A Ledger 24 word seed encodes 256 bits of entropy under the BIP39 standard, which is already beyond guessing. A 12 word phrase carries 128 bits and is also beyond guessing. Word count is not the thing protecting you. The losses that actually happen begin when someone reads, photographs or types those words.
Listen to this article, about 13 minutes. A synthetic voice reads the article and announces each section title as it begins; tables are read row by row and the questions at the end are left out.
Recorded 10 October 2026 from the article as published that day. Press a chapter to jump there; the highlighted line is what is playing. A play button sits beside every section heading, and once you scroll past this player a bar at the bottom of the screen keeps the controls in reach. Tap or click any sentence to hear the reading start from there.
On this page: a comparison table of entropy bits, a summary of Ledger Recover specifications, and a checklist for securing your recovery phrase.
Think you already know this? Five questions, one minute.
Every answer is on this page. Answer from what you know now; the page fills in the rest.
-
1. How many bits of entropy does a standard Ledger 24-word seed phrase encode?
A standard 24-word phrase encodes 256 bits of entropy, as detailed in the BIP-39 standard. Read the section
-
2. Why is a 12-word recovery phrase considered practically secure against guessing attacks?
Exhausting a 128-bit space (12 words) at a rate of ten to the power of 22 guesses per second would still take roughly 500 million years on average. Read the section
-
3. Under what condition can the Ledger Recover service export encrypted fragments of your seed phrase?
According to Ledger’s own description of Ledger Recover, the service is optional and must be activated with explicit consent on the device itself using your PIN. Read the section
-
4. What did a user on Reddit report about an application that looked like Ledger Live?
A Reddit user described an application that looked like Ledger Live asking for the 24 words, which was quickly identified as a scam. Read the section
-
5. How did scammers obtain the physical mailing addresses of Ledger customers?
Customer names and mailing addresses were exposed during historical data breaches, as detailed in Ledger’s own account of the July 2020 e-commerce and marketing data breach. Read the section
Search this topic and the first page is Ledger, Ledger, Ledger, a metal backup plate for sale and a paid recovery service. Everybody explaining the 24 words either made them or would like to sell you something for the panic. Here is the neutral version, checked on 10 September 2026 against the specification and Ledger’s own documentation.
What does the Ledger 24 word seed actually encode?
The words are not a password. They are a human readable spelling of one very large random number, and every private key your device will ever produce is derived from it. That is set out in BIP-39, the Bitcoin Improvement Proposal that defines the format, which Ledger follows and so does almost everyone else.
BIP-39 uses a fixed list of 2,048 words. Two to the power of eleven is 2,048, so each word carries exactly 11 bits. The specification also appends a checksum of ENT divided by 32 bits, which is why the word counts land where they do and why a mistyped word usually fails rather than quietly opening an empty wallet.
| Entropy bits | Checksum bits | Total bits | Words |
|---|---|---|---|
| 128 | 4 | 132 | 12 |
| 160 | 5 | 165 | 15 |
| 192 | 6 | 198 | 18 |
| 224 | 7 | 231 | 21 |
| 256 | 8 | 264 | 24 |
Every row above is taken from the table in the BIP-39 specification itself. Twenty four words is simply the top row: 256 bits of entropy, 8 bits of checksum, 264 bits total, divided by 11 bits a word. Ledger’s own BIP-39 explainer, updated on 14 April 2026, puts it the same way, that 128 bits of entropy gives 12 words and 256 bits gives 24.
Ledger’s setup flow generates 24 and offers no 12 word option. The devices will happily restore a 12, 18 or 24 word phrase you bring from elsewhere, which is worth knowing if you are moving a wallet across. If the vocabulary here is new, the wider guide to what a recovery phrase is and how people lose it covers the ground this article assumes.
Is a 12 word phrase actually weaker than 24?
Mathematically yes, by a factor of two to the power of 128. Practically the difference does not exist, and it is worth showing the arithmetic rather than asserting it, because this is the claim affiliate pages lean on hardest.
Start with 12 words. That is 128 bits, so the number of possible phrases is two to the power of 128, which is about 3.4 followed by 38 zeros. Now hand an attacker absurd equipment: a machine testing one trillion phrases every second, and ten billion of those machines running together. That is ten to the power of 22 guesses a second, which is far past anything that exists.
