Home › Glossary › BIP 39 passphrase

BIP 39 passphrase

Also called: BIP39 passphrase, 25th word, 13th word, seed passphrase, mnemonic passphrase, optional passphrase, seed extension.

An optional secret added to a BIP 39 seed phrase. The same words with a different passphrase open a completely different wallet.

A BIP 39 passphrase is an optional secret combined with a seed phrase when the wallet's seed is calculated. The same 12 or 24 words with a different passphrase produce an entirely different wallet, which is why people call it the "13th word" or "25th word".

How it works

BIP 39 turns the words into a seed with PBKDF2 (HMAC-SHA512, 2,048 iterations). The words are the password, and the string mnemonic followed by the passphrase is the salt. With no passphrase, the salt is just mnemonic. Both are normalized to UTF-8 NFKD first, so the passphrase is case-sensitive and every character counts. The BIP's own test vectors all use the passphrase TREZOR.

There is no "wrong" passphrase. BIP 39 notes that every passphrase generates a valid seed and only the correct one shows the funds. That gives plausible deniability (a small decoy balance with no passphrase, the real savings behind one), but it also means a typo silently opens an empty wallet instead of showing an error.

Why it matters

  • Someone who finds the written words can't spend the coins without the passphrase.
  • If you forget the passphrase, the words alone can't recover the funds. There is no reset.
  • It is not the same as a wallet app's PIN or encryption password, and not the same as a BIP 38 passphrase, which encrypts a single private key.

Because the passphrase changes the root of the HD wallet, it also changes every xpub and address derived from it. Back it up separately from the words, and test a restore before funding the wallet. See the seed phrase guide for backup advice.

BIPs that define BIP 39 passphrase

Related terms

  • Seed phrase: A seed phrase is a list of 12 to 24 words, defined by BIP 39, that encodes the random number from which a wallet derives all of its keys.
  • Entropy: Entropy is the randomness a wallet starts from: typically 128 to 256 random bits that a seed phrase encodes and every private key is derived from.
  • HD wallet: An HD (hierarchical deterministic) wallet derives a whole tree of keys from one seed, as defined in BIP 32, so a single backup restores every address.
  • xpub (extended public key): An xpub is a BIP 32 extended public key: a public key plus chain code that can derive every address in an account, but can't spend from them.

Learn more

Guides