Invalid Seed Phrase? How to Find and Fix a Wrong Word (BIP39)
Читать по-русски: Неверная сид-фраза: как найти и исправить ошибку
A wallet calls a seed phrase invalid when one of the words is not on the BIP39 word list or when the words fail the checksum that BIP39 builds into the last word. The backup itself is usually fine and the mistake is small: a misspelled or misread word, a skipped word or two words in the wrong order. You can find it by checking every word against the list, testing the few words that pass the checksum in the doubtful position, and keeping only the candidate that produces an address you recognize. A phrase in another format, such as an Electrum seed or a 20-word Trezor backup, is rejected by any wallet that expects a BIP39 phrase, however correct its words are.
Invalid Seed Phrase: Causes at a Glance
| What you see | Likely cause | What to do |
|---|---|---|
| The wallet flags one word | A misspelling, a plural or a word that is not on the list | Look it up in the BIP39 word list; the checksum checker suggests the closest valid words |
| ”Invalid checksum” though every word is on the list | A valid but wrong word, such as peace for piece, or two swapped words | Test the doubtful position: about 1 word in 16 passes the checksum there |
| A word is missing | Skipped when writing or typing | For the last word, the last word calculator lists the valid endings; otherwise try each position |
| The phrase is accepted but the balance is zero | A wrong word that passed the checksum, a passphrase or another derivation path | Compare the first address with your records; see what to check after a restore |
| 20, 25 or 33 words, or an Electrum seed | Not a BIP39 phrase | Restore it in a wallet that supports that format |
MetaMask’s help page for its “Invalid Seed Phrase” error starts with the same two checks: every word against the BIP39 English list, then the original order, with one space between words and all in lowercase (MetaMask Support).
Why Does a Wallet Reject a Seed Phrase?
A BIP39 seed phrase, typically 12 or 24 words, encodes random data called entropy, and part of its last word is a checksum calculated from that data. When you enter the phrase, the wallet runs two tests: every word must be on the list of 2,048 words, and the checksum must match. A typo usually fails the first test; a wrong word that happens to be on the list fails the second.
How the Checksum Is Built
According to the official BIP39 specification, a seed phrase can be 12, 15, 18, 21 or 24 words long. For a 12-word phrase:
- The wallet generates 128 bits of entropy.
- It hashes the entropy with SHA-256 and takes the first 4 bits of the hash as the checksum: one bit for every 32 bits of entropy.
- It appends those 4 bits to the entropy, which gives 132 bits.
- It splits the 132 bits into twelve groups of 11 bits.
- Each group is a number from 0 to 2047 that picks one word from the list.
A 24-word phrase works the same way with 256 bits of entropy and an 8-bit checksum. The checksum always ends up in the last word: 4 of its 11 bits in a 12-word phrase, 8 in a 24-word one. Our BIP39 visualizer shows the checksum bits landing in the last word, one 11-bit group at a time.
Why One Wrong Word Usually Shows Up
A 4-bit checksum matches by chance once in 16 times. So if one word of a 12-word phrase is wrong, the wallet notices it about 15 times out of 16; with 24 words and 8 checksum bits, it misses about 1 error in 256. For the same reason, not every combination of valid words makes a valid phrase.
The BIP39 specification itself lists the short checksum as a shortcoming: it gives only modest odds of catching random errors and cannot help you correct them.
What If a Wrong Word Passes the Checksum?
Then the wallet accepts the phrase and opens a different, valid wallet, usually an empty one, and your funds seem to be missing. A valid checksum does not prove that the phrase is yours, so check that the first address the wallet shows matches your records, such as an old receiving address or the withdrawal history on an exchange. For background on how mnemonics, seeds and derived addresses fit together, see the wallets chapter of Mastering Bitcoin by Andreas Antonopoulos and David Harding, free to read on GitHub.
