How Many Words Should a Seed Phrase Have?

A BIP39 mnemonic can contain 12, 15, 18, 21 or 24 words. The right length depends on the wallet format and how its initial entropy was generated: in BIP39, those choices represent 128, 160, 192, 224 or 256 bits of entropy, plus a short checksum. For a new wallet, let a trusted device or application generate those bits randomly and keep an offline backup. Choosing 24 words by hand or deriving them from predictable data does not create a wallet with 256-bit security.

What BIP39 length means

The BIP39 specification starts with initial entropy (ENT) generated by a random source. It then takes ENT / 32 bits from the entropy's SHA-256 hash as a checksum, appends those bits, and splits the result into 11-bit groups that map to words in a 2048-word list.

That produces five standard combinations:

• 12 words: 128 bits of entropy and 4 checksum bits.
• 15 words: 160 bits of entropy and 5 checksum bits.
• 18 words: 192 bits of entropy and 6 checksum bits.
• 21 words: 224 bits of entropy and 7 checksum bits.
• 24 words: 256 bits of entropy and 8 checksum bits.

The checksum can catch some transcription mistakes, but it is not an extra password and does not prove that the phrase restores the wallet you expect. BIP39 notes that its checksum is short: some random errors can pass, and it cannot tell you which word is wrong. A well-formed phrase still needs a recovery test in compatible wallet software or on a trusted device.

After creating the mnemonic, BIP39 can derive a 512-bit binary seed from the mnemonic and an optional passphrase with PBKDF2-HMAC-SHA512. That output length is the same for the BIP39 lengths above and does not promise 512-bit security; the initial entropy and the quality of its generation remain decisive.

Should you use 12 or 24 words?

Both can be valid when a compatible wallet generates them correctly. Twelve words already represent 128 bits of random entropy, an enormous space when the random source is cryptographically secure. Twenty-four words raise the initial entropy to 256 bits, but they also take longer to record, require more checks during recovery and may not be the format your device uses.

Compatibility matters more than choosing the largest number. The current Trezor wallet-backup guide distinguishes its 12- or 24-word BIP39 backups from 20-word SLIP39 backups. It also says that a backup should stay offline, private and protected from loss or damage. A 20-word SLIP39 backup cannot be entered as if it were a BIP39 mnemonic.

Before recovery, confirm the format, wordlist, language and procedure documented by the manufacturer. SLIP-0039 describes a different secret-sharing system in which several parts may be required to reconstruct a backup. The word count alone does not identify the standard.

Why 24 words do not always mean 256-bit security

The 256-bit figure describes the random initial entropy BIP39 expects. It does not automatically describe any text that ends up encoded as 24 words. A phrase someone selected personally or calculated from a public location can have a much smaller search space, even if it has 24 words and a valid checksum.

That distinction matters in SeedAddress. In the browser, the mnemonic is derived from the selected coordinates, a password, a language and a word length; the local process uses a precision-9 geohash and HMAC-SHA256. The address is public information, and the method adds no new random entropy. Choosing 24 words changes the result size and checksum length, but it does not turn deterministic inputs into the 256 bits of initial entropy BIP39 expects from a random source.

Recovery also depends on reproducing the same inputs. Two nearby points inside the same precision-9 geohash cell can produce the same phrase, while a provider changing its returned coordinates can produce a different one. The interface cannot paste historical coordinates to replay a recovery, and a wallet may not redisplay or reissue an old seed. Keep an offline copy of the phrase and the recovery data you need; never put real secrets in a website, screenshot or this article.

The application accepts five-character passwords for legacy compatibility. That minimum is not a security recommendation. If you use the deterministic method, choose a unique password that is difficult to guess, preserve the exact coordinates and assume an attacker can know the public address. For significant funds, prefer a wallet that generates its seed from a secure random source and follow its backup procedure.

How to choose and check a backup

1. Follow the wallet's format

Record whether the backup is BIP39 or SLIP39, how many words or shares it requires and which language it uses. Do not mix a BIP39 passphrase with a device PIN or the SeedAddress input password: they serve different purposes. A BIP39 passphrase changes the derived seed, and every value produces a valid wallet; a typo can lead to an empty wallet without a wrong-password message. The guide on seed phrases versus BIP39 passphrases explains the distinction.

2. Check it privately and offline

Use the device's own backup-check feature when available. If you need to restore a backup, use a trusted spare device and follow the manufacturer's documented recovery procedure; do not erase the only working device to test an unverified backup. Compare a known public address and avoid entering the words into an online service. This offline backup-check guide explains why a valid checksum does not prove that the backup is the right one.

3. Keep an independent copy

Store the phrase on durable physical media and in more than one secure location, according to your threat model. Do not rely only on the device that generated it, an online account or one person's memory. Bitcoin.org recommends complete backups in secure locations; the backup must remain private because anyone who obtains the words can attempt to restore the funds.

Frequently asked questions

Is a 24-word phrase always better?

No. In a correctly generated BIP39 wallet, it provides more random entropy than 12 words. If the input was predictable, hand-picked or derived from public data, adding words does not fix the missing randomness.

Can I turn 12 words into 24?

Not by appending words. They are different entropy and checksum sizes. If you want a wallet with another length, create a new wallet with independently secure random entropy and your preferred supported length; verify its backup, recovery and addresses before transferring funds if you choose to migrate.

Does SeedAddress generate a random seed?

No. It reproduces a mnemonic from coordinates, a password, language and word length in the browser. It can help study deterministic derivation or recover a known result, but it does not replace a new wallet generated with random entropy or an independent offline backup.