What is BIP-39?

The Bitcoin Improvement Proposal that defines the 12- or 24-word recovery phrase, drawn from a fixed list of 2,048 words, that most wallets now use.

Because the standard is shared, a phrase created in one wallet can usually be restored in another. Word order matters and the last word encodes a checksum.

It is the reason a hardware wallet that stops working is an inconvenience rather than a disaster. The device is replaceable; the phrase is the wallet. It is also why writing the phrase down badly is the single most common way people lose crypto permanently.

How it works

The wallet generates random entropy and appends a checksum. BIP-39 specifies that the checksum is the first ENT divided by 32 bits of the SHA-256 hash of the entropy, so 128 bits of entropy takes a 4-bit checksum and 256 bits takes an 8-bit one (source: BIP-39).

The combined bits are split into groups of 11, and each group indexes a word list of 2,048 entries, since 11 bits encodes a number from 0 to 2047 (source: BIP-39). That gives 12 words for 128 bits of entropy and 24 words for 256 bits.

The checksum is why a mistyped or reordered phrase is rejected rather than silently opening an empty wallet. It catches most errors but is only 4 or 8 bits wide, so it is a typo check rather than a guarantee.

Turning the phrase into a seed uses PBKDF2 with the mnemonic as the password and the string "mnemonic" plus an optional passphrase as the salt, 2,048 iterations, HMAC-SHA512 as the function (source: BIP-39). The optional passphrase means the same 24 words produce a completely different wallet for each passphrase, with an empty string used when none is set.

The seed then feeds the hierarchical derivation in BIP-32, which is how one phrase produces every address in an hd wallet.

Example

Illustrative: two wallets both restore the same 24 words. The first is opened with no passphrase and shows the balance you expect. The second is opened with the passphrase "kitchen" and shows an empty wallet at completely different addresses. Neither is wrong. The passphrase is part of the secret, and forgetting it loses the funds exactly as thoroughly as losing the words.

Why it matters when you buy

The moment you move a purchase off an exchange into your own wallet, this phrase becomes the only thing standing between you and permanent loss. Write it on something that survives water and fire, store it away from the device, and never photograph it or type it into anything connected. See the guide on backing up a seed phrase and the guide on setting up a hardware wallet.

Related terms

• seed phrase — the everyday name for the same thing
• passphrase — the optional extra word that changes everything
• hd wallet — the derivation that turns a phrase into addresses
• hardware wallet — where the phrase is usually generated
• shamir backup — splitting a backup into shares
• xpub — the public half you can share safely

Questions

Is 24 words safer than 12?

It doubles the entropy, from 128 bits to 256. Both are far beyond brute force with current technology, so the practical difference is negligible compared with how well you store the backup.

Can I use my phrase in a different wallet?

Usually yes, since the standard is shared. Differences in derivation paths mean some wallets show a different set of addresses, which is a configuration issue rather than a loss.

Does a passphrase replace the words?

No, it is added to them. You need both to recover the wallet, and the passphrase is not stored anywhere, so it must be backed up as carefully as the words themselves.