How seed phrases work: BIP 39 explained

A seed phrase (also called a recovery phrase or mnemonic) is a list of 12 to 24 words that encodes the random number your wallet's keys come from. The format is defined by BIP 39 (often written BIP39): random entropy plus a short checksum is split into 11-bit pieces, each piece picks one word from a 2,048-word list, and the words are turned into a 512-bit seed with PBKDF2. Anyone with the words, and the passphrase if you set one, can recreate every key in the wallet.

Updated 2026-10-20 · 8 min read

What is a seed phrase?

Your wallet's private keys are derived from one secret number, the seed. Writing that number down as 128 or 256 binary digits would be slow and error-prone, so BIP 39 defines a way to write it as ordinary words. As the BIP puts it, a sentence "could be written on paper or spoken over the telephone".

BIP 39 was written in 2013 by Marek Palatinus, Pavol Rusnak, Aaron Voisine and Sean Bowe. Because so many wallets implement the same standard, a phrase written down in one wallet can usually be restored in another.

A seed phrase is not a password you choose. It is computer-generated randomness, transcribed. BIP 39 says explicitly that it is "not a way to process user-created sentences (also known as brainwallets) into a wallet seed".

How a BIP 39 seed phrase is made

Generating a phrase takes four steps:

1. Generate entropy. The wallet picks a random number of 128, 160, 192, 224 or 256 bits (BIP 39 calls the length ENT; it must be a multiple of 32).
2. Add a checksum. It hashes the entropy with SHA-256 and takes the first ENT / 32 bits of the hash. These checksum bits are appended to the end of the entropy.
3. Split into 11-bit groups. Each group is a number from 0 to 2047.
4. Look up the words. Each number is an index into the 2,048-word list. The words, in order, are the mnemonic.

Because 2^11 = 2048, every word carries exactly 11 bits. The last word is special: it holds the final bits of entropy plus the whole checksum.

How many words are in a BIP 39 seed phrase?

The number of words depends only on how much entropy the wallet started with:

The formulas from the BIP are CS = ENT / 32 and words = (ENT + CS) / 11. 12 and 24 words are by far the most common.

12 vs 24 words: is 24 more secure?

A 24-word phrase encodes 256 bits of entropy; a 12-word phrase encodes 128 bits. Both are far beyond what anyone could guess by brute force. There is also a ceiling elsewhere: BIP 32 notes that Bitcoin's 256-bit keys offer about 128 bits of security, which is the same as a 12-word phrase.

In practice, the bigger risks are a phrase that is lost, damaged, photographed or typed into the wrong place. A 24-word phrase takes longer to write down and check, and gives twice as many chances to make a transcription mistake. Both lengths are common, and either is fine if it was generated by a good random number generator.

The BIP 39 word list

The English list has 2,048 words, sorted alphabetically from abandon (index 0) to zoo (index 2047). BIP 39 describes what makes a good list:

• The first four letters identify each word. In the English list, no two words share the same first four letters, so "abandon" can be stored as "aban". Words are 3 to 8 letters long.
• Similar words are avoided, such as "build" and "built" or "woman" and "women".
• The list is sorted, so software can find words quickly.

You can browse and search the full list in the BIP 39 word list tool.

Word lists in other languages

The bitcoin/bips repository publishes official lists in ten languages: English, Spanish, French, Italian, Portuguese, Czech, Japanese, Korean, Chinese (Simplified) and Chinese (Traditional).

BIP 39 itself says it is "strongly discouraged" to generate phrases in languages other than English, because most wallets only support the English list. There is a second reason: the seed is computed from the words themselves, not from the underlying entropy. Translating a phrase into another language's list produces a completely different wallet.

Why the last word is a checksum

The checksum lets a wallet catch mistakes. If you mistype a word or swap two words, the checksum will usually fail and the wallet will warn you.

It is short, though. With 4 checksum bits (12 words), roughly 1 in 16 random phrases happens to pass; with 8 bits (24 words), 1 in 256. BIP 39's own "Shortcomings" section notes that the checksum gives only modest error detection and cannot help correct errors. It also means you can't pick 12 words you like: most choices won't have a valid last word, and words you choose are not random anyway.

