Lose a word. Not the wallet.
You still have most of your phrase. COLDWORD scans every possibility the missing words could be, checks each against the real BIP39 checksum, and stops the moment it derives an address that matches yours.
These are your own words. You type the ones you still have from a wallet you own; COLDWORD only searches the gaps. The phrase never leaves this tab — every hash is computed on your machine.
Every word comes from a fixed 2,048-word list. One gap is 2,048 possibilities — and the checksum throws out all but about 128 of them before a single address is derived.
The same seed produces your BTC, ETH, SOL, XRP, TRON and every EVM address. Recover the words once and every chain that phrase ever touched comes back with it.
The scan runs in a Web Worker in this tab. Your words are never transmitted, never logged, and never stored — close the tab and nothing of them remains.
Your words in.
The missing ones out.
On the right, fill in what you remember and leave the gaps blank. On the left is the same engine with nothing to go on — so you can see exactly what your remaining words are worth.
Both panels run the same audited primitives production wallets use — @scure/bip39 and @noble/curves. The demo phrase is prefilled so you can watch it work before trusting it with your own.
21 addresses
from 12 words.
A seed phrase isn't a Bitcoin thing — it's a master key. These are the addresses the phrase above derives, on the standard path each chain's wallets use.
Not shown: Cardano, Monero, Algorand and TON. They don't derive from a BIP39 seed the way the chains above do, so COLDWORD doesn't guess at them — an address it can't compute correctly is worse than no address at all.
The bar
cannot move.
This is the same scan with none of your words supplied. You've "checked" 0 phrases by scrolling and the completion figure still rounds to zero. That gap — between this bar and the two seconds it takes with your own words — is the entire product.
Four steps,
all deterministic.
The same words always produce the same keys. That's why a scan can confirm a guess is right — and why the words are worth protecting.
Random bits
Your wallet rolled 128 bits of randomness. Everything below is derived from it — which is why nothing but the words themselves can reproduce your keys.
2,048-word list
Those bits are cut into 11-bit chunks, each naming one word. A checksum is appended, so most random word-sets are simply invalid — which is what makes a gap scan finish quickly.
PBKDF2, 2,048 rounds
The phrase is stretched into a 512-bit seed with PBKDF2-HMAC-SHA512.
This is the slow step — and the reason a blind search never finishes.
BIP32 derivation
The seed feeds a key tree. Path m/44'/0'/0'/0/0 gives your first Bitcoin
address, m/44'/60'/0'/0/0 your Ethereum one, and so on for all 21.
Save your scans. Go deeper.
An account keeps your chain results and unlocks longer scans — more missing words, custom derivation paths, and passphrase search.
No password. We send a one-tap sign-in link.
You're in. Deep scan is unlocked.
Open COLDWORD on TelegramDeep scan covers 3–4 missing words, non-standard derivation paths and passphrase search — the cases the in-browser scanner can't finish on its own.