A scrambled seed phrase can sometimes be recovered when enough words and positional clues survive. BIP-39 checksum validation filters candidates, but only deriving and checking the expected wallet establishes that a candidate is useful.
Count the right search space
For n known, distinct words with completely unknown order, there are n! arrangements before checksum filtering. Repeated words reduce the count to n! divided by the factorial of each repetition count. This is different from replacing a missing word from the whole dictionary.
| Known distinct words | Arrangements before checksum filtering | Approximate checksum-valid fraction |
|---|---|---|
| 12 | 479,001,600 | 1/16 |
| 18 | 6,402,373,705,728,000 | 1/64 |
| 24 | 620,448,401,733,239,439,360,000 | 1/256 |
The fractions are statistical expectations, not exact counts for a particular word set. Our earlier version mixed missing-word counts with permutations; this table corrects that model.
Missing final words are a different problem
For BIP-39, a fixed prefix leaves 128 possible checksum-valid final words for a 12-word mnemonic, 32 for 18 words, and 8 for 24 words. The SHA-256 checksum is only an error filter; it does not identify the funded wallet. See the BIP-39 specification.
GPU speed is specific to the operation
An illustrative rate of 500,000 checks per second per GPU across 140 GPUs gives 70,000,000 checks per second. This is arithmetic, not a measured RecoverCoins recovery benchmark. At that hypothetical rate, enumerating 12! arrangements takes about 6.84 seconds; 18! takes about 2.90 years, before accounting for other verification costs. Neither number is a recovery estimate.
Checksum filtering, password verification, and deriving addresses are different workloads. A defensible benchmark must identify the wallet format, key-derivation parameters, hardware, software, and what one “check” measures. Extra passphrases and derivation paths can add work. Do not use a generic GPU hash rate as a wallet recovery rate.
Practical next step
Keep seed backups in their original order. A partial seed needs a case-specific assessment, not a promised completion time. See seed phrase recovery for recoverable cases and limits, or the PlanB 2026 recording featuring Frank Dosk and Nicolas Schteinschraber.
Nicolas Schteinschraber has a background in applied cryptography and wallet security. About the team