If someone guesses my 12 words, can they log into my account?

Short answer: yes. Your phrase is the key, so anyone who holds it can sign in, the same way anyone holding your house key can open your door. That is by design: it is the single master key to your notes, and nothing weaker sits in front of it. So the real question is not whether holding the phrase grants access (it does), but whether someone could guess it, and there the answer is no, not with any computer that exists or that we can foresee.

Here is the scale. A 12-word phrase is one of 2^128 possibilities: about 340 undecillion, a 39-digit number (3.4 x 10^38). The odds of guessing yours on the first try are 1 in 340 undecillion, longer odds than winning a 1-in-300-million lottery jackpot four times in a row. Treating it as a search rather than a lucky guess does not help: even at a billion billion attempts every second (10^18, far beyond what any real hardware could reach, nation-states included), working through them all would take around 10 trillion years, close to 800 times the current age of the universe. And that is the fantasy version, because every real attempt has to run a deliberately slow key-derivation step and any online attack must go through our servers, which makes actual guessing slower by many more orders of magnitude. This is not a novel scheme either: the same 128-bit construction has secured Bitcoin wallets for over a decade, and no one has ever guessed one.

It is tempting to picture the phrase like a password, where you add strength by mixing in capitals, numbers, and symbols. A recovery phrase does not work that way, and you should never try to build or edit one by hand. Your device generates 128 bits of cryptographically secure randomness and encodes them as 12 words from a fixed public list of 2048 words: that randomness is the entire strength. The last word even carries a built-in checksum, so a mistyped or made-up phrase is rejected on sight. Word order matters, capitalization does not (we normalize it when you sign in), and adding symbols would only make the phrase invalid. Type the words exactly as issued.