A forgotten crypto wallet passphrase is stored nowhere and cannot be derived from your recovery phrase. Every possible passphrase is cryptographically valid, so entering the wrong one builds a different wallet rather than returning an error — which is why a correct seed phrase can open a balance of zero. Recovery works by testing candidate passphrases against a known address from the wallet that holds the funds — either with open-source software like BTCRecover, run offline, or through a wallet recovery specialist — and feasibility depends entirely on how much of the passphrase you can still describe. A remembered pattern with a few unknown characters is usually solvable in hours. A passphrase you recall nothing about is not solvable by any tool or any service, and the sections below set out exactly where that line falls.
Your wallet will never tell you the passphrase is wrong
Every passphrase is valid. That’s the part almost nobody knows, and it explains the symptom that brings most people here.
A passphrase — the optional extra secret you add on top of your recovery phrase — isn’t checked against anything. Your wallet doesn’t store it, compare it, or verify it. It takes whatever you type, mixes it with your seed words, and produces a wallet. Type a different passphrase and you get a different wallet, built from the same seed.
So there’s no error message. There’s no “incorrect passphrase” prompt, no attempt counter, nothing. The BTCRecover documentation states it plainly: the usual symptom of a passphrase error is a set of completely empty accounts, no balance and no history. Almost no consumer guide says this.
That silence is why people conclude their seed phrase is broken and start rewriting it. The seed is usually fine. One character in the passphrase is off.
The hidden wallet is where your funds actually are
Your base wallet is real. It just isn’t the one holding your coins.
That second wallet has a name: a hidden wallet, with its own balance and its own transaction history. Your seed words on their own still open a wallet — the base wallet — and it works normally. It’s simply empty, or holding whatever small amount you left in it.
The name describes the design goal. Anyone who takes your 24 words and restores them sees the base wallet and no evidence that another one exists. That’s the whole point of the feature, and it’s also why the mechanism traps its own owners: nothing on screen indicates that a second wallet is there.
One seed can carry as many hidden wallets as you have passphrases. Some people set up two or three deliberately, one per purpose.
There’s a free check you can run right now. Restore your seed phrase and look at the base wallet’s transaction history. If it shows no outgoing transfer of the missing amount, the funds were never in the base wallet — they went straight to a hidden one, and nobody took them. The coins never moved. That single check separates a passphrase problem from a theft, and it costs nothing.
Brand behavior differs from here. Ledger attaches the passphrase to a second PIN, covered in the Ledger passphrase guide; Trezor exposes it at a separate prompt, worked through in the Trezor passphrase guide.
Stop guessing and write down what you remember
Before you test a single candidate, get everything out of your head and onto paper.
Typing passphrase guesses into the device costs you time and nothing else: each wrong one opens another empty wallet. The real risk sits one prompt away. Start guessing at the PIN instead, and a Ledger wipes itself after three wrong entries — a wipe with an unverified seed backup turns a passphrase problem into a total loss. Write first, test second.
Put down every fragment you can reach: how long it was, roughly. Whether it was one word or several. Whether it had capitals, digits, spaces, or punctuation. What keyboard language you used. Where you would have stored it, and what you were doing the week you set it up. Fragments that feel useless on their own are what turn an impossible search into a small one.
One rule holds through all of it: do not enter your seed phrase or your passphrase into any website. No legitimate tool, service, or “wallet checker” needs them typed into a browser, and the sites that ask are collecting them.
Two things have to exist before recovery can start
A complete seed phrase, and a known address from the hidden wallet. Without the second one, nothing can begin.
The reason is mechanical. Testing a candidate passphrase means deriving a wallet from it and checking whether that wallet is yours. To check, the software needs something to compare against: a master public key (xpub) for the account, or a receiving address the wallet generated, along with a rough idea of how many addresses you created before it. Without one, there’s no way to recognize the right answer even after generating it.
People find these in old exchange withdrawal confirmations, in email receipts, in a block explorer bookmark, or written on the same sheet as the seed. Go looking before you conclude you don’t have one.
What you still remember decides what’s possible
You remember the passphrase but not its exact form
This is the strongest position. You know it was your dog’s name and a year, but not whether the D was capitalized or where the digits sat.
That’s a mask attack: the pattern is fixed and only the unknown positions get tested. A four-digit tail is 10,000 candidates. Add uncertain capitalization across eight letters and you’re at roughly 2.5 million. Both are small enough to finish on ordinary hardware. When cases succeed, this is usually why.
You remember the structure but not the content
Still workable, and the size depends entirely on how much structure you can pin down. A remembered word with an unknown two-digit ending stays in the thousands.
Two remembered words are harder. Standard recovery phrases draw from the BIP39 word list, a fixed set of 2,048 words, so two unknown words is 2,048 times 2,048: roughly 4.2 million. An uncertain separator between them pushes it near 17 million. Both sizes finish.
Every constraint you can state removes orders of magnitude. Each one you invent to feel better wastes the run.
You remember only that it was short
Now it’s pure brute force across every printable character, and the arithmetic gets steep fast. There are 95 printable ASCII characters. Five unknown characters means about 7.7 billion candidates; six means about 735 billion.
