Lose a word. Not the wallet.
You still have most of your phrase. COLDWORD scans every possibility the missing words could be, checks each against the real BIP39 checksum, and stops the moment it derives an address that matches yours.
These are your own words. You type the ones you still have from a wallet you own; COLDWORD only searches the gaps. The phrase never leaves this tab — every hash is computed on your machine.
Every word comes from a fixed 2,048-word list. One gap is 2,048 possibilities — and the checksum throws out all but about 128 of them before a single address is derived.
The same seed produces your BTC, ETH, SOL, XRP, TRON and every EVM address. Recover the words once and every chain that phrase ever touched comes back with it.
The scan runs in a Web Worker in this tab. Your words are never transmitted, never logged, and never stored — close the tab and nothing of them remains.
Your words in.
The missing ones out.
On the right, fill in what you remember and leave the gaps blank. On the left is the same engine with nothing to go on — so you can see exactly what your remaining words are worth.
Both panels run the same audited primitives production wallets use — @scure/bip39 and @noble/curves. The demo phrase is prefilled so you can watch it work before trusting it with your own.
21 addresses
from 12 words.
A seed phrase isn't a Bitcoin thing — it's a master key. These are the addresses the phrase above derives, on the standard path each chain's wallets use.
Not shown: Cardano, Monero, Algorand and TON. They don't derive from a BIP39 seed the way the chains above do, so COLDWORD doesn't guess at them — an address it can't compute correctly is worse than no address at all.
The bar
cannot move.
This is the same scan with none of your words supplied. You've "checked" 0 phrases by scrolling and the completion figure still rounds to zero. That gap — between this bar and the two seconds it takes with your own words — is the entire product.
Four steps,
all deterministic.
The same words always produce the same keys. That's why a scan can confirm a guess is right — and why the words are worth protecting.
Random bits
Your wallet rolled 128 bits of randomness. Everything below is derived from it — which is why nothing but the words themselves can reproduce your keys.
2,048-word list
Those bits are cut into 11-bit chunks, each naming one word. A checksum is appended, so most random word-sets are simply invalid — which is what makes a gap scan finish quickly.
PBKDF2, 2,048 rounds
The phrase is stretched into a 512-bit seed with PBKDF2-HMAC-SHA512.
This is the slow step — and the reason a blind search never finishes.
BIP32 derivation
The seed feeds a key tree. Path m/44'/0'/0'/0/0 gives your first Bitcoin
address, m/44'/60'/0'/0/0 your Ethereum one, and so on for all 21.
Some phrases need
more than a browser.
The scanner above finishes on its own when one or two words are missing. Past that the search stops fitting in a tab — three or four gaps, a forgotten passphrase, or a wallet that used a derivation path no longer in the defaults. Those run on our hardware, and a human checks the result before you ever see it.
Tell us what you're missing
Got it. Your case is in the queue.
Continue on TelegramTelegram is where we run the case — faster than email, and you can see the scan progress as it goes.
Nothing upfront. Nothing if it stays shut. The assessment is free — we tell you whether the search is finishable before you commit to anything.
- You keep custody the entire time. The recovered phrase goes to you, and you move the funds yourself.
- We never ask for a phrase you still hold in full — if it works today, you don't need us.
- If the gap is too wide to close, we say so on day one. The page above shows you the maths behind that answer.
- Case files are deleted on request, and automatically once a case closes.
Prefer email? and your browser scan results save to your address.