#Tutorial. Recovery phrase is invalid: why your wallet won’t accept your seed phrase

You enter your recovery words, reach the last one, and instead of restoring the wallet, the device shows an error such as “Recovery phrase is invalid.” This does not automatically mean your funds are lost. It means the wallet cannot validate the phrase in the format it expects.

The cause may be simple: a typo, the wrong word order, or an incorrectly selected phrase length. But sometimes the problem is different — the backup is not BIP39 at all, but SLIP39, an Electrum seed, a Monero mnemonic, or another format. Below, we go through the checks in the order that makes the most sense, then cover a separate case: the phrase is accepted, but the restored wallet shows a zero balance.

What does “Recovery phrase is invalid” mean?

How a BIP39 seed phrase works

A BIP39 seed phrase is not a random collection of words. The standard uses a fixed list of 2,048 words. Each word represents a number from 0 to 2,047, so every word encodes exactly 11 bits of data.

When a wallet creates a phrase, it first generates random entropy. It then calculates SHA-256 from that entropy, takes the first bits of the hash as a checksum, and appends them to the entropy. The resulting bit string is split into 11-bit groups, with each group mapped to a word from the BIP39 list.

What the wallet is actually checking

During recovery, the wallet performs the process in reverse. It converts the words back into bits, separates the checksum, recalculates SHA-256 from the entropy, and compares the expected checksum with the bits encoded in the phrase.

If the checksum does not match, the wallet rejects the phrase. At this point it is not checking your balance or looking for your coins on the blockchain. It is only checking whether the sequence you entered is a valid mnemonic for the selected format.

Why the checksum matters

The checksum catches many common mistakes before the wallet opens. If one word was written down incorrectly or two words were swapped, the phrase will usually fail validation.

Recovery phrase is invalid: what to check first

If you see “Recovery phrase is invalid,” do not start guessing words immediately. Rule out the simple causes first — they are quick to check and do not require any third-party tools.

1. Count how many words are actually in your backup.
2. Identify which wallet or device originally created the phrase.
3. Check whether it is really BIP39 or a different backup format.
4. Make sure you selected the correct phrase length on the device.
5. Check every word against the official word list for that standard.
6. If every word is valid, look for similar words and verify the order.
7. Restart the recovery process and confirm every word carefully on the device.

Reason 1. It is not BIP39

The word count is your first clue, but it is not definitive on its own. Different backup systems may use similar-looking English words even though the underlying formats are not compatible.

SLIP39: Trezor’s 20-word backup

SLIP39 is a backup standard developed by SatoshiLabs. It supports both a complete Single-share Backup and Multi-share setups where several shares are created and a defined threshold is required for recovery. On current Trezor Safe 3, Safe 5, and Safe 7 devices, a 20-word Single-share Backup is the standard option when creating a new wallet.

Trezor Model T also supports SLIP39, but its traditional default backup format was a 12-word BIP39 phrase. That is why the device brand alone is not enough to identify the standard — you need to know which backup type was originally created.

SLIP39 uses a different word list from BIP39. If you have a 20-word SLIP39 share, entering it into a standard BIP39 recovery flow will not work. A Multi-share Backup also requires enough shares to meet the recovery threshold. Trezor documents the current backup formats and model compatibility in its official backup guide.

Electrum: its own seed format

Electrum does not generate BIP39 seed phrases. Its current seed format uses its own versioning system: the wallet checks an HMAC-SHA512 value derived from the normalized phrase and identifies the seed type from a specific version prefix.

As a result, a standard BIP39 device may reject a perfectly valid Electrum seed. That does not necessarily mean the words are damaged. The seed needs to be restored in a compatible Electrum environment rather than forced into a BIP39 recovery flow.

Monero: 25 words or a 16-word Polyseed

Monero’s classic mnemonic format uses 25 words: the first 24 encode the seed, while the final word acts as a checksum. The English Monero Legacy word list contains 1,626 words and is not the BIP39 word list.

The newer Polyseed format uses 16 words. It has a different internal structure, its own checksum, and embedded information about the approximate wallet creation time, which helps determine the restore height. Its word lists are based on BIP39 lists, but the format itself is not BIP39-compatible.

Algorand: 25 words from the BIP39 list

Algorand uses a 25-word mnemonic built from the English BIP39 word list, but the encoding scheme is different. The mnemonic represents the private key directly, and the twenty-fifth word serves as a checksum.

