<p>There are 24!=620,448,401,733,239,439,360,000 permutations, which is about 79 bits.</p>
<p>BIP39 phrases include 8 bits of checksum, but even computing that involves one SHA-256 hash per permutation. Modern GPUs achieve about 500 megahashes/sec, which would only get you 2^45 checks per day, taking more than 30 million cards*years just to calculate all checksums.</p>
<p>This unfortunately makes it safe to say it's absolutely infeasible to check every permutation.</p>

CC BY-SA 4.0
2023-07-10T10:42:19.137Z
i suppose it would be difficult to hire a professional brute force it since i can't even prove how much bitcoin is in there since i don't know the public key?
MyAlfred
CC BY-SA 4.0
2023-07-10T10:58:12.070Z
From a rough calculation using bitcoin network hash rate and block rewards, it would cost at least a double-digit number of bitcoins to produce that many hashes, just for the checksum calculations.
w123
CC BY-SA 4.0
2023-07-10T10:29:59.803Z
2023-07-10T10:29:59.803Z
w123
<p>If you have a 24-word passphrase, without repeated words, and truly do not know the order anymore (as in: every order is equally likely), then it is practically infeasible to recover.</p>

CC BY-SA 4.0
2023-07-09T20:46:58.157Z
And in that case there would be exactly 620,448,401,733,239,439,360,000 or 24! permutations right? Do i understand BIP39 correctly?
MyAlfred
CC BY-SA 4.0
2023-07-09T22:01:27.020Z
Also is it just as hard to find/generate the public key/address. I don't remember how much Bitcoin there is in there.
MyAlfred
CC BY-SA 4.0
2023-07-09T22:12:59.597Z
@MyAlfred Yes; perhaps it can be a bit less by taking the fact that BIP39 phrases have a checksum into account, but not much. And yes, if all you have is the phrase, computing the address requires finding the private key first.
Pieter Wuille
CC BY-SA 4.0
2023-07-09T22:15:11.320Z
@peter Alright. That makes sense! thanks
MyAlfred
CC BY-SA 4.0
2023-07-09T20:26:45.677Z
2023-07-09T20:26:45.677Z
Pieter Wuille
<p>A while ago, I purchased Bitcoin and stored the corresponding 24-word private key. However, I am unable to recall the precise order of the words. I intentionally wrote them down in an unconventional manner to prevent potential theft if someone discovered my recovery sheet. Regrettably, I have now forgotten the correct order myself. It's frustrating.</p>
<p>The number of possible permutations is incredibly large! (24! = 620,448,401,733,239,439,360,000). Even if I were able to check one new permutation every second, it would still take millions of years...</p>
<p>So my question is: Have I calculated correctly? Is it practically impossible for me to retrieve my Bitcoin?</p>

CC BY-SA 4.0
2023-07-10T01:49:11.910Z
If you know like 7 or 8 of the right order from your 24-word mnemonic phrase and know some address that comes from your key and its path, then it is possible to recover your key back.
Romo
CC BY-SA 4.0
2023-07-10T23:46:40.287Z
@Romo I'm afraid I may not possess enough bitcoin in that account to cover his expenses. Additionally, I'm perplexed as to why I am unable to select 24 random words from the BIP39 wordlist and gain entry to a new wallet on my Ledger/Trezor. It simply notifies me that the recovery sheet was incorrect. Shouldn't it instead grant access to an empty wallet? I assumed that all conceivable combinations from the wordlist would generate a functional wallet, independent of a hardware wallet generating the words for you. Perhaps there is some information there that could aid me in accessing my funds?
MyAlfred
CC BY-SA 4.0
2023-07-10T23:49:07.930Z
ChatGPT helped me rewrite that comment. Just to make my points more clear
MyAlfred
<mnemonic-seed><lost-wallet>
Dont remember the right sequence of words in my private key
MyAlfred
# Dont remember the right sequence of words in my private key

(Asked by: username_0 on 2023-07-09)

A while ago, I purchased Bitcoin and stored the corresponding 24-word private key. However, I am unable to recall the precise order of the words. I intentionally wrote them down in an unconventional manner to prevent potential theft if someone discovered my recovery sheet. Regrettably, I have now forgotten the correct order myself. It's frustrating.

The number of possible permutations is incredibly large! (24! = 620,448,401,733,239,439,360,000). Even if I were able to check one new permutation every second, it would still take millions of years...

So my question is: Have I calculated correctly? Is it practically impossible for me to retrieve my Bitcoin?

**Tags:** mnemonic-seed, lost-wallet

> **Comments:**
> **username_1**: If you know like 7 or 8 of the right order from your 24-word mnemonic phrase and know some address that comes from your key and its path, then it is possible to recover your key back.  
> **username_0**: @username_1 I'm afraid I may not possess enough bitcoin in that account to cover his expenses. Additionally, I'm perplexed as to why I am unable to select 24 random words from the BIP39 wordlist and gain entry to a new wallet on my Ledger/Trezor. It simply notifies me that the recovery sheet was incorrect. Shouldn't it instead grant access to an empty wallet? I assumed that all conceivable combinations from the wordlist would generate a functional wallet, independent of a hardware wallet generating the words for you. Perhaps there is some information there that could aid me in accessing my funds?  
> **username_0**: ChatGPT helped me rewrite that comment. Just to make my points more clear  

---

## 2 answers

### Answer by username_3 on 2023-07-09. Score: 3 | Accepted answer

If you have a 24-word passphrase, without repeated words, and truly do not know the order anymore (as in: every order is equally likely), then it is practically infeasible to recover.

> **Comments:**
> **username_0**: And in that case there would be exactly 620,448,401,733,239,439,360,000 or 24! permutations right? Do i understand BIP39 correctly?  
> **username_0**: Also is it just as hard to find/generate the public key/address. I don't remember how much Bitcoin there is in there.  
> **username_3**: @username_0 Yes; perhaps it can be a bit less by taking the fact that BIP39 phrases have a checksum into account, but not much. And yes, if all you have is the phrase, computing the address requires finding the private key first.  
> **username_0**: @peter Alright. That makes sense! thanks  

---

### Answer by username_2 on 2023-07-10. Score: 0

There are 24!=620,448,401,733,239,439,360,000 permutations, which is about 79 bits.

BIP39 phrases include 8 bits of checksum, but even computing that involves one SHA-256 hash per permutation. Modern GPUs achieve about 500 megahashes/sec, which would only get you 2^45 checks per day, taking more than 30 million cards\*years just to calculate all checksums.

This unfortunately makes it safe to say it's absolutely infeasible to check every permutation.

> **Comments:**
> **username_0**: i suppose it would be difficult to hire a professional brute force it since i can't even prove how much bitcoin is in there since i don't know the public key?  
> **username_2**: From a rough calculation using bitcoin network hash rate and block rewards, it would cost at least a double-digit number of bitcoins to produce that many hashes, just for the checksum calculations.  

---

