September 25, 2026
How BIP-39 Seed Phrases Work
Almost every Bitcoin (and most other crypto) wallet backs itself up with a phrase of common English words — 12, 15, 18, 21, or 24 of them. It looks simple, but that phrase is a carefully designed encoding of real cryptographic data. Understanding what's actually inside it makes every other recovery topic — missing words, wrong derivation paths, passphrases — much easier to reason about.
It starts with random entropy
A wallet begins by generating a block of random data, called entropy. The size of that block determines the length of your phrase:
| Entropy | Checksum | Total bits | Words |
|---|---|---|---|
| 128 bits | 4 bits | 132 | 12 |
| 160 bits | 5 bits | 165 | 15 |
| 192 bits | 6 bits | 198 | 18 |
| 224 bits | 7 bits | 231 | 21 |
| 256 bits | 8 bits | 264 | 24 |
Notice the pattern: the checksum is always exactly entropy bits ÷ 32, and the total is always divisible by 11 — because each word in the final phrase represents exactly 11 bits.
The checksum is what makes the wordlist forgiving
The checksum isn't decorative. It's the first few bits of the SHA-256 hash of the entropy, tacked onto the end before the whole thing is split into 11-bit chunks and mapped to words from a fixed, publicly published list of 2,048 words.
That's also why a random string of 12 real BIP-39 words almost never forms a "valid" mnemonic — only 1 in 16 arbitrary 12-word combinations will happen to satisfy the checksum. This is the exact property that makes recovering a single missing or mistyped word tractable: you're not searching 2,048 possibilities, you're searching the roughly 1-in-16 (or 1-in-256, for 24 words) that pass.
The wordlist itself is designed to be forgiving of transcription: every word is unambiguous from its first four letters, which is why many wallets only ask you to type the first few letters and then offer autocomplete.
From phrase to seed: PBKDF2
The words themselves are never used directly as a key. Instead, the full phrase (normalized as text) is run through PBKDF2-HMAC-SHA512 — a deliberately slow key-derivation function — for 2,048 rounds, using the literal string "mnemonic" plus an optional passphrase as the salt. The output is a 512-bit seed.
That "optional passphrase" is worth pausing on. It's sometimes called a "25th word," but it isn't a word from the wordlist at all — it can be any text you choose, or nothing. If you used one and later forget it, the situation is fundamentally different from a forgotten wordlist word: there's no checksum, no small search space, and no wordlist to constrain guesses. A passphrase with any real entropy behind it generally can't be brute-forced. This is the one part of the system with essentially no recovery shortcut — which is exactly why it's optional, and why most wallets warn you heavily before you set one.
From seed to an entire tree of addresses
The 512-bit seed feeds into BIP-32, which turns it into a hierarchical deterministic (HD) wallet: a tree of keys that can generate a practically unlimited number of addresses, all reproducible from that one seed, without ever needing to back up each individual address's key.
Where in that tree your actual addresses live is defined by a derivation path — a short sequence of numbers standardized by later BIPs:
- BIP-44 (
m/44'/...) — legacy addresses (starting with1) - BIP-49 (
m/49'/...) — nested SegWit addresses (starting with3) - BIP-84 (
m/84'/...) — native SegWit addresses (starting withbc1q) - BIP-86 (
m/86'/...) — Taproot addresses (starting withbc1p)
This is why the exact same, correctly-recovered mnemonic can appear to show a completely empty wallet: if your wallet software derives along BIP-84 by default but your funds were originally created along BIP-44, you're looking at the wrong branch of the same tree, not a lost wallet. Trying the standard paths systematically against a known address is a normal, expected part of recovery in this situation — see our guide on derivation-path discovery for how that search works in practice.
Why this design matters for recovery
Put together, a BIP-39 phrase is: random entropy, sized to your word count, with a checksum appended, mapped to a human-typeable wordlist, stretched through a slow hash into a seed, and expanded into a full tree of keys along a standardized path.
Every practical recovery scenario maps onto one part of this chain:
- A missing or wrong word → the entropy/checksum layer. Recoverable via search, because the checksum narrows the space dramatically.
- The wrong address showing up → the derivation-path layer. Recoverable by trying the standard paths.
- A forgotten passphrase → the seed-derivation layer. Not realistically recoverable by search if the passphrase had real entropy — there's no equivalent of the checksum trick here.
Knowing which layer your problem sits in is the fastest way to know whether you're dealing with an afternoon's work or a dead end.