That familiar word list makes an Algorand backup easy to mistake for BIP39. Do not cut a 25-word phrase down to 24 words or try to force it into another wallet’s recovery format.

Reason 2. The wrong phrase length is selected

Many hardware wallets ask you to choose the number of words before recovery begins. If you select the wrong length, the recovery process will not match your backup even when every word has been recorded correctly.

BIP39 itself allows 12, 15, 18, 21, and 24 words, but an individual device may support only some of those lengths. BitBox02, for example, supports 12-, 18-, and 24-word BIP39 seed phrases. Other devices may offer different options, so always check the documentation for your exact model.

Count the words on your physical backup as well. A skipped line, a duplicated word, or a mistake made while transferring the phrase to another medium can change the actual word count.

Also consider how the wallet was designed to handle backups. Tangem can be set up without a seed phrase by using backup cards, although current versions also support an optional BIP39 seed. Cypherock X1 uses its own architecture to distribute the secret between the X1 Vault and four X1 Cards, so a paper seed backup is not required in the standard setup.

Reason 3. One of the words is not in the word list

Handwriting and transcription errors

A recovery phrase is often written down once and read again years later. By then, ink may have faded, the paper may be damaged, and your own handwriting may be much less obvious than it looked on the day you wrote it.

Look closely at characters that are easy to confuse: 1 and lowercase l, 0 and O, u and v, rn and m, or a and o. Abbreviated words and unclear final letters create the same problem.

The four-letter rule

The BIP39 word list is designed so that the first four letters uniquely identify each word. Words shorter than four letters are written in full.

This is useful when a paper backup is damaged. If the first four letters are still clearly readable, you can identify the intended word unambiguously from the official list.

How to check a word safely

For BIP39, use the official BIP39 English word list in the Bitcoin Improvement Proposals repository. For SLIP39, use SatoshiLabs documentation and its corresponding word list. Check individual words in the list — never paste the entire recovery phrase into a third-party website.

Reason 4. The word is valid, but it is the wrong word

A trickier case is when a transcription mistake turns one valid BIP39 word into another valid BIP39 word. For example, you may have written box instead of boy. Both words exist in the list, so the wallet’s autocomplete cannot tell you which one was originally intended. The mismatch only becomes apparent when the checksum is checked.

Similar-looking words

• able, cable, table;
• act, art, cat, pact;
• again, gain;
• angle, ankle;
• aware, awake;
• boy, box, fox, joy, toy;
• cannon, canyon;
• bind, bird, blind, find, kind, mind;
• better, bitter, butter, letter.

BIP39 was designed to reduce ambiguity between words, but handwritten backups can still be difficult to read. If every word appears in the official list but the checksum fails, pay special attention to short words and pairs that look or sound similar.

Why device suggestions do not always help

Autocomplete is good at filtering out words that do not exist in the word list. But if you enter the beginning of another valid word and confirm it, the device has no way to know that a different word was written on your original backup.

Reason 5. The word order is wrong

Word order is part of the mnemonic itself. Swap two words and the underlying bit sequence changes, which will usually make the checksum fail.

Order is most often lost when copying a backup to another medium, transferring it to a metal backup, or reading a card with two columns in the wrong direction. Numbering every word helps prevent this.

A special case: Trezor Model One

In Standard Recovery on Trezor Model One, the words are entered on the computer in an order randomly requested by the device. The Trezor screen tells you which word number to enter next. You therefore should not simply work through your backup from top to bottom — follow the number shown on the device.

Model One also supports Advanced Recovery for greater privacy, using a changing input layout so the computer does not learn the actual letters being selected. Trezor Model One and Model T have no longer been sold by Trezor since January 8, 2026, although the company continues to provide software support.

Reason 6. A mistake was made during entry

Even when the backup itself is correct, something can go wrong while entering it. Common examples include:

• The wrong suggestion was confirmed. After entering a few letters, the device displayed several options and you selected the neighboring word.
• A tap was missed or an extra character was entered. On touch or button-based interfaces, verify the selected word after each step.
• The wrong language list is being used. BIP39 has several official language-specific word lists. If the wallet expects a different list, the words will not match.
• The phrase was pasted into a software wallet incorrectly. Different apps may handle spaces, line breaks, and text normalization differently.

BIP39 does not include official Russian or Ukrainian word lists. If you were given a “Russian BIP39 seed” or “Ukrainian BIP39 seed,” it is not a standard BIP39 backup.

