BIP39 Checksum
Type all words but the last. Get every valid last word. Nothing leaves your browser, but never type a phrase that holds real funds into any website.
- 0
- Words
- 0
- Endings
- 0
- Errors
On this page
About BIP39 Checksum Word Finder
Updated
What it does
The last word of a BIP39 phrase is partly a checksum: it is calculated from all the other words. This tool finds it. Type 11, 14, 17, 20 or 23 words, and it lists every word that makes a valid 12, 15, 18, 21 or 24-word phrase. This is useful when you make your own phrase, for example with dice, and need a correct last word.
How to use it
Type or paste your words. The tool checks each word as you type and suggests the right one when a word is not on the list. The valid last words show in the Result pane; click one to copy the whole phrase. Type a full 12 to 24-word phrase to check its checksum instead.
Keep your phrase safe
Anyone with your phrase can take your funds. This tool runs in your browser and does not send, store or log anything. For a phrase that holds real funds, use the tool on a computer that is not connected to the internet, and never store the phrase in a file, an email or a photo.
BIP39
BIP39 (Bitcoin Improvement Proposal 39) defines mnemonic phrases: a list of common words that stands for a random number. Wallets turn that number into the keys for your addresses. Most wallets show the phrase once and ask you to write it down. If your device breaks, the same phrase restores the wallet in any wallet that supports BIP39.
- Anyone who finds your phrase can open your wallet, so keep it somewhere safe and private.
- Phrases are 12, 15, 18, 21 or 24 words long. The checksum in the last word catches most typing mistakes.
How BIP39 works
The wallet takes 128 to 256 random bits and adds a checksum: the first bits of the SHA-256 hash of those random bits. The result is split into groups of 11 bits, and each group picks one of 2048 words. The phrase, together with an optional passphrase (sometimes called the 25th word), is then turned into the seed for all your keys.
Using BIP39 safely
- Do not store your phrase in a digital format, such as a text file, an email or a photo.
- Keep it in a secure physical place, such as a safe or a safe deposit box.
- Never share your phrase. No real support team will ask for it.
- Consider more than one secure place, so that one fire or flood cannot destroy every copy.
Other BIP39 resources
- BIP39 SpecificationThe original Bitcoin Improvement Proposal that defines mnemonic phrases and their checksum.
- BIP39 Word ListThe official English list of 2048 words used to build mnemonic phrases.
- Understanding BIP-39An article on the Ledger website about recovery phrases and why they matter.
- scure-bip39The audited JavaScript BIP39 library this tool uses for the word list and checks.
- Ian Coleman BIP39 ToolA well-known tool for working with BIP39 phrases, keys and addresses, also available offline.
BIP39 Checksum FAQ
Why are there many possible last words?
The last word holds two things: the last bits of the random number, and the checksum. For a 12-word phrase, the last word carries 7 random bits and a 4-bit checksum, so 128 words can end it. For a 24-word phrase, it carries 3 random bits and an 8-bit checksum, so 8 words can end it. Each of them gives a different, valid wallet.
Is my phrase sent anywhere?
No. The words are checked in your browser and nothing is sent, stored or logged. For a phrase that holds real funds, the safest place for any tool is a computer that is not connected to the internet.
Can this tool recover lost words?
No. It finds the last word, which is partly a checksum, from all the other words. It cannot guess missing words in the middle of a phrase: there are 2048 choices for each missing word, and only the wallet can tell which one is yours.
Which word list does it use?
The official English BIP39 list of 2048 words. Words are unique by their first four letters, so the tool can suggest the right word when you mistype one.
What lengths can a BIP39 phrase have?
12, 15, 18, 21 or 24 words. They hold 128, 160, 192, 224 or 256 random bits, plus a checksum of 4 to 8 bits.