Recovery phrases come in a small number of fixed lengths, most often twelve or twenty-four words. The lengths are not arbitrary; each corresponds to a specific quantity of randomness plus a built-in error check.
The phrase encodes a number
A wallet begins by generating a large random value. Everything else, including every private key it will ever produce, is derived from that value.
Written out as digits, such a number is easy to mistranscribe and impossible to remember. Encoding it as words from a fixed list makes it far easier to copy accurately.
Each word in the standard list represents a fixed chunk of the underlying bits, so the phrase is a translation of the number rather than a password protecting it.
Word count follows from bit count
Because each word carries a fixed number of bits, the amount of randomness determines the length. The smaller standard size produces twelve words and the larger produces twenty-four.
The intermediate lengths that some wallets offer correspond to the sizes in between, following the same arithmetic.
Nothing prevents other lengths in principle, but wallets implement the standard sizes so that a phrase written down with one product can be restored in another.
The last word is partly a checksum
A portion of the final word is derived from a hash of everything preceding it rather than from the random value.
This lets software detect a mistyped or misordered phrase immediately, instead of silently opening an empty wallet derived from the wrong number.
It also means the last word cannot be chosen freely. Guessing a forgotten final word is constrained to the small set that satisfies the check.
Longer is not meaningfully safer in practice
Twelve words already represent far more possibilities than any brute-force search could cover with any conceivable amount of computing power.
Twenty-four words provide more margin, which some holders prefer for very long horizons, but the practical difference against guessing is negligible.
Losses come from elsewhere: phrases photographed, typed into a website, stored in cloud notes, or entered into software that was not what it claimed to be.
The optional passphrase changes the derivation
Many wallets support an extra secret that is combined with the phrase before keys are derived, producing an entirely separate set of accounts.
Because it is an input rather than a lock, there is no wrong answer. Any passphrase produces a valid but different wallet, which is what enables plausible-deniability setups.
It also removes the safety net. A forgotten passphrase cannot be recovered from the words, and the funds behind it are unreachable even though the phrase itself is intact.