If your device allows it, restart the recovery process and enter the phrase slowly, checking every confirmed word against your backup.

The phrase is valid, but the wallet is empty

This is a different problem. If the BIP39 phrase passed its checksum and the wallet completed recovery successfully, an “invalid” recovery phrase is no longer the issue. The next step is to find out why you are seeing a different set of accounts or addresses.

Passphrase, often called the “25th word”

A passphrase is not another word in the seed phrase, even though it is often informally called the “25th word.” In BIP39, it is used separately when the mnemonic is converted into the seed.

Any passphrase produces a mathematically valid seed. That is why an incorrect passphrase does not trigger “Recovery phrase is invalid.” It simply derives a different set of keys and usually opens a different, empty wallet.

If you used a passphrase, check capitalization, keyboard layout, spaces at the beginning or end, and any characters that may have been entered differently on the original device. We cover this scenario in detail in our guide “Trezor passphrase wallet is empty: why it happens and how to find your coins”.

A different derivation path or address type

A single seed can derive many different accounts and addresses. What you see depends on the derivation scheme, network, account number, and address type used by the wallet.

With Bitcoin, this is especially noticeable across older and newer address types: legacy addresses starting with 1, P2SH addresses starting with 3, and SegWit or Taproot addresses beginning with bc1. If you remember one of your old addresses or at least what it looked like, that can help identify the account you need to restore.

You are looking at the wrong network

Across EVM networks, the same key pair can produce the same address on multiple chains, but the balances are separate. Your assets may be on BNB Smart Chain while you are only checking Ethereum, for example. The address looks right, but the app still shows zero.

You restored a different backup

If you have accumulated several backups over the years, you may have restored an old test wallet or a wallet that is now empty. This is why it is useful to label each physical backup with the device or wallet it belongs to, without writing the passphrase on the same backup.

How much does the checksum help if one word is missing?

The checksum does not recover a seed automatically, but it can dramatically reduce the number of mathematically valid candidates. BIP39 makes this easy to see with a few examples.

The last word is unknown

In a 24-word BIP39 phrase, the final word contains only 3 unknown entropy bits; the other 8 bits are checksum bits. If the first 23 words are known, only 8 valid possibilities remain for the final word.

For a 12-word phrase, the final word contains 7 unknown entropy bits and 4 checksum bits, leaving 128 valid possibilities.

One word is wrong, but you do not know which one

If exactly one word in a 24-word phrase is wrong but its position is unknown, there are 24 positions and 2,047 possible replacements for each one. That produces 49,128 raw candidates. With an 8-bit checksum, only about 192 of them will pass validation on average.

For a 12-word phrase, there are 24,564 raw candidates, while the 4-bit checksum leaves about 1,535 valid candidates on average.

If you already know which position is wrong, the search space is much smaller. For a 24-word phrase with one known problematic position, the checksum leaves roughly 8 valid candidates on average.

Two or more errors

With two unknown errors, the number of combinations grows very quickly. The practical difficulty depends on whether you know the positions, parts of the words, previous wallet addresses, or other information that can be used to identify the correct result.

Open-source tools exist for local seed recovery, but using them incorrectly can expose your phrase. If you do not understand how to isolate the environment and verify the software, do not type your recovery phrase into random tools downloaded from the internet.

What you should never do

• Do not enter your seed phrase into an online form. Websites offering to “check” a seed phrase are unnecessary for BIP39 diagnostics and may be phishing pages.
• Do not give the phrase to a “recovery service” or support agent. Anyone with the complete phrase may be able to control the funds.
• Do not import a cold-wallet seed into an ordinary software wallet just to test it. That moves the secret from a protected offline environment onto a general-purpose device.
• Do not photograph the backup or save it in notes. Photos and text may be synced automatically to a cloud account or device backup.
• Do not destroy the old backup until the replacement has been verified. First confirm that the new backup really restores the wallet you expect.

If the backup really cannot be restored

What you should do next depends on whether you still have a working device that can access the original wallet.

The device still works and unlocks

In this situation, you still have access to the funds, but relying on one physical device is risky. The safer option is to create a new wallet with a new backup and move the assets to new addresses.

1. Prepare another compatible wallet or a second hardware wallet.
2. Create a new backup and verify it immediately using the device’s built-in backup check, if available.
3. Move the assets from the old wallet to the new addresses and wait for the transactions to confirm.
4. Check more than the main account — include any other networks, tokens, and accounts you may have used.
5. Only retire the old wallet once everything has been confirmed.

