12 or 24 word seed phrase: which is safer?
Pick a word count and a passphrase to see how long a thief would need.
Never type your real seed phrase or passphrase into any website. This calculator only asks how long they are, and nothing leaves your browser.
Show the numbers
| Randomness in the words | 128 bits |
| Checksum bits in the last word | 4 |
| Valid 12-word phrases | 3.4 × 10³⁸ |
| Security against guessing without your backup | 128 bits |
Twelve words are enough. A 12-word phrase holds 128 bits of randomness, about the same strength as the keys that guard your bitcoin, so 24 words only add writing. A strong passphrase, stored apart from your words, protects you if someone finds them.
How the words are built
BIP39 wallets turn 128 to 256 bits of randomness into words from a fixed list of 2,048, at 11 bits per word. The last word carries a checksum (one bit per 32 bits of randomness), so a wallet can catch most typos.
| Words | Randomness | Checksum bits | Valid phrases |
|---|---|---|---|
| 12 | 128 bits | 4 | about 3.4 × 10³⁸ |
| 15 | 160 bits | 5 | about 1.5 × 10⁴⁸ |
| 18 | 192 bits | 6 | about 6.3 × 10⁵⁷ |
| 21 | 224 bits | 7 | about 2.7 × 10⁶⁷ |
| 24 | 256 bits | 8 | about 1.2 × 10⁷⁷ |
Why 24 words is not safer
An attacker without your backup can guess your phrase or attack a key directly. Foundation, which makes the Passport Prime hardware wallet, notes that the best known attack on a Bitcoin key, Pollard's rho, takes about 2¹²⁸ operations, the same as guessing a 12-word phrase. Extra words only make the phrase harder to guess, so your bitcoin stays at 128 bits either way, and each one is another chance for a backup mistake. If your wallet already gave you 24 words, keep them.
Frequently asked questions
How many 12-word seed phrases are there?
Twelve words from the 2,048-word list can form 2,048¹² sequences, about 5.4 × 10³⁹. The checksum rules most of them out, leaving 2¹²⁸ valid phrases, about 3.4 × 10³⁸.
How many 24-word seed phrases are there?
There are 2²⁵⁶ valid 24-word phrases, about 1.2 × 10⁷⁷. Only 8 of the 2,048 possible final words are valid for any 23 words before it.
Is a 24-word seed phrase more secure than 12 words?
Not in practice. Your bitcoin is protected by keys with about 128 bits of security either way, so the extra words only add backup work.
Can someone guess my seed phrase?
Not if your wallet generated it. Foundation estimates guessing a 12-word phrase would take billions of years on modern supercomputers. The danger is a phrase that was never random, such as one you made up or one from a generator website.
Why does my Trezor have 20 words?
Trezor Safe devices now default to a Shamir (SLIP39) backup of 20-word shares at 128-bit strength, with their own word list. A BIP39 backup made on a Trezor is 12 or 24 words, and the Model One uses BIP39 only.
How long should a seed phrase passphrase be?
Long enough that a thief holding your words cannot guess it. A random lowercase letter adds about 4.7 bits, a random letter or digit about 6, and a random word from the 2,048-word list 11. The calculator above shows when that is enough. A passphrase you invent is weaker than its length suggests.