BIP 32 vs BIP 39: HD wallets vs seed phrases
BIP 39 turns random entropy into a 12 to 24 word seed phrase and then into a 512-bit seed; BIP 32 takes a seed and derives a whole tree of private and public keys from it. Most wallets use both: BIP 39 is the backup you write down, and BIP 32 is the engine that generates your keys and addresses.
Updated · 4 min read
At a glance
| BIP 32 | BIP 39 | |
|---|---|---|
| Title | Hierarchical Deterministic Wallets | Mnemonic code for generating deterministic keys |
| Status | Deployed | Deployed |
| Type | Informational | Specification |
| Assigned | 2012-02-11 | 2013-09-10 |
| Authors | Pieter Wuille | Marek Palatinus, Pavol Rusnak, Aaron Voisine, Sean Bowe |
| In plain English | Defines hierarchical deterministic (HD) wallets, in which a single seed generates a whole tree of keys. Users can back up a wallet once and share watch-only parts, for example with a shop or accountant, without giving away the ability to spend. | Defines the recovery phrase: a list of 12 to 24 common words that encodes a wallet's master secret. Users can write the words down to back up and later restore a wallet, a format now widely used across wallets. |
What BIP 32 does
BIP 32 (often written BIP32), by Pieter Wuille, defines hierarchical deterministic (HD) wallets. It starts from a seed of 128 to 512 bits (256 bits is advised) and runs it through HMAC-SHA512 with the key "Bitcoin seed". The 64-byte result is split into a master private key and a 32-byte chain code. Child keys are then derived by index, and children of children, forming a tree addressed by a derivation path such as m/0'/1/2.
BIP 32 also defines extended keys: a key plus its chain code, serialized as 78 bytes and encoded in Base58Check as a 111-character string starting with xprv (private) or xpub (public). An xpub lets software generate receiving addresses without being able to spend. Hardened derivation, for indexes of 2^31 and above and written with an apostrophe, stops a leaked child private key from exposing its parent.
What BIP 39 does
BIP 39 (BIP39), by Marek Palatinus, Pavol Rusnak, Aaron Voisine and Sean Bowe, defines the seed phrase, also called a mnemonic or recovery phrase. It takes 128 to 256 bits of entropy, appends a checksum of entropy length / 32 bits, and splits the result into 11-bit groups. Each group picks one word from a 2,048-word list, giving 12, 15, 18, 21 or 24 words.
To turn the words into a seed, BIP 39 runs PBKDF2 with HMAC-SHA512 for 2,048 iterations, using the phrase as the password and the string "mnemonic" plus an optional passphrase as the salt. The output is a 512-bit (64-byte) seed which, in the BIP's words, "can be later used to generate deterministic wallets using BIP-0032 or similar methods". BIP 39 defines no keys or addresses itself.
BIP 32 vs BIP 39: the key differences
| BIP 32 | BIP 39 | |
|---|---|---|
| Job | Derive a tree of keys from a seed | Encode entropy as words, then turn words into a seed |
| Input | Seed of 128 to 512 bits | Entropy of 128 to 256 bits, plus an optional passphrase |
| Output | Master key, chain code and child keys | 512-bit (64-byte) seed |
| Human-readable form | xprv / xpub strings of 111 characters |
12, 15, 18, 21 or 24 words |
| Core function | HMAC-SHA512 with key "Bitcoin seed" | PBKDF2-HMAC-SHA512, 2,048 iterations |
| Error check | 4-byte Base58Check checksum | 4 to 8 checksum bits (entropy length / 32) |
| Extra secret | None | Optional passphrase, often called the "25th word" |
| Safe to share? | An xpub, for watch-only use (costs privacy) | Never: the words are the wallet |
How BIP 32 and BIP 39 fit together
The two standards form a pipeline:
- The wallet generates random entropy and shows it to you as a BIP 39 phrase.
- BIP 39 stretches the phrase, plus any passphrase, into a 64-byte seed.
- BIP 32 turns that seed into a master key and derives child keys.
- A path standard such as BIP 44, BIP 84 or BIP 86 picks the branch of the tree that holds your addresses.
The conversion only runs one way. Because BIP 39 hashes the words instead of encoding the seed directly, an arbitrary BIP 32 seed or xprv can't be turned back into a phrase, and translating a phrase into another language's word list produces a completely different seed. BIP 32 also works without BIP 39: it accepts any random seed of the right size, and some wallets back up an extended private key or an output descriptor instead of words.
Which one applies to you?
Both, if you use a typical wallet. If you were given 12 or 24 words, that is your BIP 39 backup; the addresses the wallet shows come from BIP 32 derivation along a path. To restore funds elsewhere you need the words, the passphrase if you set one, and ideally the derivation path or descriptor. BIP 39 itself lists the lack of versioning as a shortcoming: the words don't record which address type you used.
For developers, implement BIP 32 for any HD wallet and BIP 39 when you need human-friendly backups. The BIP 39 word list shows all 2,048 English words, and the derivation path tool explains each level of a path. Never type a real seed phrase into a website, including this one. The seed phrases guide and derivation paths guide go further.
Frequently asked questions
Is a seed phrase the same as a BIP 32 seed?
No. A BIP 39 seed phrase is a human-readable encoding of random entropy. BIP 39 runs the words, plus any passphrase, through PBKDF2-HMAC-SHA512 with 2,048 iterations to produce a 64-byte seed, and that seed is what BIP 32 uses to create the master key. The phrase and the seed are linked, but they are different data.
Can you use BIP 32 without BIP 39?
Yes. BIP 32 accepts any seed of 128 to 512 bits from a random number generator, and it predates BIP 39. A wallet can back up the seed, an extended private key or an output descriptor instead of words. BIP 39 is simply the most common way to make the seed easy for people to write down and restore.
What is the difference between an xpub and a seed phrase?
A seed phrase (BIP 39) recreates every private key in the wallet, so anyone who has it can spend your coins. An xpub (BIP 32) is an extended public key for one branch of the key tree: it can generate addresses and watch balances but cannot sign. Sharing an xpub costs privacy rather than funds, unless a child private key also leaks.
Does a BIP 39 passphrase change the BIP 32 keys?
Yes. The passphrase is part of the PBKDF2 salt, so every passphrase produces a different 64-byte seed and therefore a completely different BIP 32 key tree. BIP 39 notes that every passphrase gives a valid wallet. That offers plausible deniability, but it also means a typo silently opens an empty wallet instead of showing an error.
Can I turn an xprv back into a seed phrase?
No. BIP 39 derives the seed by hashing the words, so the conversion only runs one way: words to seed to master key. An existing BIP 32 seed or extended private key can't be expressed as a BIP 39 phrase. To get a word backup you would create a new wallet with a fresh phrase and move the funds to it.