The device is lost, broken, or already reset

If the device is no longer accessible and the backup is invalid, the manufacturer normally does not have a copy of your private key and cannot restore it from your account or device serial number.

The exception is when you deliberately enabled a separate recovery service in advance. Ledger Recover, for example, is an optional subscription where an encrypted representation of the secret is split into three fragments held by Ledger, Coincover, and EscrowTech; two of the three fragments are required for recovery. If the service was not activated before access was lost, it cannot be added retroactively.

If most of the seed phrase is still available, the chances of recovery depend on how many errors there are, what kind of errors they are, and whether you know an old wallet address or another reliable reference that can be used to identify the correct result.

How to avoid the same problem next time

Verify the backup before you need it

The worst time to check a seed phrase for the first time is after the main device has been lost or reset. If your wallet includes an official backup-check feature, use it before you are in an emergency.

Ledger provides the Recovery Check app, which lets you compare the written Secret Recovery Phrase with the phrase protecting the device without changing the wallet itself.

Trezor has a similar feature called Check backup. Trezor recommends checking the backup before resetting the device and before firmware updates.

Write the phrase so you can read it years later

• Use clear block letters and do not abbreviate words.
• Number every word.
• Record the word count and the wallet or device that created the backup.
• If you use a passphrase, keep a separate record that a passphrase exists.
• Do not store the seed and passphrase together in the same obvious location.

Choose a durable backup medium

Paper is simple and requires no electronics, but it is vulnerable to water, fire, fading, and physical damage. For long-term storage, you can use a metal seed backup designed to preserve a recovery phrase physically. We compare the main approaches in our guide “How to Store a Seed Phrase: 5 Safe Methods in 2026”.

For BIP39 backups, options include products such as Trezor Keep Metal and Keystone Tablet Punch. Before transferring a phrase, check which word counts and backup standards the specific product supports.

There are also other backup approaches. Ledger Recovery Key is a PIN-protected NFC card with a Secure Element that can store an encrypted copy of a Secret Recovery Phrase and restore a compatible touchscreen Ledger without manually entering every word. Ledger positions it as an additional backup option rather than a reason to abandon a reliable primary backup.

Do not keep your only copy in one place

A single physical copy creates a single point of failure. A fire, flood, theft, or simple loss can destroy the backup and your recovery path at the same time. For significant holdings, consider keeping backups in separate physical locations.

If you do not want the full secret stored in one place, schemes such as SLIP39 Multi-share Backup let you require a defined number of shares for recovery.

FAQ: Recovery phrase is invalid

Can entering the wrong seed phrase damage my wallet?

A failed recovery attempt or an official backup check is not the same as entering the wrong PIN. On supported Ledger and Trezor devices, checking a recovery phrase should not erase your funds or modify the wallet. If you use another manufacturer, check the documentation for your exact model before making repeated attempts.

Can I restore a 24-word seed on a wallet that normally creates 12 words?

Yes, if that device supports 24-word BIP39 backups during recovery. The phrase length a wallet creates by default and the phrase lengths it accepts for recovery are not necessarily the same.

I lost one word. Can the seed phrase be recovered?

It depends on what you still know. If the first 23 words of a 24-word BIP39 phrase are known, the checksum leaves only 8 possible final words. If the exact position of one incorrect word is known, there are also about 8 checksum-valid candidates on average. If even the position of the error is unknown, the number rises to roughly 192 candidates.

Can I restore a BIP39 phrase from Ledger on Trezor, and vice versa?

Generally, yes, as long as both devices support the same BIP39 phrase length as well as the networks and derivation schemes you need. Wallet-specific formats such as SLIP39 should not be assumed to work on every BIP39 wallet.

The device accepted the phrase but shows zero. Is that the same error?

No. If recovery completed successfully, check the passphrase, derivation path, account number, address type, network, and whether you restored the correct backup.

Quick checklist

1. Count the words and identify which wallet originally created the backup.
2. Check the standard: BIP39, SLIP39, Electrum, Monero, Algorand, or another format.
3. Make sure the correct phrase length is selected on the device.
4. Check every word against the official list for that backup standard.
5. If every word is valid, check similar words and word order.
6. Restart recovery and confirm each word carefully.
7. If you see “Recovery phrase is invalid,” look for a format or entry problem; a zero balance after successful recovery has different causes.
8. Never enter the complete seed phrase into an online service or share it with support.