There is a specific version of a lost wallet that is worth separating from all the others. Your recovery phrase is intact. Every word validates. The wallet restores without complaint. And the balance is zero, because at some point you turned on the feature your device called an optional passphrase, a hidden wallet, or a 25th word, and you no longer remember what you typed.
This is not the same problem as a lost seed, and it is not the same problem as a forgotten file password. It has its own mechanics, its own odds, and its own set of details that turn out, more often than you would expect, to be the entire problem.
A note on scope before anything else. This guide is about wallets whose keys are still yours. If your coins were sent to someone else's address in a hack or a scam, no passphrase work brings them back, and the honest version of that answer is at my Bitcoin was stolen, can you help. And the standing rules apply here as much as anywhere: do not type your seed phrase into a website, and do not hand it to anyone who contacted you first. If you are deciding who to trust, read how to tell a legitimate recovery service from a scam before you share anything with anyone.
Why there is no "wrong passphrase" error
Locked out of a wallet like this one?
I repair hardware wallets, crack forgotten passwords, and rebuild broken seed phrases — on my own bench in Denver.
The behaviour that confuses people is not a bug, it is the design.
BIP-39 turns your words into a wallet seed with PBKDF2, using HMAC-SHA512 as the pseudo-random function, an iteration count of 2048, and a 512-bit output. The passphrase is not checked against anything. It is concatenated into the salt, which the standard specifies as the string mnemonic plus your passphrase, both in UTF-8 NFKD.
Because the passphrase is an input to derivation rather than a credential, there is nothing to validate it against. BIP-39 states the consequence plainly: "Every passphrase generates a valid seed (and thus a deterministic wallet) but only the correct one will make the desired wallet available." The specification treats this as a feature, noting that the method "also provides plausible deniability", since an observer cannot tell a decoy passphrase from a real one.
So there is no wrong passphrase. There is only a different wallet. Trezor builds this directly into the product and describes it the same way: "Entering a different passphrase, intentionally or by mistake, creates a new, empty wallet."
Two practical consequences follow, and both are useful.
The first is diagnostic. Because the passphrase is mixed in at the seed level, it changes every key the seed produces, on every derivation path and for every coin. If a restore shows an empty balance for Bitcoin and Ethereum and everything else you held, a passphrase is a much better explanation than a derivation-path mismatch, which usually strands one coin or one account rather than all of them at once.
The second is that testing is cheap and safe. A candidate passphrase can be tried offline, watch-only, without ever moving funds or exposing a private key, and a wrong guess costs you nothing but time.
What your wallet called it
Same mechanism, different vocabulary, which is why people often do not realise they enabled it.
| Wallet | What it is called there | Documented limit |
|---|---|---|
| Trezor | Passphrase, hidden wallet | Case-sensitive, up to 50 ASCII characters |
| Ledger | Passphrase, the 25th word | Case-sensitive, maximum 100 characters |
| Electrum | Seed extension, extra words | Set when the seed is created |
| Most software wallets | Passphrase, or an "advanced" option at restore | Varies |
The device limits are not trivia. They are constraints that shrink a search. Trezor accepts ASCII only, so a passphrase you half-remember as containing an accented letter or an emoji cannot be what you typed on a Trezor. Ledger's cap at 100 characters rules out a remembered sentence longer than that. Every constraint you can establish removes candidates before a single one is tested.
Note also what none of these vendors can do for you. Trezor does not store the passphrase on the device and says it "cannot be changed, removed, or recovered". Ledger says it "does not store or back up passphrases" and that if you lose it, "your hidden accounts become inaccessible". Neither company has a reset path, and anyone claiming to have one at either company is running a scam.
First, confirm it really is the passphrase
Before searching for something you may not have set, rule out the cheaper explanations. A seed that restores empty has several possible causes, and the passphrase is only one of them. The full diagnostic is in your seed phrase restored an empty wallet; the short version:
- Test with an empty passphrase first, deliberately and explicitly. Some apps silently pass an empty string while others prompt, and people occasionally "remember" setting a passphrase they never set.
- Read the first address you got. If your old wallet paid you at addresses starting with
1and the restore showsbc1q, that is a derivation-path difference, not a passphrase. - Check whether the wallet scanned far enough. A gap limit that stops before your funded addresses looks identical to an empty wallet.
- Confirm the seed itself is well-formed before blaming anything else. The seed phrase checker validates the structure in your browser, without the phrase leaving your machine.
Only when a valid seed, an empty passphrase, and the right paths still produce nothing does a passphrase search make sense.
What actually recovers a forgotten passphrase
Here is the honest split, and it is a genuine split rather than a sales pitch.
If you remember nothing at all, it is gone. A passphrase with no remembered structure is equivalent to a random secret. There is no shortcut, no vendor override, and no service that changes this. Anyone who tells you otherwise is selling you something.
