A while ago, I purchased Bitcoin and stored the corresponding 24-word private key. However, I am unable to recall the precise order of the words. I intentionally wrote them down in an unconventional manner to prevent potential theft if someone discovered my recovery sheet. Regrettably, I have now forgotten the correct order myself. It's frustrating.

The number of possible permutations is incredibly large! (24! = 620,448,401,733,239,439,360,000). Even if I were able to check one new permutation every second, it would still take millions of years...

So my question is: Have I calculated correctly? Is it practically impossible for me to retrieve my Bitcoin?

  • 1
    If you know like 7 or 8 of the right order from your 24-word mnemonic phrase and know some address that comes from your key and its path, then it is possible to recover your key back.
    – Romo
    Commented Jul 10, 2023 at 1:49
  • @Romo I'm afraid I may not possess enough bitcoin in that account to cover his expenses. Additionally, I'm perplexed as to why I am unable to select 24 random words from the BIP39 wordlist and gain entry to a new wallet on my Ledger/Trezor. It simply notifies me that the recovery sheet was incorrect. Shouldn't it instead grant access to an empty wallet? I assumed that all conceivable combinations from the wordlist would generate a functional wallet, independent of a hardware wallet generating the words for you. Perhaps there is some information there that could aid me in accessing my funds?
    – MyAlfred
    Commented Jul 10, 2023 at 23:46
  • ChatGPT helped me rewrite that comment. Just to make my points more clear
    – MyAlfred
    Commented Jul 10, 2023 at 23:49

2 Answers 2


If you have a 24-word passphrase, without repeated words, and truly do not know the order anymore (as in: every order is equally likely), then it is practically infeasible to recover.

  • And in that case there would be exactly 620,448,401,733,239,439,360,000 or 24! permutations right? Do i understand BIP39 correctly?
    – MyAlfred
    Commented Jul 9, 2023 at 20:46
  • Also is it just as hard to find/generate the public key/address. I don't remember how much Bitcoin there is in there.
    – MyAlfred
    Commented Jul 9, 2023 at 22:01
  • @MyAlfred Yes; perhaps it can be a bit less by taking the fact that BIP39 phrases have a checksum into account, but not much. And yes, if all you have is the phrase, computing the address requires finding the private key first. Commented Jul 9, 2023 at 22:12
  • @peter Alright. That makes sense! thanks
    – MyAlfred
    Commented Jul 9, 2023 at 22:15

There are 24!=620,448,401,733,239,439,360,000 permutations, which is about 79 bits.

BIP39 phrases include 8 bits of checksum, but even computing that involves one SHA-256 hash per permutation. Modern GPUs achieve about 500 megahashes/sec, which would only get you 2^45 checks per day, taking more than 30 million cards*years just to calculate all checksums.

This unfortunately makes it safe to say it's absolutely infeasible to check every permutation.

  • i suppose it would be difficult to hire a professional brute force it since i can't even prove how much bitcoin is in there since i don't know the public key?
    – MyAlfred
    Commented Jul 10, 2023 at 10:42
  • From a rough calculation using bitcoin network hash rate and block rewards, it would cost at least a double-digit number of bitcoins to produce that many hashes, just for the checksum calculations.
    – w123
    Commented Jul 10, 2023 at 10:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.