From words to seed: PBKDF2 and the 512-bit seed

The words are not used as a key directly. BIP 39 stretches them into a 512-bit (64-byte) seed with PBKDF2:

• Password: the mnemonic sentence, in UTF-8 NFKD form.
• Salt: the string mnemonic followed by the passphrase (an empty string if there is none).
• Function: HMAC-SHA512, repeated 2,048 times.

For example, the well-known test phrase "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about" (128 bits of zeros plus its checksum) produces a seed beginning 5eb00bbd. This phrase is public and used only for testing: never send funds to it.

The step is one-way. You can get from words to seed, but not from an arbitrary seed back to words.

The BIP 39 passphrase (the "25th word")

BIP 39 lets you add an optional passphrase to the salt. People often call it the 13th or 25th word, but it is not a word from the list: it can be any text, of any length.

Every passphrase produces a valid, different wallet. The same 12 words with the passphrase TREZOR (used in the BIP's test vectors) give a completely different seed from the same words with no passphrase. BIP 39 points out this provides plausible deniability: a phrase can open a small decoy wallet without a passphrase and the real one with it. The glossary entry on the passphrase goes further.

The risks are just as important:

• There is no "wrong passphrase" error. A typo opens an empty wallet, not an error message.
• It is case-sensitive and space-sensitive. "Satoshi" and "satoshi " are different wallets.
• If you forget it, the coins are gone. Nobody can reset it.
• It must be backed up separately from the words, or it adds nothing against someone who finds both.

How the seed becomes your wallet: BIP 32

The 512-bit seed is the input to BIP 32, hierarchical deterministic (HD) wallets. BIP 32 hashes the seed with HMAC-SHA512 under the key "Bitcoin seed" to get a master private key and chain code. From there a tree of keys is derived, and each branch is identified by a derivation path such as m/84'/0'/0'/0/0.

That is why one phrase can hold many accounts and addresses, and why restoring it in a new wallet regenerates the same addresses. BIP 39 handles words to seed; BIP 32 handles seed to keys. BIP 32 vs BIP 39 compares the two, and the derivation paths guide explains the paths.

What a seed phrase doesn't store

A seed phrase stores the seed and nothing else. It does not record:

• which address type the wallet used (legacy, SegWit or Taproot; see address types),
• which derivation paths or account numbers were used,
• the passphrase, if any,
• for a multisig wallet, the other signers' public keys and the policy (see the multisig guide).

BIP 39 lists the missing version information as a shortcoming and notes it is "now largely mitigated by use of descriptor wallets (BIP-0380) in addition to a seed". An output descriptor records exactly what the wallet watches.

BIP 39 alternatives

BIP 39 is the most widely supported format, but not the only one:

• Electrum seeds. The Electrum wallet uses its own seed format, which is not BIP 39. Its phrases encode a version so the wallet knows which script type to restore. An Electrum phrase will not restore correctly in a wallet that expects BIP 39, and vice versa.
• SLIP-0039. BIP 39 says its own authors proposed SLIP-0039 "as an intended successor". It splits a secret into several shares using Shamir's secret sharing, so that a set number of shares is needed to recover it. It is a SatoshiLabs standard, not a BIP.
• codex32 (BIP 93). Encodes a BIP 32 master seed in the bech32 alphabet with an error-correcting checksum, optionally split into up to 31 shares with a threshold of 2 to 9. It is designed so checksums and recovery can be done by hand with lookup tables.
• Formosa (BIP 450). Maps every 33 bits of entropy to a short themed sentence instead of three unrelated words, aiming to make phrases easier to remember. It re-encodes back through the English BIP 39 list before PBKDF2, so the keys stay the same.
• Deterministic entropy (BIP 85). Not a replacement but a companion: it derives new, independent seed phrases from an existing master key, so one backup can recreate many child wallets.

How to back up a seed phrase safely

1. Write it on paper or stamp it in metal, in order, and number the words. Metal survives fire and water better than paper.
2. Never type it into a website, chat or cloud document, and never photograph it. No legitimate service, including BIP Explorer, will ever ask for your seed phrase. Our tools never do.
3. Check the backup by restoring it on the signing device, or in a wallet that has never touched the internet, before you put real money in.
4. Store copies in more than one safe place, so a single fire or burglary doesn't lose them.
5. Back up the passphrase separately if you use one, and make sure someone you trust can find both in an emergency.
6. Record what the phrase can't: the wallet software, address type and, ideally, the output descriptor. These aren't secret in the same way, but they make recovery much easier.