum, which leaves 8. After 23 × "abandon", the start of a public BIP39 test vector, the eight valid endings are:
art diesel false kite organ ready surface trouble
The last word calculator lists the valid endings for any test prefix. Two more details matter here:
Mathematically, yes: 2²⁵⁶ possible phrases against 2¹²⁸. In practice the difference rarely matters, for two reasons.
2¹²⁸ is about 3.4 × 10³⁸ and 2²⁵⁶ about 1.16 × 10⁷⁷. No attacker can try a meaningful share of either number; our guide on whether a seed phrase can be guessed works through the math and the real-world risks. Trezor's comparison of backup lengths rates 12 words at 128-bit security, equivalent to the strength of a Bitcoin private key, and calls the 256 bits of 24 words "vastly more than needed" (Trezor).
The seed is only one way into a wallet. Bitcoin addresses are controlled by private keys on secp256k1, and SEC 2, the standard that defines this curve, rates it at 128 bits of strength: solving the discrete logarithm problem on a curve of its size is believed to take about 2¹²⁸ operations (SEC 2, Table 1). An attacker who sees one of your public keys can attack that key directly, and the curve, not the seed, decides how hard that is.
So a 24-word phrase makes the seed far harder to guess than any single key, but it cannot lift a key above the curve's roughly 128 bits. A 12-word phrase already matches that level.
Length starts to matter once an attacker, or you, already knows part of the phrase. The work then depends on how many words are still unknown.
Each unknown word multiplies the search by 2,048, and the checksum then rejects most combinations: 15 of every 16 for 12 words, 255 of every 256 for 24 words. Here is what remains when you know which positions are missing:
| Unknown words | 12 words | 15 words | 18 words | 21 words | 24 words |
|---|---|---|---|---|---|
| 1 | 128 | 64 | 32 | 16 | 8 |
| 2 | 262,144 | 131,072 | 65,536 | 32,768 | 16,384 |
| 3 | 536,870,912 | 268,435,456 | 134,217,728 | 67,108,864 | 33,554,432 |
| 4 | 1,099,511,627,776 | 549,755,813,888 | 274,877,906,944 | 137,438,953,472 | 68,719,476,736 |
The counts are exact when the last word is among the unknown ones and averages otherwise: with word 5 of the 12-word test phrase blanked out, 131 words pass the checksum; in the 24-word test vector, 10 do. The checksum test costs a single SHA-256 hash, so only the survivors need the slow PBKDF2 step.
For the same number of missing words, a 24-word phrase leaves fewer candidates, because its checksum is twice as long. If you lose one or two words of your own backup, either length leaves a search that recovery software can finish; see how to fix seed phrase errors.
The advantage of 24 words shows when someone sees a fixed part of your backup: a photo of one column, a glimpse of a sheet, one half of a split. The part still hidden is then much longer:
| What the attacker learned | 12-word phrase | 24-word phrase |
|---|---|---|
| 8 words | 4 unknown: about 1.1 × 10¹² candidates (2⁴⁰) | 16 unknown: about 3.7 × 10⁵⁰ (2¹⁶⁸) |
| Half the words | 6 unknown: about 4.6 × 10¹⁸ (2⁶²) | 12 unknown: about 2.1 × 10³⁷ (2¹²⁴) |
| Every word, but not the order | 12! = 479,001,600 orders (about 2²⁹) | 24! ≈ 6.2 × 10²³ orders (about 2⁷⁹) |
About a trillion candidates is a large but finite job, 2⁸⁸ times less work than guessing a whole 12-word phrase; 2¹⁶⁸ is out of reach. In the last row, the checksum trims the 12-word case to about 30 million orders worth testing. Trezor gives a related reason for the Model One's 24-word default: its recovery relies on entering words on a computer, and 24 words add safety to that process (Trezor).
The same math explains why splitting a phrase by words is weak. Each piece narrows the search, and Trezor warns that keeping the first and last 12 words in different places does not protect the way real secret sharing does. For a backup in pieces, use SLIP-39 shares or multisig rather than cutting the words apart.
Each entry below comes from the vendor's own help pages or documentation as of October 2026:
| Wallet | Default length | Other options and notes |
|---|---|---|
| Ledger (all devices) | 24 words, the only length it generates | Restores 12- and 18-word phrases from other wallets, which Ledger does not recommend |
| Trezor Model One | 24 words (BIP39) | 12 words |
| Trezor Model T | 12 words (BIP39) | 24 words; SLIP-39 shares |
| Trezor Safe 3 | 12 words until June 2024, then a 20-word single-share SLIP-39 backup | BIP39 12 or 24 words; SLIP-39 multi-share |
| Trezor Safe 5, Safe 7 | 20-word single-share SLIP-39 backup | BIP39 12 or 24 words; SLIP-39 multi-share |
| MetaMask | 12 words | — |
| Trust Wallet | 12 words | — |
| Exodus | 12 words | Always 12 |
| Coinbase Wallet | 12 words | Accounts can use email, social or passkey sign-in instead of a recovery phrase |
| Phantom | 12 words | Imports 24-word BIP39 phrases |
| Electrum | 12-word Electrum seed | Its own format, 132 bits; Electrum does not generate BIP39 phrases |
When you create a wallet on a Trezor, Trezor Suite's setup lets you pick another format from the Backup format dropdown. A 20-word SLIP-39 share still holds a 128-bit secret: the extra words carry share data and a stronger checksum.
BIP39 feeds the words themselves into PBKDF2 as the password, so any change to them, twelve extra words included, produces an unrelated seed. The two public test phrases show it. Both start from entropy made only of zero bits, yet their first native SegWit addresses, at the BIP84 path m/84'/0'/0'/0/0 with no passphrase, have nothing in common:
12 words abandon ×11 about → bc1qcr8te4kr609gcawutmrza0j4xv80jy8z306fyu
24 words abandon ×23 art → bc1qzmtrqsfuaf6l6kkcsseumq26ukaphfj9skkug6
Both phrases are published test vectors, so never send funds to them. To change length, create a new wallet with a freshly generated phrase and send your funds to it. Wallet makers say the same: Phantom notes that a recovery phrase is generated once and cannot be changed, and Trezor says a BIP39 backup cannot be converted to SLIP-39, only replaced by a new wallet.
If your worry is someone finding the written words, more words do not help: a thief with the whole sheet has the whole phrase. A BIP39 passphrase does help. BIP39 mixes it into the seed, every passphrase opens a valid but different wallet, and only the right one opens yours. The trade-offs:
Match the length to how your backup could fail, not to how secure the number sounds:
Whatever the length, the phrase must come from a proper random generator on a device you trust. The seed phrase generator on this site is for practicing with test phrases only.
No. It is 2¹²⁸ times harder to guess, not twice. But guessing a 12-word phrase is already out of reach, and the secp256k1 keys behind Bitcoin addresses offer about 128-bit security, so against brute force both lengths are equally safe in practice.
Each vendor sets its own default. Both are standard BIP39 lengths, so either phrase can be restored in another BIP39 wallet that accepts its length, though the derivation paths may differ.
Yes. BIP39 defines all five lengths, from 128 to 256 bits of entropy. They are less common, and not every wallet accepts all of them: Ledger's recovery offers only 12, 18 or 24 words.
Your wallet checks it when you restore. To see how the check works, try the checksum checker with a public test phrase, and never type a real phrase into any website.