The last word is not yours to choose.

Because it is not free text. The final word carries a checksum over everything before it, so only a small set of words produce a phrase a wallet will accept. Pick any other and the wallet rejects the whole phrase as invalid — which is what this page is for: it works out which words qualify.

Far fewer than the 2048 words in the list, and fewer the longer your phrase. The final word carries the last few entropy bits plus the entire checksum, so the longer the phrase, the more checksum that one word has to hold.

Every phrase sets aside a fixed number of bits for its checksum, and the last word is where they live. A 12-word phrase sets aside 4 of them, leaving 7 bits free — that is 2⁷ = 128 endings. A 24-word phrase sets aside 8, leaving only 3 free, so just 2³ = 8 words can finish it. Each extra checksum bit halves your options.

This page only works out the final word. If a word is missing from somewhere in the middle, the checksum still narrows it down — for a 12-word phrase, to roughly 128 of the 2048 possibilities — but that is a different search, and this page does not do it.

No. The checksum is derived from your words, not the other way round, and it is not part of the secret — it exists so a wallet can catch a typo instead of silently opening an empty account. Someone holding only your last word learns nothing useful about the rest.

From crypto.getRandomValues, the browser’s cryptographic generator. There is no Math.random anywhere in this file. The word list holds 2048 = 2¹¹ entries, so eleven raw bits pick a word outright: the code masks off those bits rather than folding a bigger number down with a remainder, which means every word is exactly equally likely — no bias to correct and no retry loop that could introduce one.

Not entropy — nothing can measure the entropy of a phrase. Entropy is a property of how words were chosen, not of the words themselves, so a genuine random draw can look terrible and a hand-picked one can look fine. What it does instead is look for the fingerprints of hand-picking — repetition, wordlist order, words bunched into one stretch of the list — and report the search space an attacker would face having spotted them. Treat it as an upper bound, never as proof your words are random.

Because “the same word 23 times” is only 2048 possible phrases, one per word in the list, and log₂(2048) = 11. Repeating a word more times adds nothing at all — every word after the first is already determined. A 23-word repeat is exactly as weak as an 11-word repeat, which is the clearest demonstration there is that length is not entropy.

The randomness is of the same quality: both draw from a cryptographic generator, and 24 random words is 256 bits either way. What differs is the machine. A hardware wallet builds the phrase on a device that does one job and never hands it to an operating system running everything else you have installed. A browser on an ordinary computer cannot make that promise, which is why the guidance above is worth following.

No. The page makes no network requests of any kind, and a Content-Security-Policy blocks them outright — no fonts, scripts, styles or images load from anywhere. Nothing is stored or logged. That covers this page only, though: a browser extension can read what you type here, and no web page can stop it.

Press Verify this page. It hashes its own built-in word list and compares the result against the official BIP-39 list, and works out the endings for nine examples whose correct answers are published in the standard. Change a single word in the embedded list and the check fails, showing a different hash.