BIP39: how a recovery phrase becomes a wallet

BIP39 is a Bitcoin Improvement Proposal from 2013 that describes, in its own words, “generating the mnemonic and converting it into a binary seed”. The mnemonic is the 12 to 24 words you write down; the seed is what the wallet derives every key from. This sheet covers the mechanics and which hardware wallets use the standard. How to store a phrase, and what never to do with one, is in our seed phrase guide.

How does BIP39 turn random bits into words?

The wallet starts with entropy, random bits from its generator. BIP39 allows 128 to 256 bits in steps of 32. It adds a checksum, the first bits of the entropy’s SHA-256 hash (one checksum bit per 32 bits of entropy), then cuts the result into 11-bit pieces. Each piece is a number from 0 to 2,047, and each number picks one word from the 2,048-word list.

Entropy	Checksum	Total bits	Words
128 bits	4 bits	132	12
160 bits	5 bits	165	15
192 bits	6 bits	198	18
224 bits	7 bits	231	21
256 bits	8 bits	264	24

Why is the last word of a recovery phrase special?

Because it carries the checksum. In a 12-word phrase the last word’s 11 bits are 7 bits of entropy and the 4 checksum bits; in a 24-word phrase, 3 bits of entropy and 8 of checksum. Two things follow from the arithmetic:

• A wallet can catch many typos. If one word is wrong, the checksum usually no longer matches, and BIP39 tells software to “issue a warning if it is invalid”. With 4 checksum bits, about 1 in 16 random changes still passes, so a check is not a guarantee.
• You cannot pick 12 favourite words. Only about 1 in 16 arbitrary 12-word combinations has a valid checksum, and words chosen by a person are not random anyway. BIP39 says using a mnemonic not generated by its algorithm “is possible, this is not advised”; Tangem’s glossary puts it as “Human-chosen words are not random in the cryptographic sense.” Let the device generate the words.

How does the BIP39 word list work?

BIP39 lists the properties of a good word list. The English list is built so that “it’s enough to type the first four letters to unambiguously identify the word”, and “similar words avoided” (pairs such as “build” and “built”). That is why metal backup plates can store only the first four letters of each word, and why a device keyboard can complete a word after four letters.

The BIP39 repository also holds official lists in Japanese, Korean, Spanish, Chinese (simplified and traditional), French, Italian, Czech and Portuguese. BIP39 itself warns: “Since the vast majority of BIP39 wallets supports only the English wordlist, it is strongly discouraged to use non-English wordlists for generating the mnemonic sentences.” A phrase in another language may not restore in the wallet you need years later.

How do the words become keys?

The words themselves are not the key. BIP39 runs the mnemonic through PBKDF2 with HMAC-SHA512 and 2,048 iterations, with the string “mnemonic” plus an optional passphrase as the salt, and gets a 512-bit seed. Text is normalised to Unicode NFKD first. Change the passphrase and you get a different seed and a different wallet: that is the BIP39 passphrase, sometimes called the 25th word.

From the seed, BIP32 describes “a system for deriving a tree of keypairs from a single seed”. BIP44 names the branches: m / purpose' / coin_type' / account' / change / address_index. The coin type comes from the registry in SLIP-0044, “the registered coin types for usage in level 2 of BIP44”. One phrase can therefore hold Bitcoin, Ethereum and other coins at once, each on its own branch. For Bitcoin’s four address types and their paths, see the Bitcoin sheet.

Why can the same phrase show different accounts in another wallet?

Because two apps can derive from the same seed along different paths. A wallet that scans native SegWit accounts will not show coins on legacy addresses; one that follows BIP44’s discovery rules stops after 20 unused addresses in a row (“Address gap limit is currently set to 20”). If a restore looks empty, check the address type, the account number and the passphrase before anything else.

Some software uses its own word format. Electrum’s documentation says “Electrum seed phrases include a version number” and “For these reasons, Electrum does not generate BIP39 seeds”, although its own code says “BIP39 seeds can be imported in Electrum”. An Electrum seed entered into a hardware wallet as if it were BIP39 will not restore the same wallet.

SLIP-39 Shamir shares are a different standard: SLIP-0039 uses its own 1,024-word list. See the SLIP-39 sheet.

Which hardware wallets use BIP39?

BIP39 by default (the table above gives each maker’s word counts): the five Ledger models, which create 24 words; the Trezor Model One and Model T (Trezor’s backup-format table lists BIP39 for the Model T, though its Single-share article conflicts; see below); Arculus, KeepKey, SafePal S1 Pro and X1, ELLIPAL Titan 2.0, Keystone 3 Pro, OneKey Pro, the COLDCARD Mk5 and Q and the Jade Plus.

BIP39 as an option (marked “Partial” in the table):

• Trezor Safe 3, Safe 5 and Safe 7: a 20-word SLIP-39 share is the default; 12 or 24 BIP39 words can be chosen at setup, and BIP39 phrases restore.
• BitBox02 Nova Multi: the standard setup backs up to the included microSD card. BitBox says its “recovery information follows the BIP39 standard”, but the file restores only on a BitBox02; the BIP39 words can be written down at setup or, in BitBox’s words, “display and record the recovery words on the BitBox02 later” (BitBox).
• Tangem Wallet and Tangem Ring: “By default, Tangem uses a seedless setup: no 12-word or 24-word recovery phrase is generated or written down” (Tangem). A BIP39 phrase can be generated or imported at setup.
• NGRAVE ZERO: “Since firmware v 1.5 you can only generate a wallet with the Perfect Key format” (NGRAVE), NGRAVE’s own backup; an equivalent 24-word phrase can be displayed afterwards, and BIP39 phrases import.
• Passport Prime: Magic Backups on NFC Keycards and in Envoy are the default; BIP39 seed words are available under advanced backups.

No BIP39: Bitkey, whose 2-of-3 multisig design recovers without a seed phrase.

Is a 12-word BIP39 phrase secure enough?

Trezor puts a 12-word phrase at 128-bit security, “2¹²⁸ possible combinations”, and 24 words at 256-bit, and says “All backup formats are extremely secure.” Guessing a properly generated phrase is not the practical risk. The practical risks are a phrase someone else sees, one typed into a website or app, and one chosen by hand. Trezor’s web-app guide says: “Enter your backup words only on your Trezor device, never in a browser or app.” Open-source BIP39 tools such as Ian Coleman’s offer a standalone offline version; a phrase that protects real funds should still never be typed into a computer.

The device PIN is not part of any of this. Trezor’s PIN guide: “Your PIN is independent of your wallet backup”. A restored wallet gets a new PIN; a forgotten PIN does not lose funds if you hold the phrase (and passphrase, if set).

What we could not verify

• Tangem: its pages disagree on which word counts the app generates (12 or 24, or all five lengths), and on where the entropy comes from: its entropy article says “the Tangem app generates the mnemonic on the phone”, while its BIP39 glossary describes entropy generated inside the card.
• SafePal: the restore lengths the S1 Pro and X1 accept.
• Trezor Model T default: Trezor’s backup-format table lists a 12-word BIP39 phrase, while its Single-share article says a 20-word SLIP-39 share became the Model T default in June 2024.
• Passport Prime: the word counts it creates and restores.