The last word is not yours to choose.

Because the last word is not a free choice. It carries a short summary — a checksum — of every word before it, so only a small set of words produce a phrase a wallet will accept. Pick any other and the wallet rejects the whole phrase as invalid. Working out which words qualify is what this page is for.

Far fewer than the 2048 words in the list, and fewer the longer your phrase. The last word has to carry the final scraps of your phrase’s randomness and the whole checksum, so the longer the phrase, the more of that one word is already spoken for. The table counts the checksum in bits, where one bit is a single yes-or-no answer.

Because a longer phrase spends more of its last word on the checksum, leaving less room for choice. Picking one word out of 2048 takes 11 yes-or-no answers — a bit is one such answer. In a 12-word phrase the checksum claims 4 of the last word’s 11, leaving 7 free, and 7 yes-or-no answers cover 128 endings. In a 24-word phrase the checksum claims 8 and leaves only 3, so just 8 words can finish it. Every extra answer the checksum takes halves what is left to you.

This page only works out the final word. If a word is missing from somewhere in the middle, the checksum still narrows it down — for a 12-word phrase, to roughly 128 of the 2048 possibilities — but that is a different search, and this page does not do it.

No. The checksum is derived from your words, not the other way round, and it is not part of the secret — it exists so a wallet can catch a typo instead of silently opening an empty account. Someone holding only your last word learns nothing useful about the rest.

From the random number generator your browser provides for security work, crypto.getRandomValues. The everyday one, Math.random, is predictable enough that it should never choose a seed phrase, and it appears nowhere in this file. The word list holds exactly 2048 words, a round number in binary, so each draw lands on a word directly instead of being squeezed down to fit. That matters: squeezing is what makes some words come up slightly more often than others. Here every word is exactly as likely as every other.

Both generate buttons use it — Generate complete seed draws every word including the ending in one press, and Generate partial seed stops one word short so you can see the checksum at work and choose the ending yourself. Either way ends at the same place: a phrase whose every word came from the generator.

Not entropy — nothing can. Entropy is about how your words were chosen, not about the words themselves, so a genuinely random set can look terrible and a hand-picked one can look fine. What it actually does is hunt for the fingerprints of hand-picking: the same word repeated, words sitting in wordlist order, words bunched into one short stretch of the list. Then it works out how many phrases someone would still have to try if they noticed the same pattern. Treat that as the best case, never as proof your words are random.

Because “the same word 23 times” is only 2048 different phrases — one for each word in the list — and singling out one in 2048 takes 11 yes-or-no answers. Repeating the word more times adds nothing at all: every word after the first is already decided. A 23-word repeat is exactly as weak as an 11-word repeat, which is the clearest demonstration there is that a long phrase is not automatically a strong one.

The randomness is the same quality: both draw from a proper cryptographic generator, and 24 random words is 24 random words either way. What differs is the machine. A hardware wallet builds the phrase on a device that does one job and never hands it to a computer running everything else you have installed. A browser on an ordinary computer cannot make that promise, which is why the steps above are worth following.

Not while you are online, and not in a browser you use for anything else. That answer does not change with how much the wallet holds. A phrase copied today opens the wallet you fund next year just as easily, so “there is nothing in it yet” buys you nothing.

What this page promises is narrow, and you can check it rather than believe it: nothing you type ever leaves it, nothing is saved or logged, and your browser is told to refuse if anything here ever tried to send it. Press Verify this page.

What no web page can promise is the computer it runs on. A browser extension can read every word you type here, and nothing this page does will stop it. Your clipboard can be read by anything running on the machine. Until you close the tab, the phrase is still sitting in the browser’s memory. A computer that is already compromised will not be rescued by a web page.

So if the phrase is real, do it the other way round: save this page, disconnect from the network, open it in a browser profile with no extensions, and work through the six steps at the top. And if you only want to see how this works, you do not need a real phrase at all — press Load example, or either generate button.

No. The page never sends anything anywhere, and it tells your browser to block the attempt if it ever tried — nothing at all is fetched from the internet, not a typeface, not an image, not a line of code. Nothing is saved or logged either. That covers this page only, though: a browser extension can read what you type here, and no web page can stop it.

Press Verify this page. It takes a fingerprint of its own built-in word list and checks that against the official BIP-39 one, then works out the endings for nine example phrases whose correct answers are published in the standard. Change a single word in the built-in list and the fingerprint comes out different and the check fails.