BIP-39 Mnemonic Phrases: How Crypto Wallets Generate Seed Words

When you create a new cryptocurrency wallet — whether it's MetaMask, Ledger, Trust Wallet, or any other HD wallet — the setup process gives you a list of 12 or 24 English words and tells you to write them down and keep them safe. Those words are your mnemonic phrase, also called a seed phrase or recovery phrase, and they are the single point of access to every key and address your wallet will ever generate.

The system behind those words is BIP-39, a Bitcoin Improvement Proposal published in 2013 that defines how random entropy is converted into human-readable words and then into a cryptographic seed. BIP-39 has become the de facto standard across the cryptocurrency industry — not just for Bitcoin, but for Ethereum, Solana, and virtually every blockchain that uses hierarchical deterministic wallets.

This article explains each step of the BIP-39 process: entropy generation, checksum calculation, word mapping, and seed derivation.

The Problem BIP-39 Solves

Before BIP-39, wallet backup meant managing raw private keys — long hexadecimal strings like e9873d79c6d87dc0fb6a5778633389f4453213303da61f20bd67fc233aa33262. These strings are functionally impossible to memorize, easy to transcribe incorrectly, and offer no error detection. Swap two characters and you have a completely different (and probably empty) wallet with no way to know you made a mistake.

BIP-39 addresses all three problems. Words are easier for humans to read, write, and verify than hex strings. The word list is designed so that the first four characters of each word are unique, reducing transcription ambiguity. And the checksum built into the phrase means that a randomly altered word will almost certainly produce an invalid phrase that software can reject.

Step One: Entropy Generation

The process begins with random entropy — raw random bits generated by a cryptographically secure random number generator. The amount of entropy determines the length of the mnemonic phrase.

A 12-word phrase requires 128 bits of entropy. A 15-word phrase requires 160 bits. An 18-word phrase requires 192 bits. A 21-word phrase requires 224 bits. A 24-word phrase requires 256 bits. The relationship is consistent: every 32 bits of additional entropy adds 3 more words to the phrase.

The quality of this entropy is the most critical security factor in the entire process. If the random number generator is predictable, biased, or compromised, the resulting mnemonic can be brute-forced regardless of how many words it contains. Hardware wallets typically use dedicated hardware random number generators, while software wallets rely on the operating system's cryptographic random source. Our article on password security discusses entropy in depth — the same principles apply here.

Step Two: Checksum Calculation

After generating the entropy, the wallet computes a SHA-256 hash of the entropy bytes. The first few bits of this hash become the checksum, which is appended to the original entropy.

For 128 bits of entropy, the checksum is 4 bits (128 divided by 32). For 256 bits, the checksum is 8 bits. This gives a combined bit string of 132 bits (for 12 words) or 264 bits (for 24 words).

The checksum serves as an error-detection mechanism. If you write down your mnemonic and accidentally change one word, the checksum bits will almost certainly no longer match, and any BIP-39-compliant wallet will reject the phrase as invalid. This is not full error correction — it won't tell you which word is wrong — but it catches the vast majority of accidental transcription errors.

You can compute SHA-256 hashes using our SHA-256 hash generator, which uses the same algorithm that BIP-39 uses for its checksum step.

Step Three: Mapping Bits to Words

The combined entropy-plus-checksum bit string is divided into groups of 11 bits. Each 11-bit group represents a number from 0 to 2047, and each number maps to a word in the BIP-39 word list.

The standard English word list contains exactly 2,048 words — from "abandon" (index 0) to "zoo" (index 2047). This number is not arbitrary: 2,048 is 2 to the power of 11, which means each word encodes exactly 11 bits of information. Twelve words encode 132 bits (128 bits of entropy plus 4 bits of checksum). Twenty-four words encode 264 bits (256 bits of entropy plus 8 bits of checksum).

The word list was carefully curated with several design constraints. Words are between 4 and 8 characters long. The first four characters of every word are unique, so that wallets can accept abbreviated input. Similar-sounding words and easily confused words were avoided where possible. The list is sorted alphabetically, making it easier to search.

BIP-39 defines word lists for multiple languages — English, Japanese, Korean, Spanish, Chinese (simplified and traditional), French, Italian, Czech, and Portuguese. The English list is by far the most widely used, and some wallet implementations only support it.

Step Four: From Mnemonic to Seed

Here's a detail that surprises many people: the mnemonic phrase itself is not the seed. The seed is derived from the mnemonic using a key-stretching function called PBKDF2.

The wallet takes the mnemonic phrase (as a UTF-8 string of space-separated words) and passes it through PBKDF2-HMAC-SHA512 with 2,048 rounds of hashing. The salt for this function is the string "mnemonic" concatenated with an optional passphrase. If no passphrase is set, the salt is simply the word "mnemonic".

The output is a 512-bit (64-byte) seed. This seed is then used as input to BIP-32, which defines hierarchical deterministic key derivation — the process of generating an entire tree of private keys, public keys, and addresses from a single master seed.

The PBKDF2 step is crucial for two reasons. First, it makes brute-force attacks more expensive. An attacker who tries to guess a 12-word mnemonic must run 2,048 rounds of HMAC-SHA512 for every guess, which is computationally meaningful at scale. Second, the optional passphrase acts as a "25th word" that produces a completely different seed — and therefore completely different keys and addresses — without changing the mnemonic itself. Two people could write down the same 12 words, use different passphrases, and end up with entirely separate wallets.

