The seed phrase checksum, and why your last word is special

Most people never think about how a recovery phrase is built until one stops working. Then one detail matters more than any other: the words are not independent. The last one depends on all the rest.

A phrase is a number written in words. Your wallet starts with a random number — 128 bits of it for a 12-word phrase, 256 bits for 24. It then appends a short checksum, calculated from that number with a hash function: 4 bits for 12 words, 8 bits for 24. The whole thing is cut into 11-bit pieces, and each piece picks one word from the list of 2,048. Twelve words times eleven bits is 132 bits: 128 of randomness and 4 of checksum.

The checksum lives in the last word. Because the checksum sits at the end, the final word is part randomness and part checksum. For a 12-word phrase it carries 7 random bits and 4 checksum bits, so once the first eleven words are fixed, only 128 of the 2,048 words can legally come last. For 24 words the last word carries only 3 random bits, so just 8 words fit. The offline checker lists them for any set of first words, on a computer disconnected from the internet.

What the checksum catches. Most single mistakes: a wrong word, a misread word, two words swapped, a missing word. For a 12-word phrase, a random error slips past it about one time in sixteen; for 24 words, about one time in 256. That is why a wallet that says "invalid phrase" is usually right that something is wrong.

What it cannot catch. It cannot tell you the phrase is yours. About one in sixteen random 12-word phrases passes, so a phrase with a wrong word can still validate, and restore a perfectly real, perfectly empty wallet. The only proof of ownership is an address you know held your funds. And the checksum knows nothing about a passphrase — the 25th word has no checksum at all.

Why an invalid result is useful. It narrows the search. If a phrase fails, at least one word is wrong, missing or misplaced — and because most wrong candidates also fail, the checksum cuts any systematic search by a factor of 16 for 12 words and 256 for 24. That is the difference between reordering a phrase being hours of computing and being impossible. See words in the wrong order and a missing word.

Not every phrase is BIP39. Electrum's own seeds use the same word list but a different checksum, and Monero uses 25 words from its own list. Those phrases fail a BIP39 check while being perfectly valid in the wallet that made them. If a phrase has never passed any BIP39 check, it is worth asking which wallet created it before assuming it is damaged.

Two warnings, because this is where people get hurt. First, a checksum tool never needs to be online, so never use one that is — any page asking for your words has your wallet. The BIP39 word checker on this site takes one word at a time and refuses more; the whole-phrase checks are only in the offline file. Second, do not invent your own last word to make a phrase you generated yourself valid unless you understand exactly how, and do it offline: a phrase made that way is only as random as the words you chose.