The checksum consists of a few bits, the basic units of information, calculated from the wallet’s original random data. BIP39 calls the length of that data ENT, appends the first ENT/32 bits of its SHA-256 fingerprint, then divides the result into 11-bit groups that select words. This checks the record; it creates no extra secret. Anyone with the same data can calculate the same checksum.
The words represent both the original random data, called entropy, and a short check of it. BIP39 allows ENT = 128, 160, 192, 224 or 256 bits. It respectively adds 4, 5, 6, 7 or 8 check bits, producing 12, 15, 18, 21 or 24 words. Each 11-bit group selects a word numbered 0‑2047 from a list of 2048 words. During recovery, software can unpack this record and check whether its parts agree. [1]
The last word also contains some of the original secret data. For a 128-bit input, 128 + 4 = 132 = 12 × 11: the last word holds 7 entropy bits and 4 checksum bits. With 24 words, it holds 3 entropy bits and 8 checksum bits. Losing the last word therefore means losing more than the check. The preceding words do not determine a single correct ending; there is no universal check word you can simply insert. [1]
The check is short, so it cannot reject every incorrect combination. Among uniformly random sequences drawn from the correct wordlist, 1/16 passes for 12 words and 1/256 for 24 words. These figures describe all possible sequences of that length. They do not tell you how reliably your particular typo or swapped word will be caught. A green confirmation in the wallet is therefore not proof that you copied the backup exactly. [1]
Consider a backup published in a tutorial. Its checksum can be perfectly correct, yet using it for your own money is unsafe. The checker only converts words to bits using the correct list, separates the original data and compares the check bits with its SHA-256. An attacker can perform the same calculation. The check cannot tell who created the words or who knows them. It neither authenticates their origin nor provides a general way to repair an incorrect backup. [1]
If you use a BIP39 passphrase, an additional password, the word checksum does not check it at all. A separate calculation, PBKDF2-HMAC-SHA512, converts the backup phrase and passphrase into a 512-bit seed, the secret basis for deriving keys. A mistyped passphrase can therefore lead to a different wallet even when the words pass. Keep the exact words, their order and any required passphrase. Do not translate the words into another wordlist either: that would change the seed. [1]
An unfamiliar website might promise a quick backup check, but entering your words is enough to give it access to them. A correct result does not prove the app did not save or steal them. For recovery, follow your wallet’s trusted procedure. Software tests should use public test vectors, known inputs with expected results, instead of your secret backup. Those public examples must never be used as wallets for real funds. [1]
For the clearest picture, read this entry together with BIP 39, Seed Generation, BIP39 passphrase, Cryptographic Entropy. The reverse links also lead from BIP 39, BIP39 passphrase, COLDCARD RNG Incident (2026), SeedQR.