Log In Get Started
Free tool

Seed phrase: generator and checker

A BIP-39 seed phrase is 12 or 24 words from a 2,048-word list, encoding a random key and a checksum. The last word is not free: it verifies all the ones before it, so a phrase with a typo fails the check.

Generate a new phrase, or paste your own and we will verify the checksum.

Important — read this before you press anything A phrase created on a web page must not hold real money. This page sends nothing anywhere, but browser extensions, clipboard sync and other people’s eyes work right next to it. For a real wallet use a hardware wallet, or generate the phrase on a device with no network. This page is for learning, test networks and checking a phrase you already have.

How it works

1. RandomnessThe browser takes 128–256 bits from the system source of random numbers — the same one used for encryption keys. An ordinary random-number generator will not do here: it is predictable.
2. ChecksumSHA-256 is taken of those bits, and the first few bits of the result are appended: one bit for every 32 bits of randomness. For 12 words that is 4 bits, for 24 it is eight.
3. WordsThe resulting chain is cut into 11-bit pieces. Each piece is a number from 0 to 2047 — the index of a word in the standard list. That is where both the size of the list and the multiple-of-three word count come from.
4. VerificationThe reverse: words turn into indices, indices into bits, SHA-256 is recomputed from the start and compared with the tail. No match means a typo somewhere, or a word out of order.

FAQ

guest@404vpn:~$ cat seed-faq.md
[01] $ Why can’t the last word be chosen freely? ▸
> Because it carries the checksum. The words encode random bits, and a few bits of the SHA-256 of that same randomness are appended at the end. Change any word and the sum stops matching — that is how a wallet knows you mistyped.
[02] $ 12 or 24 words — does it matter? ▸
> Twelve words is 128 bits of randomness, twenty-four is 256. Neither can be brute-forced: 128 bits is already out of reach of any hardware. Twenty-four is chosen where a margin for the future or a compliance rule demands it, but in practice the danger is not the length of the phrase — it is where the phrase is written down.
[03] $ Does the phrase reach your server? ▸
> No. Generating and checking happen entirely in the browser: neither the words nor the random bits leave the page. Its only request is the anonymous visit counter we run on every page, which carries the page address and nothing else. Switch the internet off and the tool keeps working — and for a real wallet that is exactly what you should do.
[04] $ What is the 25th word, or passphrase? ▸
> An extra password added to the phrase, which yields a completely different set of wallets. It is stored nowhere and cannot be recovered: forget it and you lose access even knowing all 24 words. We do not touch it here; that is a separate story.
[05] $ Does the tool show wallet addresses? ▸
> No, deliberately. Deriving addresses takes another layer of computation and creates a temptation to check a real phrase on a web page. Here there is only the phrase itself and its checksum.