BIP-39 · Incomplete phrases
Recovering an incomplete recovery phrase
This is the case with the best prognosis of all, and the reason is not computing power: BIP-39 carries a checksum that throws away 99.6% of the combinations. If one word is missing, eight candidates remain. Eight.
Why one missing word is not a serious problem
Your phrase is not twelve or twenty-four independent secrets: it is a number dressed up as words, with a built-in checksum. Of every 256 possible combinations, only one passes it. That turns “one word is missing” into a problem of arithmetic rather than brute force.
| What is missing | Combinations | Pass the checksum |
|---|---|---|
| 1 word, position known | 2,048 | ~8 |
| 1 word, position unknown | 49,152 | ~192 |
| 2 words, positions known | 4,194,304 | ~16,384 |
| 2 words, positions unknown | 1.16 · 10⁹ | ~4.5 million |
| The whole phrase | 2²⁵⁶ | beside the point: there is no case |
The cases I work on
- One or two missing words, whether or not you know the position.
- Misspelled words, or words that do not exist in the list: the 2,048 BIP-39 words are unique in their first four letters, so an invented word can almost always be reconstructed.
- Scrambled order, when the disorder is bounded: two words swapped, two lines read backwards, a column transcribed vertically when it was horizontal.
- Doubt between two similar words in several positions at once.
- A complete phrase that opens nothing: sometimes it is a different derivation path, not a mistake in the phrase.
What kills the case
- A phrase lost entirely. Twelve unknown words cannot be searched, not with every computer on the planet. It is not a hard case: it is a closed one.
- The extra passphrase, the misnamed “25th word”, if there was one and you remember nothing about it. It has no checksum and leaves no trace: every different passphrase produces a different wallet, all valid and all empty but one.
- Three or more missing words with no other clue.
- Order lost completely: 24 scrambled words are 6.2 · 10²³ permutations.
The single most valuable piece of information
A known address from that wallet. Checksum filtering is instant; the expensive part is working out which of the surviving candidates is yours, because it means deriving dozens of addresses per candidate across several paths and looking them up on chain. With one address of yours, that becomes a comparison and the work divides by twenty. The second most valuable thing: knowing which application created the wallet, because it pins down the derivation path.
The article I lost one word of my 24-word seed explains where each number in the table comes from.