Mnemonic seed

A bitcoin seed phrase, also called a mnemonic, is a list of 12 to 24 words, taken from a fixed list of 2048. The words encode a large random number, called the entropy, plus a short checksum. A key stretching function turns the phrase into a 64-byte seed, and that seed starts an HD wallet. The rules are set out in BIP 39.

The phrase is the backup of the whole wallet. Anyone who holds it can rebuild every key, so write it down, keep it offline and never type it into a website.

Why do wallets use words?

A wallet needs a random number of 128 to 256 bits, which people cannot copy reliably. Written as hex, 128 bits is 32 characters with no check against typos. Written as 12 words, the same bits are easy to read aloud and to write by hand.

The word list is designed for this. It has 2048 English words, each with a different first four letters, so a phone can complete a word after you type four letters. A typo often produces a word that is not on the list, and the checksum catches most of the rest.

How is a mnemonic made?

Making a phrase takes three steps.

1. Generate the entropy

Generate between 128 and 256 bits of randomness, in steps of 32 bits. Use a secure random source, such as the operating system's generator. The general random function in most programming languages is fast, but it is not secure, so do not use it for keys.

2. Add the checksum and split into words

Hash the entropy once with SHA-256. Take the first bits of that hash as the checksum, one bit for every 32 bits of entropy. Append the checksum to the entropy, then cut the result into groups of 11 bits. Each group is a number from 0 to 2047, which picks one word from the list.

Entropy	Checksum	Total bits	Words
128 bits	4 bits	132	12
160 bits	5 bits	165	15
192 bits	6 bits	198	18
224 bits	7 bits	231	21
256 bits	8 bits	264	24

Both 12 and 24 words are fine. A 24-word phrase has more entropy, and a 12-word phrase is easier to store.

3. Turn the words into a seed

Run the phrase through PBKDF2, which is covered below. The output is 64 bytes, and that is the seed for the wallet.

What does a 12-word phrase look like?

The example uses the official BIP 39 test vector with entropy of 128 zero bits. Its SHA-256 begins 37, which is 0011 in binary, so the checksum is 0011. The 132 bits split into twelve 11-bit groups. Each group becomes one word.

The phrase is abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about. Anyone can look up this phrase, so it must never hold coins. Use it only to test your code.

How is the seed made?

The seed comes from PBKDF2 with HMAC-SHA512, run for 2048 rounds, with a 64-byte output. The phrase is the password. The salt is the fixed text mnemonic, plus an optional passphrase. Both values are normalized with NFKD before they are used.

PBKDF2 is slow on purpose. Each guess at a phrase costs 2048 rounds of HMAC, which makes large searches expensive.

With an empty passphrase, the seed of the example phrase is 5eb00bbddcf069084889a8ab9155568165f5c453ccb85e70811aaed6f6da5fc19a5ac40b389cd370d086206dec8aa6c43daea6690f20ad3d8d48b2d2ce9e38e4.

What does the passphrase do?

The passphrase is an optional extra word, sometimes called the 25th word. It is not part of the phrase. It joins the salt, so a different passphrase gives a completely different seed. The same 12 words with the passphrase TREZOR give c55257c360c07c72029aebc1b53c05ed0362ada38ead3e3e9efa3708e53495531f09a6987599d18264c1e1c92f2cf141630c7a3c4ab7c81b2f001698e7463b04, which looks nothing like the seed above.

This has three consequences.

• A passphrase is not a PIN. With no passphrase, the phrase alone opens the wallet.
• A wrong passphrase does not raise an error. It opens an empty wallet, which can look like lost funds.
• Back up the passphrase separately from the words. If you lose it, the words will not recover the coins.

How do you check a phrase is valid?

A phrase carries its own checksum, so you can check it before you rely on it. Look up each word's index, join the 11-bit groups into one string of bits, and split off the checksum at the end. Hash the entropy part with SHA-256, take the same number of bits, and compare.

A random list of 12 words passes the check only about one time in 16. A 24-word phrase has an 8-bit checksum, so only about one in 256 random lists passes it.

This Python code builds the phrase from entropy, using the English word list from BIP 39 saved as english.txt. It needs only the standard library.

import hashlib

def mnemonic_from_entropy(entropy: bytes, wordlist: list[str]) -> str:
    cs_len = len(entropy) * 8 // 32                      # checksum bits
    checksum = hashlib.sha256(entropy).digest()           # one SHA-256 pass
    bits = bin(int.from_bytes(entropy, "big"))[2:].zfill(len(entropy) * 8)
    bits += bin(int.from_bytes(checksum, "big"))[2:].zfill(256)[:cs_len]
    return " ".join(wordlist[int(bits[i:i + 11], 2)] for i in range(0, len(bits), 11))

words = [w.strip() for w in open("english.txt")]
print(mnemonic_from_entropy(bytes(16), words))            # ... about

The seed comes from one more call, hashlib.pbkdf2_hmac("sha512", phrase.encode(), ("mnemonic" + passphrase).encode(), 2048). The snippet skips the NFKD normalization that BIP 39 specifies. That changes nothing for the English words, but a library handles it for every language. Use a library for real wallets, and check any code against the test vectors first.

How do you keep a seed phrase safe?

• Write the words on paper, and keep the paper offline, in more than one place.
• Never store the phrase in a photo, a cloud note, an email or a password manager you cannot restore from.
• Never type the phrase into a website, and never use a phrase that a website generated for you. A website can keep a copy.
• Check that your wallet can restore from the phrase with a small amount first, before you move large sums.

What should you remember about mnemonic seeds?

• A mnemonic is 12 to 24 words that encode 128 to 256 bits of entropy plus a checksum.
• PBKDF2 turns the phrase and an optional passphrase into a 64-byte seed.
• The seed is the root of the wallet, so the phrase is the most sensitive backup you hold.

Next, read extended keys to see how the seed becomes the master key, and derivation paths to see how a wallet finds each address from it.