The 25th word isn’t a word — it’s a password.

What the “25th word” actually is

The BIP39 passphrase is an optional, arbitrary string you can add when a wallet is created. People call it the “25th word” (24-word seed), the “13th word” (12-word seed), the “seed extension”, “extra word” or “hidden-wallet phrase” — but it is not a word from the 2048-word BIP39 list. It can be anything: a name, a date, a sentence, a random string, even a second language. Key facts:

• It is not part of the mnemonic. The passphrase is an extra input combined with the seed words at the moment you unlock the wallet, and it cannot be derived from the seed words themselves. Whether a particular wallet app stores or caches it is an implementation detail — never assume it is saved, never assume it is not.
• Same seed + different passphrase = a different wallet. Each passphrase derives a completely different set of addresses. Entering your 24 words without the passphrase opens a wallet that usually looks empty.
• It was designed as a security feature — a “hidden wallet” someone can find your seed and still not reach your funds. That same design is why forgetting it locks the wallet so completely.

Why this is a password problem — not a seed problem

This distinction is the whole page, so it is worth being blunt:

• The seed phrase is your backup. 12–24 fixed words from a standard list. Lose all of them and no tool on earth recreates the wallet — that is a different problem, and this site does not cover reconstructing lost seed words.
• The passphrase is your password. An arbitrary string you chose, the way you choose any other password. And like any password you chose yourself, it follows your habits — which is exactly what makes it recoverable.

If your seed words are safe but the wallet shows the wrong (empty) addresses, you are almost certainly dealing with the passphrase — and you are on the right page.

Do you even have one? The empty-passphrase test

Before any recovery work, rule out the simplest explanation: the passphrase is empty. The default is no passphrase, and many “lost” wallets turn out to have never had one. Test it offline:

• Take your seed words and restore them in a fresh wallet on a device you control — without entering any passphrase.
• Compare the first address shown with the address you remember. Match? There was no passphrase (or it was empty) and your wallet is simply there. No match? That alone does not prove a passphrase was used — first check that the wallet type, derivation path and address/script type match the original wallet. If they do and the first address still differs, a non-empty passphrase is the likely cause, and the section below applies.

Do this on a fresh device or a wallet you have already emptied — restoring a seed can overwrite the local copy you still need. The safe-copy rules apply here too.

How passphrases get lost

Because the passphrase is not part of the mnemonic, forgetting it feels different from a normal lockout. The usual stories:

• Set once at wallet creation years ago, written down nowhere, and silently forgotten.
• Stored in a password manager or notes app that has since been abandoned, wiped, or forgotten.
• Confused with the seed itself — people write “24 words + this other thing” and later cannot recall what the “other thing” was.
• Reused from another account or service, so it is somewhere in your password history.

Search first — it is usually stored somewhere

Most forgotten passphrases are found, not cracked. Work the search before touching any tool:

• Every password manager you have ever used — including old, abandoned and browser-built-in ones. Export and search them all.
• Notes apps, email drafts and attachments, cloud drives, old phones and their backups.
• Paper: the same notebook, drawer or safe where the seed lives is where the passphrase usually was recorded too.
• Browser password autofill — many people let the browser remember the passphrase field.

The complete method is in where old passwords hide, and the tick-by-tick version is the 68-place search checklist.

If you have to recover it: how the math works

With your seed words and at least one known address, every candidate passphrase can be tested: derive the wallet for seed + candidate, and check whether the address matches. That is the entire attack, and it is fast:

• Human-chosen passphrases are the most recoverable secret in crypto. They follow the same habits as any password you pick — names, dates, phrases, substitutions. The memory method rebuilds the candidate list.
• Measured speed: BIP39 passphrase candidates test at roughly 15,000 per second on a modern CPU (about 20,000 on GPU) — published btcrecover measurements. A structured candidate list of a few thousand habits is minutes, not months. See the password strength calculator for your exact numbers.
• Random passphrases are the straight “no”. If a password manager generated a 20-character random passphrase, no amount of GPU time finds it. Your only path there is locating it in the manager, an export, or a backup.

Realistic verdicts

How to never lose the passphrase again

The passphrase defeats the usual backup advice, so it needs its own rule: store the seed and the passphrase separately. Seed on paper in one place, passphrase in a password manager (or a second physical location) — never both together. If one is compromised, the other still protects you. But both are required to restore the same passphrase-protected wallet: a different passphrase — including an empty one — derives a different wallet. If either is lost, you may permanently lose access, so both need reliable independent backups. The full prevention system is in how to never lose access.

Sources & references

1. BIP39 — mnemonic code for generating deterministic keys