BIP39 Last Word Calculator
Enter the first 11, 14, 17, 20 or 23 words of a phrase and get every last word that gives a valid BIP39 checksum. The calculation runs in your browser.
Updated
Эта страница по-русски: Калькулятор последнего слова
Why the last word is special
A BIP39 phrase is a random number followed by a checksum: the first ENT/32 bits of its SHA-256 hash, where ENT is the length of the random part. Every word stands for 11 bits, and the checksum lands at the end, inside the last word. So the first words can be anything from the list, but the last one has to fit them: most words fail, and wallets reject the phrase as invalid. The calculator tries all 2048 words and keeps the ones that pass, exactly as described in the BIP39 specification.
| Phrase length | Words you enter | Free bits in the last word | Checksum bits | Valid last words |
|---|---|---|---|---|
| 12 | 11 | 7 | 4 | 128 |
| 15 | 14 | 6 | 5 | 64 |
| 18 | 17 | 5 | 6 | 32 |
| 21 | 20 | 4 | 7 | 16 |
| 24 | 23 | 3 | 8 | 8 |
Try it with the public test phrase: after eleven times abandon the calculator shows 128 words, and the first of them is about, the word that ends the official BIP39 test vector.
Building a phrase from dice or coin flips
The calculator exists mostly for people who make their own randomness instead of trusting a device's generator. A sketch for a 12-word phrase (the full walkthrough, with how many rolls each length needs and a worked example, is in our guide to generating a seed phrase with dice):
- Make 11 random numbers from 0 to 2047. Eleven coin flips per word give an 11-bit number; the word with that index (number plus one on a list numbered from 1) is the word. Dice work too, as long as the method gives every number the same chance.
- Enter the 11 words. The calculator lists the 128 words that complete a valid phrase, in list order.
- Pick one at random. Flip a coin seven more times and read the result as a binary number from 0 to 127: take the word at that position, counting the first word as position 0. In list order the candidates differ exactly in those seven free bits, so this keeps the full 128 bits of entropy.
- Restore the phrase in your wallet and check that it shows the addresses you expect before you send any funds.
For a 24-word phrase, enter 23 words and flip three more times to choose among 8 candidates. Keep the coin-flip notes as safe as the phrase itself, or destroy them.
Related tools
To test whether a finished phrase is valid, use the BIP39 checksum checker. If you do not need to make your own randomness, the BIP39 generator creates a complete phrase, and our guide explains why you should never make up the words yourself.
Offline version
The generator, checksum checker, last word calculator and seed phrase converter in a single HTML file: it opens in a browser with no internet connection and makes no network requests.
Download the offline version (HTML, 522 KB)
Check the file’s SHA-256 before you open it: 96396acd75801a3a271b716cd0666bf006c613e8e6f7be5e47de7330bcec2887
macOS and Linux: shasum -a 256 bip39-tools-offline.html; Windows: certutil -hashfile bip39-tools-offline.html SHA256. v1.0.0, 2026-10-19.
BIP39 Last Word Calculator — Frequently Asked Questions
Why are there 128 valid last words for 12 words but only 8 for 24?
The last word carries 11 bits: some random, the rest checksum. A 12-word phrase has a 4-bit checksum, so 7 bits of the last word are free, which gives 2⁷ = 128 options. A 24-word phrase has an 8-bit checksum, leaving 3 free bits and 2³ = 8 options.
Does it matter which of the valid words I choose?
Yes. The free bits of the last word are part of your entropy, so choosing by preference throws some of it away. Pick at random: for a 12-word phrase, flip a coin seven times and take the word at that position in the list, as described above.
Can I make up the first 11 words myself?
No. Words you choose are far easier to guess than random ones, and the calculator cannot add the randomness that is missing. Generate the first words with dice or coins, or let a wallet create the whole phrase.
Guides
- How to Generate a BIP39 Seed Phrase with Dice, Step by Step
Each roll of a fair die adds 2.585 bits: 50 rolls make a 12-word BIP39 seed phrase, 99 a 24-word one. Two methods, a worked example and the last word.
- Why You Should Never Create Your Own Seed Phrase
Words you pick are far easier to guess than random ones; brain wallets made from invented phrases were usually drained within a day. Use a generator or dice.
- Can You Guess a Seed Phrase? Probability and Real Risks
No: a random 12-word BIP39 phrase is one of 2¹²⁸ possibilities and a 24-word one of 2²⁵⁶; real losses come from weak generators, self-chosen words and scams.
- How to Store a Seed Phrase: Paper, Steel and Safe Locations
Store a seed phrase offline on paper or stamped steel, in at least two separate places, never as a photo or file, and test each copy by restoring from it.