Divide 3.4 times ten to the 38 by ten to the 22 and you get 3.4 times ten to the 16 seconds. A year is about 31.6 million seconds, so that is roughly one billion years to exhaust the space, or around 500 million years to expect a hit on average. And that ignores the cost per guess: BIP-39 runs the phrase through PBKDF2 with HMAC-SHA512 for 2,048 iterations, so every single attempt costs 2,048 hash rounds rather than one.
Twenty four words multiplies that billion years by another two to the power of 128. There is no unit for the result and no point inventing one. Both numbers mean the same thing in practice: nobody is guessing your phrase, whichever length you hold. The extra twelve words buy headroom against a future nobody can describe, not protection against any attack seen today.
The risk that does exist sits outside the mathematics: a photograph in a cloud backup, a support chat, a website that looks right. That is the same reason a cold wallet helps at all, keeping the secret off any machine that talks to the internet.
Can Ledger read your 24 words?
This is the question underneath most searches, so here it is plainly, verified on 10 September 2026 against Ledger’s own description of Ledger Recover, updated 9 April 2026, rather than against forum summaries of it.
| What people ask | What Ledger’s documentation says | Source and date |
|---|---|---|
| Is Ledger Recover automatic? | No. It is optional and must be activated with explicit consent on the device itself, using the PIN | Ledger Academy, 9 April 2026 |
| What actually leaves the device? | The entropy is duplicated, encrypted and split into three fragments inside the Secure Element, then sent over three separate channels | Ledger Academy, 9 April 2026 |
| Who holds the fragments? | Coincover, Ledger and EscrowTech, in hardware security modules, no one company holding a whole backup | Ledger Academy, 9 April 2026 |
| What does restoring require? | Two of the three fragments plus two independent identity checks, with ID and a selfie through Onfido | Ledger Academy, 9 April 2026 |
| What does it cost? | Quoted at 9.99 dollars a month, cancellable, and limited to certain countries and devices | Ledger Academy, 9 April 2026 |
| Will Ledger ever ask for the 24 words? | Never, on any channel. Ledger states the phrase should be entered nowhere except directly into the device | Ledger phishing page, checked 10 September 2026 |
The honest reading, and the one the manufacturer pages do not phrase this way: a firmware path exists that can export an encrypted duplicate of your entropy, gated behind your PIN and a physical button press. Plenty of owners had assumed no such path could exist at all. It can, it is off unless you switch it on, and knowing that is more useful than either the marketing or the outrage. If you want the device comparison that follows from it, the Trezor and Ledger comparison takes the open source question head on.
What do Ledger owners actually report about their 24 words?
Guidance pages all say the same sentence. What they do not carry is what owners describe when something goes wrong. Reading across Trustpilot reviews of ledger.com and threads in the r/ledgerwallet subreddit, about twenty accounts in total, one pattern dominated and one popular fear did not survive contact with the detail.
A reviewer posting as Nick Barnes on 8 July 2026 described physical mail carrying Ledger branding and a QR code, instructing him to apply post quantum cryptography to his wallet. Two more, on 17 and 19 August 2026, described receiving similar letters, checking them against the official site and finding them fraudulent. All three left the review because they had spotted it, which is a reporting bias worth naming: the people who scanned the code do not write reviews.
The clearest account came from Reddit. A user posting as clodmodracing in roughly September 2025 described an application that looked like Ledger Live asking for the 24 words, and posted screenshots before typing anything. Commenters spotted the giveaway immediately, a misspelling in the interface, and the poster believed the download had come from the official site. The likeliest route, several replies suggested, was a paid search result impersonating it. The machine was wiped. Nothing was lost, because the question was asked first.
Then the fear that did not hold up. A post from around February 2026 claiming that hackers had used Ledger Recover to take a seed phrase drew a Ledger support reply and a wall of scepticism, on the grounds that Recover cannot be triggered by software alone: it needs the physical device, the PIN, a button press and a live identity check. The poster also said no coins were held. The thread reads as a warning and resolves as a misattribution.