How to Find a Wrong Word
Two common cases have a shortcut. A misspelled word that is not on the BIP39 list is the easiest error to find: the BIP39 checksum checker highlights it and suggests the closest valid words. If only the last word is missing, the last word calculator cuts the 2,048 possibilities down to the words that complete the phrase with a valid checksum, 128 for a 12-word phrase and 8 for a 24-word one. Only one of them restores your wallet, so check each candidate against an address you know.
Check Every Word Against the List
Go through the backup word by word and look each one up in the BIP39 English word list. The list was built so that the first four letters identify every word, which means a word with a smudged or illegible ending can still be pinned down. Most errors fall into a few patterns:
| Error | Examples | Does the word check catch it? |
|---|---|---|
| Sound-alike words, both on the list | peace / piece, pair / pear, right / write | No: only the checksum can |
| Look-alike handwriting, both on the list | coach / couch, daring / during, wine / wire | No: only the checksum can |
| Similar spelling, both on the list | thunder / wonder | No: only the checksum can |
| A word that is not on the list | apples (the list has apple), flour (the list has flower) | Yes: the wallet flags the word |
| Two words swapped | Word 5 and word 6 in each other’s place | No, every word is valid; the checksum catches most swaps |
Try Each Word in the Doubtful Position
If you know which word is wrong, try every word of the list in its place:
- Note the position of the doubtful word.
- Put each of the 2,048 words in that position in turn.
- Keep the candidates that pass the checksum.
- Restore each survivor and keep the one that shows an address you recognize.
About 1 word in 16 survives step 3. In the official test vector ozone drill grab fiber curtain grace pudding thank cruise elder eight picnic, for example, 125 of the 2,048 words pass the checksum in the fourth position, and only one of them, fiber, is right. Swapped words behave the same way: of the 66 ways to swap two words in that phrase, 2 still pass the checksum, and none of the 11 swaps of neighboring words does. By hand this takes hours; the tools below do it in seconds.
Use a Recovery Tool
- Seed Savior is a browser-based tool from ZenGo, built on Ian Coleman’s BIP39 tool. Type ”?” for a missing word and it lists every option; for a wrong word it suggests the closest match. A standalone HTML version works offline.
- FinderOuter is an open-source bitcoin recovery tool that finds missing words in BIP39 and Electrum seed phrases. It checks candidates against a key or address you already know, so you need one derived address and its exact derivation path.
- BTCRecover is an open-source wallet password and seed recovery tool. Its seed recovery script takes a phrase with one or more mistakes in it and searches for the right one.
BTCRecover’s seed recovery quick start comes down to these steps:
- Download BTCRecover from its official repository and install Python and the packages it needs.
- Run
seedrecover.pyand choose your wallet type. - Give it something to check against: the wallet’s master public key (xpub), or a few addresses from the first account, preferably early ones, plus how many addresses to generate for each guess.
- Enter your best guess of the seed phrase.
- Verify the result. Restore the phrase it finds in your wallet and check that the expected addresses and funds appear.
What If You Don’t Know Which Word Is Wrong?
Unknown Position
If you suspect an error but don’t know which word is wrong, a tool has to try every position, which multiplies the work by the length of the phrase. For a 12-word phrase with one wrong word somewhere, that is 12 × 2,048 = 24,576 candidates; for a 24-word phrase, 49,152.
Several Wrong Words
When more than one word might be wrong, the numbers grow fast:
- For two unknown words in a 12-word phrase: 2,048² ≈ 4.2 million combinations if you know which two positions are wrong, or about 277 million (66 possible position pairs × 2,048²) if you don’t
- For three unknown words: 2,048³ ≈ 8.6 billion combinations with known positions, or about 1.9 trillion (220 possible position triples × 2,048³) with unknown positions
A 12-word phrase has only a 4-bit checksum, so about 1 in 16 random candidates still passes it. The checksum thins out these numbers, but the survivors still have to be checked against something you know:
- Addresses the wallet should derive from the seed
- Part of your transaction history
- The wallet app and the derivation path it used
Confirming the Right Candidate
When several candidate phrases pass the checksum, find the right one by:
- Generating the first few addresses for each candidate
- Checking in a block explorer which addresses have a transaction history
- Verifying that the balance matches your expectations
Different wallets may use different derivation paths for the same seed phrase, so knowing which wallet software you originally used can decide the search. If the wallet accepts the phrase but shows a zero balance, our guide to restoring a wallet from a seed phrase lists what to check.
