What Happens If You Forget Your BIP-39 Passphrase (the "25th Word")?

A missing word from your 12 or 24-word recovery phrase is a math problem with a small, checkable answer set. A forgotten passphrase — sometimes called the "25th word" — is not. It's a different feature built on different mechanics, and if you've lost it, the recovery path looks nothing like recovering a seed word.

The passphrase isn't part of the wordlist at all

BIP-39 actually defines two separate things that people often conflate: the mnemonic (your 12-24 word phrase, drawn from the standard 2,048-word list) and an optional passphrase, which can be any string you want — a sentence, a random password, a single character, anything, including nothing.

The mnemonic converts to raw entropy, and that entropy has a checksum baked into its last few bits, which is exactly why a missing seed word is recoverable: you can filter 2,048 candidates down to a small checksum-valid set. The passphrase has no such structure. It's not drawn from a wordlist, it's not checksummed, and the wallet software never validates it against anything. You can type the wrong passphrase and your wallet will not tell you — it will simply open a different, empty-looking wallet and act like that's the correct one.

How the passphrase actually gets used

Per the BIP-39 spec, your mnemonic phrase and your passphrase are combined and run through PBKDF2 with HMAC-SHA512, using 2,048 rounds, to produce a 512-bit seed. That seed is what actually feeds into BIP-32 to derive your keys and addresses. The mnemonic words are the same regardless of passphrase — the passphrase is mixed in at the seed-derivation step, not the mnemonic step.

This has one important consequence: every distinct passphrase produces a completely different, fully valid wallet from the same 12-24 words. No passphrase, an empty string passphrase, "myhorse", "MyHorse", and "myhorse " (with a trailing space) are five different passphrases producing five entirely unrelated sets of addresses. There's no partial credit and no "close enough." PBKDF2-HMAC-SHA512 is designed so that a one-character change in the input produces an output with no resemblance to the original — that's the point of a cryptographic hash function, not a flaw in your memory.

This is also why some hardware wallets (Trezor and others) market the passphrase as a "hidden wallet" or plausible-deniability feature: you can hand over your seed phrase under duress and reveal only the no-passphrase wallet, while your real funds sit behind a passphrase that produces an entirely separate wallet from the same words.

Why you can't brute-force it the way you can a missing word

With a missing seed word, you're searching a space narrowed by a checksum to roughly 128 or 8 candidates depending on phrase length — trivial for a computer. With a forgotten passphrase, there is no checksum to narrow anything. If your passphrase was a genuinely random string of any real length, the search space is effectively the same as brute-forcing a strong password — computationally infeasible with current hardware, full stop. No recovery service, ours included, can shortcut that math. Anyone who claims they can "crack" a strong passphrase is either wrong or lying to you.

Where recovery is actually realistic is narrower and more personal: if you chose a passphrase you can partially remember, or one built from a pattern you use elsewhere (a phrase, a modified password, something tied to a memorable date or line), the practical approach is targeted guessing based on what you actually might have typed — not computation, memory work.

What a realistic recovery attempt looks like

1. List every variation you might plausibly have used. Capitalization, spacing, punctuation, whether you added a trailing space out of habit, whether it was a phrase versus a single word. Each variation is a distinct candidate to test, not a detail to round off.
2. Get a known-correct address to check against, from a past transaction, an exchange withdrawal record, or anything your wallet previously displayed. Without this, there's no way to confirm a candidate is right even if you find it.
3. Derive addresses from each candidate mnemonic-plus-passphrase combination and compare against that known address. This is mechanical, and it's the same principle behind checking candidates for a missing seed word — you're just generating candidates from memory and pattern-guessing instead of from a checksum filter.
4. Check standard derivation paths, since the same correct mnemonic and passphrase can still show different addresses depending on whether the wallet uses legacy, SegWit, or Taproot paths.
5. Treat character encoding as a real variable. The BIP-39 spec requires the passphrase to be normalized using NFKD Unicode normalization before hashing. If you typed the passphrase on a phone keyboard with autocorrect, or it contained an accented character, the byte-for-byte string your wallet actually used may not be the one you remember typing.

If none of your plausible variations produce the known address, it's worth reconsidering whether there was a passphrase at all — some people set one, forget they did, and spend a long time guessing variations of a passphrase that was never actually enabled. Testing the empty-string case first costs nothing and rules that out immediately.

What this means going forward

If you're setting up a passphrase now rather than recovering an old one: write it down, physically, separately from your seed phrase, in a place as secure as the phrase itself. The entire value of a passphrase — plausible deniability, an extra layer if the physical seed phrase is ever found — depends on it being unguessable by an attacker, which is the exact same property that makes it unrecoverable by you if you forget it. There's no backdoor for legitimate owners that doesn't also exist for thieves. Storing it as carefully as you'd store the seed phrase itself isn't optional caution, it's the only way the two facts — secure and recoverable — coexist.

Be wary of anyone offering to "recover" a forgotten passphrase for a fee without asking you a single question about what you might remember. A real attempt starts with your memory, not with someone else's tool.

— WalletRecover Team