Entropy and Security

The security of a BIP-39 mnemonic is determined by its entropy, not by the number of words per se — though the two are directly related. A 12-word phrase has 128 bits of entropy, meaning there are 2 to the power of 128 possible valid phrases — roughly 3.4 times 10 to the power of 38. A 24-word phrase doubles that to 256 bits.

To put 128 bits of entropy in perspective: if every computer on Earth attempted one billion guesses per second, it would take approximately 10 to the power of 21 years to try all possibilities — many orders of magnitude longer than the age of the universe. For all practical purposes, a 12-word BIP-39 phrase is unguessable through brute force, provided the entropy was generated properly.

The real vulnerabilities are elsewhere. Phishing attacks trick users into entering their phrases on fake websites. Malware captures phrases when they're typed or displayed on screen. Physical theft of written backups is perhaps the most common attack vector. The cryptographic security of BIP-39 is not the weak link — human factors are.

The Passphrase (Optional "25th Word")

BIP-39 supports an optional passphrase that is concatenated with "mnemonic" to form the PBKDF2 salt. This feature is sometimes called the "25th word" because it effectively extends the mnemonic with an additional secret.

The passphrase provides plausible deniability. You can create one wallet with no passphrase (holding a small amount) and a second wallet with a passphrase (holding your main funds). Both derive from the same 12 or 24 words, but they produce completely different seeds, keys, and addresses. Under duress, you could reveal the mnemonic without the passphrase and the attacker would see only the decoy wallet.

The passphrase also protects against physical theft of the written mnemonic. An attacker who finds your 24 words but doesn't know the passphrase cannot access the passphrase-protected wallet.

However, the passphrase is a double-edged sword. If you forget it, your funds are permanently inaccessible. There is no recovery mechanism. The passphrase is not stored anywhere — it exists only in your memory and in whatever backup method you use. Many users who enable a passphrase eventually lose access to their funds because of it.

Common Misconceptions

"My seed phrase is my private key." It's not. The mnemonic generates a seed through PBKDF2, and the seed generates a master key through BIP-32 derivation. The relationship is deterministic but not direct.

"Any random 12 words from the list form a valid mnemonic." They usually don't. The last word encodes the checksum bits, so only specific combinations of words produce valid phrases. Roughly one in 16 randomly assembled 12-word sequences (for 4-bit checksums) will pass validation.

"All wallets generate the same addresses from the same mnemonic." They should, but they might not. Different wallets use different derivation paths (BIP-44, BIP-49, BIP-84 for Bitcoin; BIP-44 with a different coin type for Ethereum). The same mnemonic in two wallets with different derivation path defaults will produce different addresses.

"A 24-word phrase is twice as secure as a 12-word phrase." In terms of bit length, 256 bits is double 128 bits. But security doesn't scale linearly — 128 bits is already astronomically beyond brute-force capability. The practical security improvement of 24 words over 12 is negligible against brute-force attacks. The advantage of 24 words is mainly relevant for theoretical quantum computing threats.

BIP-39 and Related Standards

BIP-39 is one piece of a larger ecosystem of standards that together define modern HD wallets.

BIP-32 defines hierarchical deterministic key derivation — how a single master seed produces a tree of child keys. BIP-43 establishes a purpose field in the derivation path to indicate which standard is being used. BIP-44 defines the multi-account hierarchy for HD wallets, establishing the derivation path format m/44'/coin_type'/account'/change/address_index. BIP-84 defines derivation paths for native SegWit addresses.

Together, these standards mean that a single 12 or 24-word mnemonic can deterministically generate addresses for Bitcoin, Ethereum, Solana, and hundreds of other chains — all from the same seed, all recoverable from the same set of words.

Generating and Testing Mnemonics

Our BIP-39 mnemonic generator creates valid mnemonic phrases using cryptographically secure entropy. You can generate 12, 15, 18, 21, or 24-word phrases and verify that the checksum is valid.

For understanding the hashing algorithms involved, our SHA-256 hash generator demonstrates the hash function used for the checksum step, and our Keccak-256 hash generator shows the hash function used in Ethereum's key derivation process after the BIP-39 seed is created.

If you're interested in how random values are generated and why entropy quality matters, our password generator and random string generator use the same type of cryptographic randomness that secure BIP-39 implementations require.

The Bottom Line

BIP-39 is elegant in its simplicity: take cryptographic entropy, add a checksum, split into 11-bit chunks, map each chunk to a word, and then stretch the result into a seed using PBKDF2. The output is a human-friendly backup for what would otherwise be an unmanageable cryptographic key hierarchy. Those 12 or 24 words hold the keys to every address your wallet will ever generate — which is exactly why they must be stored with extreme care, never entered on any website, and never shared with anyone for any reason.

References

BIP-39 Specification — The original Bitcoin Improvement Proposal defining mnemonic code generation.

BIP-39 Word Lists — Official word lists for all supported languages.

Learn Me a Bitcoin — Mnemonic Seed — Visual walkthrough of entropy to seed conversion.

Ian Coleman BIP-39 Tool — Interactive tool for generating and inspecting BIP-39 mnemonics and derived keys.

DevTools — How BIP39 Seed Phrases Work — Clear explanation of the mnemonic-to-seed derivation process.