Is It a BIP39 Phrase at All?
Some backups look like BIP39 phrases but follow other rules, and a wallet that expects BIP39 rejects them however carefully you check the words. Seed phrase formats by network covers the exceptions; the common ones are:
- Electrum seeds. Electrum does not generate BIP39 seeds: its phrases use the same 2,048-word list but carry a version number instead of the BIP39 checksum (Electrum documentation). Restore them in Electrum as an Electrum seed; see Electrum seed vs BIP39.
- SLIP-39 shares. 20 or 33 words from a separate list of 1,024 words, created by default on newer Trezor models (SLIP-39 vs BIP39).
- TON and Monero. A classic TON phrase has 24 words from the BIP39 list but its own check; a Monero phrase has 25 words from Monero’s own list.
- Another language. A phrase from one of the other BIP39 word lists is valid, but many wallets, MetaMask among them, accept English phrases only.
How to Avoid Seed Phrase Errors
Write the Phrase Down Carefully and Test It
- Write clearly and number the words. Spell each word exactly as in the list; if your handwriting is hard to read, the first four letters printed clearly are enough to identify a word.
- Use metal for the long term. Specialized metal plates protect the words against fire, water and time.
- Keep more than one copy. Store redundant copies in different secure locations.
- Test the backup before you fund the wallet. Restore a wallet from what you wrote down, or use your hardware wallet’s backup check; our guide to testing your wallet backup walks through it.
Back Up a Passphrase Separately
Many wallets support an additional passphrase, sometimes called the “25th word”, that combines with your seed phrase. It protects against theft of the written words and allows plausible deniability wallets.
The passphrase has no checksum, though. As the BIP39 specification notes, every passphrase generates a valid seed, so a typo in it raises no error: it simply opens a different, empty wallet.
Jameson Lopp compares a passphrase-protected wallet to a 2-of-2 multisig: lose either the words or the passphrase and the funds are out of reach, and he has seen people locked out of their funds after forgetting or losing the passphrase. Back up the passphrase as carefully as the seed phrase, but not in the same place.
Check Your Backup Regularly
- Set reminders to check your backups, for example before every firmware update
- Test recovery on a spare device without connecting it to the internet
- Verify that the expected wallet addresses are generated
For Developers: Where the Checksum Check Happens
Once a phrase passes the checksum, the wallet turns it into the seed:
- It normalizes the phrase with Unicode NFKD normalization.
- It builds the salt: the string “mnemonic” followed by the optional passphrase.
- It runs PBKDF2 with HMAC-SHA512 and 2,048 iterations.
- The resulting 512-bit value is the seed from which the HD wallet derives every key.
Wallets check the checksum before this step, and recovery tools do the same: one SHA-256 hash is far cheaper than 2,048 rounds of HMAC-SHA512, so most wrong candidates are discarded before the expensive part. For both stages in working code, see a BIP39 implementation in Python.
Frequently Asked Questions
Can a seed phrase be invalid if every word is right?
Yes. The words may be in the wrong order, the app may expect a different number of words, or the phrase may not be BIP39 at all, like an Electrum seed or SLIP-39 shares. Some apps are also strict about capital letters and extra spaces; MetaMask, for one, asks for lowercase words with one space between them.
Can I recover a seed phrase with two wrong words?
Usually, if you know at least one address of the wallet. With the two positions known, there are about 4.2 million combinations, of which about 262,000 pass the checksum, and a recovery tool can test those against your address on an ordinary computer. If you don’t know the positions, the search is 66 times larger.
Can wallet support fix my seed phrase?
No. The developers of a non-custodial wallet never see your phrase and cannot correct it. Anyone who offers to fix it if you send them the words, including people posing as support in chats and on social media, is trying to take the funds: see common seed phrase scams.