1. Home
  2. / BIP39 Last Word Calculator

BIP39 Last Word Calculator

Enter the first 11, 14, 17, 20 or 23 words of a phrase and get every last word that gives a valid BIP39 checksum. The calculation runs in your browser.
For a real wallet, do this on a computer that never goes online, not on a website. The words you enter here are the secret of the wallet.

Why the last word is special

A BIP39 phrase is a random number followed by a checksum: the first ENT/32 bits of its SHA-256 hash, where ENT is the length of the random part. Every word stands for 11 bits, and the checksum lands at the end, inside the last word. So the first words can be anything from the list, but the last one has to fit them: most words fail, and wallets reject the phrase as invalid. The calculator tries all 2048 words and keeps the ones that pass, exactly as described in the BIP39 specification.

Phrase lengthWords you enterFree bits in the last wordChecksum bitsValid last words
121174128
15146564
18175632
21204716
2423388

Try it with the public test phrase: after eleven times abandon the calculator shows 128 words, and the first of them is about, the word that ends the official BIP39 test vector.

Building a phrase from dice or coin flips

The calculator exists mostly for people who make their own randomness instead of trusting a device's generator. A sketch for a 12-word phrase:

  1. Make 11 random numbers from 0 to 2047. Eleven coin flips per word give an 11-bit number; the word with that index (number plus one on a list numbered from 1) is the word. Dice work too, as long as the method gives every number the same chance.
  2. Enter the 11 words. The calculator lists the 128 words that complete a valid phrase, in list order.
  3. Pick one at random. Flip a coin seven more times and read the result as a binary number from 0 to 127: take the word at that position, counting the first word as position 0. In list order the candidates differ exactly in those seven free bits, so this keeps the full 128 bits of entropy.
  4. Restore the phrase in your wallet and check that it shows the addresses you expect before you send any funds.

For a 24-word phrase, enter 23 words and flip three more times to choose among 8 candidates. Do all of this on a computer that is offline, with an offline copy of the tool, and keep the coin-flip notes as safe as the phrase itself, or destroy them.

Related tools

To test whether a finished phrase is valid, use the BIP39 checksum checker. If you do not need to make your own randomness, the BIP39 generator creates a complete phrase, and our guide explains why you should never make up the words yourself.

BIP39 Last Word Calculator — Frequently Asked Questions

Can I use the calculator for a wallet that will hold real funds?

Not on a computer that is online. The calculator runs in your browser, but the first words of your phrase are secret, and a web page shares the computer with extensions, other scripts and malware. For a real wallet, run an offline copy of a BIP39 tool on a computer that never connects to the internet, or use a hardware wallet that accepts your own dice rolls as entropy.

Why are there 128 valid last words for 12 words but only 8 for 24?

The last word carries 11 bits: some random, the rest checksum. A 12-word phrase has a 4-bit checksum, so 7 bits of the last word are free, which gives 2⁷ = 128 options. A 24-word phrase has an 8-bit checksum, leaving 3 free bits and 2³ = 8 options.

Does it matter which of the valid words I choose?

Yes. The free bits of the last word are part of your entropy, so choosing by preference throws some of it away. Pick at random: for a 12-word phrase, flip a coin seven times and take the word at that position in the list, as described above.

Can I make up the first 11 words myself?

No. Words you choose are far easier to guess than random ones, and the calculator cannot add the randomness that is missing. Generate the first words with dice or coins, or let a wallet create the whole phrase.

Guides