If you remember something, it is a search problem. And "something" is a lower bar than people assume. Useful fragments include: the words or phrase you think you used, a scheme you used for passwords in that era, the approximate length, whether it was one word or several, whether it ended in digits or punctuation, and which keyboard or device you typed it on.
From fragments like those, candidates are generated systematically rather than guessed: your remembered tokens in different orders, with different separators, with and without capitalisation, with common substitutions and appended digits. The open-source tool most often used for this is BTCRecover, documented as "an open source wallet password and seed recovery tool", which explicitly supports "BIP-39 passphrases (Also supports all cryptos supported for seed recovery, as well as recovering 'Extra Words' for Electrum seeds)", with GPU acceleration for BIP-39 and Electrum seeds.
What decides the outcome is the quality of your recollection, not the size of the machine. This is the same shape as Bitcoin Core password work: each candidate costs a fixed 2048 PBKDF2 iterations by design, so the cost per guess cannot be optimised away. The only lever that matters is reducing how many guesses are needed, and that lever is your memory.
The near misses that are usually the whole problem
Before running any search, work through these. In practice a large share of "forgotten" passphrases were never forgotten, only mistyped, and the wallet had no way to say so.
- A trailing or leading space, often from copy and paste, or from a phone keyboard adding one after a word.
- Capitalisation, including a mobile keyboard auto-capitalising the first letter of something you entered in lower case.
- Autocorrect silently changing a word on a phone or tablet at the moment you set it.
- Smart quotes and dashes, where a note-taking app converted a straight apostrophe into a curly one. On a Trezor this also collides with the ASCII limit.
- Keyboard layout, if the passphrase was set on a different layout than the one you are testing on.
yandz, and most punctuation, move between layouts. - A different Unicode form, since the standard normalises to NFKD. Accented characters entered two different ways can look identical on screen and still derive differently.
- The passphrase you tested once. People frequently try a throwaway passphrase to see what the feature does, fund that wallet later, and remember only the throwaway.
Write each variant down as you try it. Which brings us to the method.
Testing safely
The seed already exists, so nothing here is time-critical. Be slow and be methodical.
- Never test on a website. Every "check your seed phrase" page is either a scam or one breach away from being one.
- Test watch-only. Derive the extended public key for a candidate and check it against a block explorer. You learn whether a passphrase holds coins without ever exposing a private key.
- Use a machine you trust, offline where you can, and prefer well-known wallet software over a path-scanning utility found in a search result.
- Keep a log of every candidate, path, and account index you have tried and what came back. It stops you repeating work, and if you later hand the case to someone, they start from your notes instead of from zero.
- Do not wipe or re-initialise the original device while testing. It may still hold the only copy of something, and a wipe cannot be undone.
When it is worth handing off
Much of the above you can do yourself, and if the passphrase surfaces on your third variant you should. The cases that usually justify professional help are the ones where the candidate space is large enough to need structuring rather than guessing:
- You remember the ingredients but not the arrangement, so the search has to be generated and prioritised rather than typed by hand.
- The wallet is a hardware device and you want the seed handled once, carefully. See Trezor recovery and repair and Ledger wallet recovery.
- The passphrase sits on top of a seed that is itself incomplete or damaged, which is two problems at once. That starts at seed phrase recovery.
- What you have forgotten turns out to be an Electrum seed extension, covered at Electrum wallet recovery.
For an honest read on which of these tend to succeed, see your recovery odds by scenario. For the wider picture of how a passphrase sits alongside seeds and PINs, see how hardware wallets work and a guide to seed recovery.
If you would rather not run the search yourself, that is the service: crypto wallet recovery by David Veksler through a Colorado LLC, with published pricing, a free assessment, and no fee until your crypto is back. In a first message, describe what you remember about the passphrase and what your restore is showing. Never send your seed words or your passphrase candidates. Get your free assessment →
Sources
- BIP-39, the optional passphrase, PBKDF2-HMAC-SHA512 at 2048 iterations, the
mnemonicsalt, and plausible deniability: https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki (retrieved 2026-09-01) - Trezor on passphrases and hidden wallets, the 50-character ASCII limit, and that a passphrase cannot be recovered: https://trezor.io/learn/a/passphrases-and-hidden-wallets (retrieved 2026-09-01)
- Ledger on the 25th word, the 100-character maximum, and that Ledger does not store or back up passphrases: https://www.ledger.com/academy/passphrase-an-advanced-security-feature (retrieved 2026-09-01)
- BTCRecover documentation, BIP-39 passphrase and Electrum extra-word recovery support: https://btcrecover.readthedocs.io/en/latest/ (retrieved 2026-09-01)