BIP-39 Checksum Calculator & Solver
Diagnostic utility to compute the 8 valid 24th-word candidates for any 23 BIP-39 words and detect dictionary typos. Computations execute locally in your browser memory using the WebCrypto API.
Security Warning: Never Enter Real Production Recovery Phrases Online
Do not type your real 24-word recovery phrase or private keys into any browser window, online computer, or connected device. Browser extensions, keyloggers, clipboard monitors, and operating system caches can compromise sensitive credentials.
Operational Isolation: This calculator runs mathematical computations (SHA-256 bit slicing, entropy hashing, dictionary verification) locally in your browser session using native WebCrypto (crypto.subtle). Analytics scripts are disabled on this page, and no inputs are sent to remote servers or persistent storage. For distressed wallets, test only with known public test vectors, isolated offline systems, or perform verification directly on the physical hardware screen.
Calculate Valid 24th Words
Enter your first 23 test words. The algorithm computes the exact 8 words that satisfy the SHA-256 8-bit checksum.
Need to Test a Real Ledger Seed Phrase Without Online Exposure?
Never type a real seed phrase into a computer. Use Ledger's official on-device Recovery Check application to verify mnemonic validity directly inside the Secure Element.
Frequently Asked Cryptographic Questions
How does the BIP-39 24th word checksum calculation work mathematically?
In a 24-word BIP-39 mnemonic, the initial entropy is exactly 256 bits (32 bytes). The checksum is generated by taking the SHA-256 hash of this 256-bit entropy and extracting the first 8 bits (entropy length / 32 = 8 bits). These 8 checksum bits are appended to the 256 entropy bits, producing 264 bits total. Because each BIP-39 word encodes an 11-bit integer index (from 0 to 2047 across 2,048 dictionary words), 264 / 11 = 24 words. The 24th word is formed by combining the final 3 bits of entropy with the 8 checksum bits. For any 23 words, there are only 2³ = 8 possible 3-bit entropy endings, yielding exactly 8 valid candidate 24th words.
Why is it dangerous to enter a funded recovery phrase into an online browser tool?
Typing real 24-word recovery phrases into any web browser risks exposure to browser extensions, clipboard scrapers, operating system crash dump caches, and keystroke listeners. If an attacker intercepts your 24 words, your funds can be swept instantaneously. Live recovery phrases must only be validated on an air-gapped hardware wallet (such as Ledger's native Recovery Check app) or using isolated offline environments.
How can I fix an "Invalid recovery phrase" error on Ledger Stax or Nano X?
An "Invalid recovery phrase" or "Wrong word" error occurs when a typed word is not in the official 2,048-word BIP-39 dictionary or when all words are recognized but the 8-bit checksum fails. Check for common typos (such as mistaking similar words like "cloud" and "clown"), confirm the exact order of written words, and verify your configuration before trying on-device recovery.
What is the difference between a 12-word and 24-word BIP-39 mnemonic checksum?
A 12-word mnemonic uses 128 bits of entropy and a 4-bit SHA-256 checksum (132 total bits / 11 bits per word = 12 words). The 12th word contains 7 bits of entropy and 4 bits of checksum, which leaves 128 possible 12th words for 11 known words. A 24-word mnemonic uses 256 bits of entropy and an 8-bit checksum, which restricts the final word to only 8 valid candidates.