Where the accounts agree with the official guidance: the attack is social, it arrives by post, ad or fake app, and it ends the moment somebody types the words. Where they diverge: several one star reviewers, including accounts dated 22 June and 28 August 2026, insist their coins went while the phrase was never exposed. Those are unverified claims from one side of a dispute, and other explanations exist, including approving a malicious transaction. They are reported here as testimony, not as evidence, and they are not a finding about the device.
Why do fake Ledger letters keep arriving in the post?
Because the addresses are public. In Ledger’s own account of the July 2020 e-commerce and marketing data breach, an unauthorised party reached its marketing database, exposing around one million email addresses and roughly 272,000 detailed records carrying names, postal addresses and phone numbers. The full contents were dumped publicly in December 2020. No device secret was involved, and that was never the point: the product being stolen was a mailing list of people known to own crypto hardware.
It happened again. In January 2026 Ledger confirmed customer order data was exposed through Global-e, a cross border commerce partner, after a breach reported by The Register on 6 January 2026. Names, postal addresses, emails and phone numbers again. Recovery phrases, PINs and private keys were not involved, because they are not stored anywhere a shop could leak them. The same leak shows why a private wallet is not a private owner, a point we follow through the ledger itself in what an anonymous crypto wallet cannot actually hide.
Ledger’s ongoing phishing campaigns page lists physical mail with QR codes among the live threats, alongside fake emails, fake apps and malicious calls, and states that the recovery phrase should never be entered anywhere other than directly into the device. If a letter arrives saying your keys must be upgraded before a deadline, that is the campaign. Ledger does not send letters, and no genuine security fix has ever required you to read out 24 words.
What can you actually do with the 24 words?
The phrase is a standard, not a Ledger format. Any BIP-39 compatible wallet can rebuild the same accounts from the same words, so the hardware is replaceable and the vendor is not a dependency. That portability is the whole argument for holding a non custodial wallet.
It also cuts both ways, and this sentence is written straight. Anyone holding those words can rebuild your wallet from anywhere on earth without ever touching your device, your PIN or your email. No support desk can reverse it and no company holds a copy to restore from. That is the trade the standard makes, and it is why the only place the phrase belongs is offline and out of reach of any camera or keyboard.
BIP-39 also defines an optional passphrase, sometimes called the 25th word, mixed into the derivation to produce an entirely separate set of accounts. Ledger supports it. Forgetting it loses those accounts permanently, so it deserves its own page rather than a paragraph here. That page now exists: our wallet passphrase comparison sets Ledger’s second PIN option beside how Trezor, Coldcard, Jade and KeepKey handle the same word. A separate set of accounts can also turn up for a duller reason, a restoring app scanning different paths, which our guide to why a multi currency wallet restore can show a zero balance works through with the path table.
Ledger Seed Security Checklist
Verify that your storage and handling of the 24-word seed phrase follow recommended security practices.
Ticks are saved on this device only.
Frequently asked questions
Does a 24 word Ledger seed work on other wallets?
Yes. It is a BIP-39 phrase, so any BIP-39 compatible wallet can derive the same accounts from the same words, subject to that wallet supporting the same derivation paths for the coins you hold.
Can I change my Ledger 24 word seed to different words?
Not on an existing phrase. The usual route is to reset the device and let it generate a fresh 24 words, then move funds across, which means the old phrase and the new one are separate wallets.
Is 12 words enough, or should I insist on 24?
Both 128 and 256 bits are past any realistic guessing attack, so the choice is not a security decision in practice. Ledger generates 24 and gives no option, and will restore 12, 18 or 24.
What happens if one word of the 24 is wrong?
The checksum usually catches it and the device reports an invalid phrase rather than opening a different wallet. That is what the extra 8 bits in a 24 word phrase are for.
Does Ledger keep a copy of my recovery phrase?
Not by default. Ledger Recover is an optional paid subscription that stores encrypted fragments with three companies, and per Ledger’s documentation it is activated only with explicit consent on the device.
I got a letter about upgrading my Ledger for quantum computers. Is it real?
No. Ledger lists physical mail with QR codes among its ongoing phishing campaigns and states it never asks for the recovery phrase. Never enter the 24 words anywhere except the device itself.
Finished the page? The same five questions from the top, to see what stuck.
This article is educational and is not financial advice. Nothing here is a recommendation to buy, sell or hold anything. You are responsible for your own security decisions.
Leave a Reply