Why the seed is twenty five words
The private spend key is a number. Unlike the amounts on this chain, it is a number you never see written out as digits. The mnemonic scheme converts it into words drawn from a fixed list, and twenty four of them carry the whole of it.
The twenty fifth is different. It is computed from the other twenty four and carries no key material at all. It is a checksum. On restore the software recalculates it from what you typed and compares, so a word misread, mistyped or swapped with its neighbour makes the restore fail rather than quietly opening the wrong wallet.
Other wallets solved the same problem another way. Seeds built on the BIP39 scheme come in twelve or twenty four words with the checksum folded into the final word instead of getting one of its own. A twelve word seed is not weaker for being shorter. It is a different scheme carrying more bits per word.
| Scheme | Words | Where the checksum lives |
|---|---|---|
| Monero mnemonic | 25 | A separate twenty fifth word |
| BIP39 | 12 or 24 | Folded into the final word |
What the twenty fifth word does for you
It catches a transcription mistake while you can still fix it. Handwriting fails in predictable ways. Letters get read as other letters, two words trade places, a line is skipped when copying. All of that surfaces as a failed restore rather than as an empty wallet years later.
Test the seed rather than trusting it. Restore into a fresh wallet from the written copy and watch it come back. The check costs a few minutes once and is the only proof that the paper in the drawer is worth anything. Do it before there is money involved, because nothing about a lost key is recoverable and there is no office to appeal to.
It also gives a small amount of tamper evidence. Somebody altering one word of a written seed produces a copy that fails the check. That is not security, but a loud failure beats a silent one.
What people expect twenty five words to do
The largest wrong belief is that a partial seed can be rebuilt. It cannot. Lose three words and you have removed enough of the number that searching for the rest is not a task anybody finishes. There is no support line, no recovery process and nobody holding a copy. The words are the wallet.
The second is treating the checksum as protection for the key. It protects your transcription and nothing else. Anybody who reads all twenty five words has the balance, and the twenty fifth word does nothing to slow them down.
The third is the photograph. People take a picture of the seed with the same device that holds the wallet, and the picture then goes wherever pictures go on that device, which is usually a synchronised folder on a machine belonging to somebody else. Paper in a drawer has a small and understandable set of ways to leak. A photo library has a very large one.
What changes the word count
The wallet software, which is the only thing deciding which scheme you get. Move to a different wallet and you may be handed twelve words, or twenty four, or a key file instead of words. None of that changes the key underneath. It changes how the key is written down for you.
The word list can also change without the count changing, since the scheme has lists in several languages. A seed written in one language will not restore under another, so keep a note of which list you used if it was not the default. And a seed is not an address, whatever the two look like on paper. The ninety five character page covers the string people confuse it with.
Questions people ask
Can I recover a wallet from twenty four of the twenty five words?
No. The twenty fifth is a checksum and adds nothing to the key, and a gap anywhere in the other twenty four cannot be searched for.
Is a twelve word seed less secure?
Not by word count alone. It is a different scheme carrying more information per word, so compare the schemes rather than the lengths.
Should I keep the seed encrypted on a computer?
That trades one risk for another and adds a password you can also lose. Most people are better served by paper kept physically, away from the device holding the wallet.