Blockchain/Level II · Mechanics/2.1 Cryptography/Lesson 7
Seed phrases (BIP39)
Twelve words, a checksum, and the 512-bit seed that controls everything
MaterialsThe BIP39 English word list (github.com/bitcoin/bips)A notebook
Wonder
- Why does a random sequence of bits become twelve English words instead of staying as hex?
- What happens to the wallet if one word in the phrase is swapped for another from the same list?
- How can the exact same twelve words generate two completely different wallets?
Explore
- BIP39, written in 2013 by developers including the team behind the Trezor hardware wallet, converts raw cryptographic entropy into a human-readable mnemonic. Copying 32 or 64 hexadecimal characters by hand invites errors; words are easier to write, read back and check. The standard defines a deterministic mapping between binary sequences and words from a fixed dictionary, allowing users to recover their entire key hierarchy by memorizing or writing down a short list.
- The process begins with entropy: a random sequence of 128, 160, 192, 224, or 256 bits. A checksum is appended to this entropy by taking the first N bits of its SHA-256 hash, where N equals the entropy length divided by 32. For a standard 12-word phrase (128-bit entropy), this adds 4 bits; for 24 words (256-bit entropy), it adds 8 bits. This checksum allows wallet software to detect most transcription errors immediately upon import.
- The combined entropy and checksum string is split into 11-bit segments, each of which indexes a word from the BIP39 English list of 2,048 unique entries. The list was curated so that no two words share the same first four letters, reducing ambiguity during manual transcription. Because the final segment includes part of the checksum, randomly chosen words usually fail: only about 1 in 16 random 12-word sequences passes the checksum (1 in 256 for 24 words).
- To derive the actual seed used for key generation, the mnemonic sentence and an optional passphrase are fed into PBKDF2-HMAC-SHA512 with 2,048 iterations. The salt is constructed from the literal string ‘mnemonic’ followed by the passphrase (or just ‘mnemonic’ if no passphrase exists). This stretching function produces a deterministic 512-bit seed. When a passphrase is used, an attacker holding all twelve words still cannot derive the seed without it, provided the passphrase is strong enough to resist guessing.
- This mechanism creates a dual-layer security model. The mnemonic provides recovery capability and basic error detection, while the passphrase acts as a ‘hidden wallet’ layer. Some users keep a small decoy wallet under the bare words and their main funds behind a passphrase. However, this is also a vector for loss: if the passphrase is forgotten or lost, access to the funds is permanently revoked, as there is no way to recover it from the mnemonic alone.
- Not all wallets follow BIP39; Electrum uses its own scheme, and SLIP-0039 splits secrets into Shamir shares for multi-party custody. Nevertheless, BIP39 remains the dominant standard due to broad compatibility across hardware devices and software applications. The 512-bit seed generated here serves as the root input for BIP32 hierarchical deterministic key derivation, meaning that every private key in a wallet is ultimately traceable back to this specific phrase and passphrase combination.
Key facts
- BIP39 maps 128-256 bits of entropy plus a SHA-256 checksum into 12-24 words from a 2,048-word list.
- The English wordlist is designed so that the first four letters uniquely identify each word.
- PBKDF2-HMAC-SHA512 with 2,048 iterations stretches the mnemonic and passphrase into a 512-bit seed.
- A different passphrase applied to the same mnemonic generates a completely distinct and valid wallet.
- Losing either the mnemonic words or the associated passphrase results in permanent loss of access to funds.
- SLIP-0039, a separate and incompatible standard, splits a secret into Shamir shares for threshold recovery.
Exercise nine, six, three, one
9CollectList 9 wallets or signing devices and note whether each uses BIP39, its own scheme, or SLIP-39.
6ClusterGroup the 9 into 6 by how they back up keys: 12 words, 24 words, words plus passphrase, Shamir shares, multisig configuration, or other.
3DistillReduce the 6 to 3 trade-offs between ease of recovery and resistance to theft.
1CrystallizeWrite 1 sentence explaining why the final word in a BIP39 phrase is mathematically distinct from the preceding eleven.
Fact check
Dates, figures and claims checked against the published sources listed below.