Derivation paths

A derivation path is the list of child indexes that leads from the master key to one key in an HD wallet. The path m/84'/0'/0'/0/0 names the first receiving key of a native SegWit account. Each slash moves one level down the tree, and an apostrophe marks a hardened index. Wallets agree on a few standard paths, so the same seed restores in another wallet.

A derivation path does not hold any secret. It is a map. The secret is the seed, and the path tells software which part of the tree to open.

How do you read a path?

A path starts with m, which is the master key. Each number after it is a child index, and each slash is one level down. An apostrophe after a number marks a hardened child, which is described in extended keys.

• m/0/1/3' means child 0 of the master, then child 1 of that, then hardened child 3 of that.
• A hardened index adds 2^31, which is 2,147,483,648, to the number. So 0' is index 2,147,483,648, 3' is 2,147,483,651, and 84' is 2,147,483,732.
• A level can hold up to 2^32 children, so the full range of indexes is 0 to 4,294,967,295.

The normal range is the first half, from 0 to 2,147,483,647. Hardened children use the second half, and only the private key can make them. Most paths use hardened indexes at the top and normal indexes at the bottom, as the next section explains.

What do the five levels mean?

The layout comes from BIP 44, which builds on the layout that BIP 32 suggested. It has five levels, with the purpose defined by BIP 43:

m / purpose' / coin_type' / account' / change / address_index

• Purpose (44', 49', 84', 86') says which family of addresses the wallet uses. The number matches the BIP that defines it.
• Coin type (0') says which coin the keys belong to. Bitcoin mainnet is 0', and testnet is 1'. The full list is in SLIP-44. Using one seed with several coins is why the level exists.
• Account (0', 1' and so on) keeps separate pots of coins apart. Accounts are hardened, so the xpub of the coin-type level cannot make an account. BIP 44 asks wallets not to open a new account until the previous one has been used.
• Change is 0 for receiving addresses, which you give out, and 1 for change, which goes back to you after a payment. Both are normal children, so a shared xpub at this level can make every receiving address.
• Index is the position of the key in its chain. Each new receiving address takes the next index, starting from 0.

The keys you use to sign are at the last level. The levels above it only organize them.

Which paths do wallets use?

Four paths cover most wallets. Each uses the same five levels, so only the purpose number changes. Every example below uses the seed of the test phrase abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about, the same one the BIP 84 vector uses.

• BIP 44 (m/44'/0'/0'/0/0) gives legacy 1 addresses, which are P2PKH.
• BIP 49 (m/49'/0'/0'/0/0) gives nested SegWit 3 addresses, which are P2SH-P2WPKH.
• BIP 84 (m/84'/0'/0'/0/0) gives native SegWit bc1q addresses, which are P2WPKH.
• BIP 86 (m/86'/0'/0'/0/0) gives Taproot bc1p addresses, which are P2TR. It builds key-path-only outputs with no script tree, so the Merkle root is empty.

The purpose number does not change the key math. It tells the wallet which script to build from the key. The address types are on the address page.

What does a full BIP 84 example look like?

Here is every step from the seed to the first receiving address, using the BIP 84 test vector. Use it to test your own code. It is public, so never send coins to these addresses.

1. Start from the seed, which the BIP 39 phrase gives with an empty passphrase:

5eb00bbddcf069084889a8ab9155568165f5c453ccb85e70811aaed6f6da5fc19a5ac40b389cd370d086206dec8aa6c43daea6690f20ad3d8d48b2d2ce9e38e4

2. Derive the master key with HMAC-SHA512, as HD wallets describes.
3. Derive the hardened levels 84', 0' and 0', using indexes 2,147,483,732, 2,147,483,648 and 2,147,483,648.
4. Derive the normal levels 0 and 0, for the receiving chain and index 0.
5. Take the private key, which is 4604b4b710fe91f584fff084e1a9159fe4f8408fff380596a604948474ce4fa3. Encode it as WIF, which gives KyZpNDKnfs94vbrwhJneDi77V6jF64PWPF8x5cdJb8ifgg2DUc9d.
6. Compute the compressed public key, 0330d54fd0dd420a6e5f8d3624f5f3482cae350f79d5f0753bf5beef9c2d91af3c.
7. Build the address from the public key, which gives bc1qcr8te4kr609gcawutmrza0j4xv80jy8z306fyu.

The same test vector gives bc1qnjg0jd8228aq7egyzacy8cys3knf9xvrerkf9g at m/84'/0'/0'/0/1, the second receiving address. Its first change address, at m/84'/0'/0'/1/0, is bc1q8c6fshw2dlwun7ekn9qwf37cu2rn755upcp6el.

What happens when the path is wrong?

A wallet restored with the wrong path shows an empty balance, even though the seed is right. The keys exist, but they sit at another path, so the wallet looks at the wrong addresses. The coins are not lost.

The fix is to try the other standard paths. A seed that shows nothing at m/84'/0'/0' may hold coins at m/86'/0'/0' or m/44'/0'/0'. Some wallets let you choose the path when you restore, and many show the path in their advanced settings.

What is the gap limit?

When a wallet restores, it checks addresses in order, and it stops after 20 unused addresses in a row, the gap limit that BIP 44 sets. If you used index 5 and then index 26, a wallet with a gap limit of 20 would stop at index 25. The 20 unused addresses from 6 to 25 end its search before it reaches 26.

The coins are safe, and the wallet can still see them if you raise the limit or use a custom search. The gap limit only controls what a restore sees by default. Good wallets warn you before you create a large gap.

What habits help with paths?

• Keep the path with the seed. Write down the path or the wallet name, not just the words. It will save time if you ever restore.
• Prefer a standard path. A custom path can be hard to recover, and it does little for security.
• Know your notation. Many wallets show the account path, such as m/84'/0'/0', and leave out the last two levels. Add /0/0 to reach the first receiving key.
• Keep path tools local. Derivation tools are useful for learning, but never enter a seed into a website to explore paths.

What should you remember about derivation paths?

• A path such as m/84'/0'/0'/0/0 is a list of indexes, and an apostrophe marks a hardened level.
• The five levels are purpose, coin type, account, change and index.
• BIP 44, 49, 84 and 86 use the same shape, and only the purpose changes the address type.
• A restore that shows no balance usually means the path is different, not that the coins are gone.

Next, read address to see which address each path builds, or go back to extended keys to see the arithmetic that moves down each level.