The throughput problem compounds it. Turning your phrase into a seed runs PBKDF2-HMAC-SHA512 over it 2,048 times, deliberately slow by design (an unrelated 2,048 — an iteration count, not a word count). And BTCRecover, the standard open-source tool for this work, gets GPU acceleration for seed-word recovery but not for passphrase recovery. Throughput sits far below the “hundreds of thousands per second” figures that apply to other wallet problems. Around five or six characters is the practical ceiling for an unconstrained search.
How the search actually runs, step by step
This is command-line work, and it’s slow. If you’re not comfortable at a terminal, read this to understand what a service will do rather than to do it yourself — a misconfigured run can burn a week and prove nothing.
- Get offline first. Download BTCRecover only from its official documentation at btcrecover.readthedocs.io, then disconnect the machine before your seed phrase touches it. Counterfeit builds of recovery tools exist specifically to harvest seed phrases.
- Assemble the three inputs. Your complete recovery phrase, the reference address or xpub, and the address type your wallet used — legacy, P2SH, or native segwit. That third one gets skipped constantly and it’s fatal: searching for a legacy address when your wallet generated native segwit will never match, even with the correct passphrase in the list.
- Write down what you remember as a pattern. The tool takes a description of the search space: fixed parts you’re sure of, unknown positions, character sets for those positions. This is where the constraints from earlier turn into an actual run size. Narrow beats hopeful.
- Set the address generation limit. The software checks the first handful of addresses each candidate produces. If you used the wallet heavily before the address you’re matching against, raise the limit — otherwise the right passphrase can pass through untested.
- Validate the configuration before the real run. Point the same setup at a wallet whose passphrase you do know, or at your base wallet with an empty passphrase, and confirm it finds the expected address. The most common failure isn’t a passphrase that couldn’t be found — it’s a configuration that was never going to find anything. Ten minutes here saves days.
- Start narrow, widen in stages. Run the tightest version of your pattern first. Add uncertainty one dimension at a time: capitalization, then digits, then length. Each expansion multiplies runtime, so you want the cheap possibilities eliminated before the expensive ones start.
- When it matches, sweep rather than import. Move everything to a wallet you generate fresh, rather than continuing to use keys that have now existed in plaintext on a working machine.
If a well-configured run across your honest constraints comes back empty, the constraints were wrong, not the method. Go back to step 3 and question what you were certain about. Capitalization and stray whitespace are the two constraints worth loosening first, because either one changes the derived wallet completely while feeling like nothing at the moment you typed it.
When there is no recovery path
No length, no structure, no characters, no context. Nothing to anchor a search on.
An unconstrained passphrase has no upper bound on length or content, which means the search space isn’t large — it’s undefined. No tool narrows an undefined space, and no service does either. The same applies when the seed phrase itself is gone: a passphrase is useless without the words it attaches to, and a completely lost seed phrase with no other wallet material cannot be recovered by anyone.
We’d rather say that upfront than take a case that has no route through it.
Anyone who tells you otherwise, particularly anyone asking for payment before assessing what you have, is describing something that can’t be done. Legitimate services don’t charge upfront and don’t promise results.
Passphrase, password, and PIN are three different locks
Most people arrive using the wrong one of these words, and the difference decides everything about your odds.
A PIN unlocks the physical device. Forget it, reset the device, restore from your recovery phrase, choose a new PIN. Your accounts come back because they were never on the device.
A password unlocks a wallet app or an encrypted wallet file on your computer. You replace an app password by restoring from your seed phrase; encrypted files like wallet.dat are a different reconstruction problem, worked through in the Bitcoin Core password guide.
A passphrase doesn’t unlock anything. It derives a different wallet. No reset recovers it, and your seed phrase can’t produce it, because nothing stored it in the first place.
Two neighboring problems have their own guides: a phrase rejected outright rather than opening an empty wallet is covered in invalid mnemonic phrases, and if you’re not certain a passphrase was ever set on your Trezor, that question is worked through here.
Storing it so this doesn’t happen twice
Once you’re back in, move the funds to a fresh wallet and back up the new setup properly. Paper fails in ordinary ways: it fades, tears, and burns. Metal survives all three.
Store the passphrase on metal, in a different physical location from your seed words. Keeping both in one place removes the entire point of having a passphrase, and keeping the passphrase only in your head is what brought you here. Before you move anything of value into a passphrase-protected wallet, restore it from scratch on a wiped device and confirm the balance appears. A backup you haven’t tested is an assumption.
If your situation involves a partial passphrase, a remembered pattern, or a seed phrase that opens the wrong wallet, Crypto Recovers offers a free assessment: describe what you still have and you get an honest evaluation of whether the search is small enough to be worth running, before any commitment. We’ve been performing recoveries since 2019, with 200+ wallets recovered, and we work No Cure No Pay. We never handle your funds at any point, and nothing of yours passes through us; if a recovery succeeds, you move everything to a new wallet you created yourself and transfer the agreed percentage to us yourself.
We don’t take stolen-crypto or scam cases. Blockchain transactions are irreversible, and our work is technical reconstruction of access for people who still own what they can’t reach.
