A recovery phrase is meant to be the backup that never fails. In practice it is a row of words written by hand, years ago, often in a hurry, sometimes copied twice with a mistake introduced on the second copy. It is the single most common thing people bring me, and it is also one of the more recoverable ones, because a seed phrase is a structured object rather than a random string.
This guide explains that structure, what each kind of damage actually costs to search, and which mistakes convert a fixable seed into a permanently lost wallet.
What a seed phrase actually is
Locked out of a wallet like this one?
I repair hardware wallets, crack forgotten passwords, and rebuild broken seed phrases — on my own bench in Denver.
Nearly every modern wallet uses BIP-39. The words are not the secret in themselves. They are a human-readable encoding of a random number.
Three properties of that encoding do all the useful work in recovery:
The wordlist is fixed and public. English BIP-39 has exactly 2048 words. Your phrase cannot contain a word that is not on that list, which means a misspelled or misread word can usually be narrowed to a handful of candidates, and often to one. There are also official wordlists in Japanese, Korean, Spanish, Chinese, French, Italian, Czech, and Portuguese, and a phrase in one of those is not a lost cause either.
Every word in the list has a unique four-letter prefix. If your handwriting turned "abandon" into something illegible after the fourth character, the first four letters still identify the word exactly.
The last word carries a checksum. A 12-word phrase encodes 128 bits of entropy plus a 4-bit checksum; a 24-word phrase encodes 256 bits plus 8 bits. This means the overwhelming majority of random word combinations are invalid, and a computer can reject them instantly without touching the blockchain. That is why searching a damaged seed is tractable at all: the checksum throws away roughly 15 out of every 16 candidates for a 12-word phrase before any expensive work happens.
The seed alone is not the wallet. The phrase produces a master key, and a derivation path turns that master key into actual addresses. Two wallets given the same correct phrase can show you two completely different, both-empty balances if they use different paths. This trips people up constantly, and it is worth reading why a restored seed can show an empty wallet before concluding your coins were stolen.
The five ways a seed breaks
1. Missing words
Some words are gone: the paper tore, the ink faded, a line was skipped when copying. This is the classic case and it is often solvable.
The arithmetic is simple and unforgiving. Each unknown word multiplies the search space by 2048, before the checksum prunes it. One unknown word is trivial. Two is small. Three is a real computation but a finite one. Beyond that the space grows faster than hardware does, and whether a case is still worth attempting depends on what else you know: whether you know the positions of the missing words, whether you know any partial letters, whether you can rule out candidates. Knowing that word 9 is missing is enormously more useful than knowing that some word somewhere is missing.
If you know how many words you have and where the gaps are, the free assessment can tell you quickly whether your particular case falls inside the feasible range.
2. Wrong or misread words
The word on the paper is not a valid BIP-39 word, or it is valid but was written down incorrectly. Handwriting is the usual culprit: a and o, u and v, rn read as m, 1 and l, 5 and s. Autocorrect is the modern one, silently turning a wordlist word into an ordinary English word that is not on the list.
This is the cheapest case to fix, because the checksum plus the wordlist usually collapse the possibilities to a single answer. Our free browser-based seed phrase checker does exactly this: it validates a phrase, identifies which word is wrong, and suggests the correction, entirely on your own machine with nothing sent anywhere. There is an offline copy you can download and run with the network disconnected, which is how you should run it if the wallet holds real value.
3. Wrong order
Every word is correct, but two are transposed, or a column was read down instead of across, or a numbered list was written in two columns and read in the wrong sequence. Because the checksum validates the whole ordered phrase, a transposition fails exactly like a wrong word does, which is why people misdiagnose this one.
A small number of swapped positions is a small search. A fully shuffled 24-word phrase is not.
4. A passphrase you no longer have
BIP-39 supports an optional passphrase, often called the "25th word" or, on Trezor, a hidden wallet. It is not stored anywhere. It is mixed into the key derivation, and every different passphrase produces a different, completely valid wallet. There is no error message and no wrong answer, only a different empty wallet.
This is why an empty result does not prove your seed is wrong. It may prove you are missing the passphrase. Recovering one is a password-search problem rather than a wordlist problem, so it works the same way a forgotten wallet password does: it depends entirely on what you can remember about how you built it.
5. Not BIP-39 at all
Not every phrase is a BIP-39 phrase. Electrum uses its own seed format with a different checksum scheme. Older wallets used brainwallets, mini private keys, or raw key exports. Trezor supports SLIP-39 Shamir shares, where the phrase you are holding is one share of several and cannot restore anything on its own. Feeding an Electrum seed into a BIP-39 tool will simply tell you it is invalid, which is true and useless.
Identifying the format correctly is step one, and getting it wrong wastes weeks.
What to do, in order
- Photograph or scan what you have, at high resolution, and store copies in two places. Paper degrades and so does the memory of what an ambiguous character looked like.
- Transcribe carefully, in the original order, and record which positions you are unsure about. Uncertainty is information; do not throw it away by guessing.
- Check the first four letters of each word against the BIP-39 list. Anything that does not match a wordlist entry is a candidate error, and often the only one.
- Note the wallet software and hardware. Manufacturer, model, app, and roughly when you set it up. This determines the derivation path and the seed format.
- Write down anything you know about a passphrase, including whether you might have set one at all.
- Do not start guessing at random. Every unlogged attempt makes it harder to reason about what has already been ruled out.
What to avoid
Never type a seed phrase into a website. Not into a checker, not into a "validator", not into a wallet-support chat. A seed phrase in a text box is a wallet you no longer own. Anything that touches a real phrase should run offline, on hardware you control, with the network off. That includes our own tools, which is exactly why we publish downloadable offline copies and the source.
Never send a phrase to someone who contacted you first. I never DM, cold-email, or message anyone unprompted, and neither does any legitimate service. See the scam warning for how to verify that a message is genuinely from me.
Do not factory-reset a hardware wallet you cannot get into. If the seed on paper is the damaged copy, the device may still hold the intact one, and a reset destroys it.
Do not conclude you were robbed because a restored wallet came up empty. Check the derivation path and the passphrase first. Robbery leaves a transaction on-chain, and you can look for it.
When to bring it to someone
If the phrase is short by more than a word or two, if you have several uncertain positions at once, if a technically valid phrase restores to nothing, or if you are dealing with Shamir shares or a lost passphrase, the search stops being something a browser tool can do and becomes a real computation with real design choices behind it.
That is the work described on the seed phrase recovery page. The assessment costs nothing and there is no upfront fee, so the honest answer about your odds does not cost you anything to obtain. If the answer is that your case is not feasible, you will hear that too.