--- title: "What Is BIP39? The Standard Behind Seed Phrases" url: "https://bip39-phrase.com/bip39-the-foundation-of-crypto-wallet-security/" language: "en" published: "2025-03-30T00:00:00+00:00" updated: "2026-10-19T00:00:00+00:00" --- [ BIP Standards ](/topics/bip-standards/) Published March 30, 2025 Updated October 19, 2026 # What Is BIP39? The Standard Behind Seed Phrases ![What Is BIP39? The Standard Behind Seed Phrases](/wp-content/uploads/2025/03/bip39-hero.webp) BIP39 (Bitcoin Improvement Proposal 39) is the standard that defines seed phrases: it turns a wallet’s random secret into 12 to 24 words from a fixed list of 2,048 and turns those words back into the seed from which every key in the wallet is derived. Marek Palatinus, Pavol Rusnak, Aaron Voisine and Sean Bowe wrote it in 2013, and most software and hardware wallets now use it for their backups. ## BIP39 at a Glance | Question | Answer | | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Full name | Mnemonic code for generating deterministic keys ([specification](https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki)) | | Authors and date | Marek Palatinus, Pavol Rusnak, Aaron Voisine and Sean Bowe; number assigned September 10, 2013 | | Status | Deployed, Specification BIP | | Phrase lengths | 12, 15, 18, 21 or 24 words: 128 to 256 bits of entropy plus a 4- to 8-bit checksum | | Word lists | 2,048 words in each of 10 [official languages](https://github.com/bitcoin/bips/blob/master/bip-0039/bip-0039-wordlists.md); most wallets support only English | | Seed | 512 bits from PBKDF2-HMAC-SHA512 with 2,048 iterations, with an optional passphrase | | What comes next | BIP32 derives the keys from the seed; BIP44 and its successors choose the paths | ## Why Does BIP39 Matter? Before BIP39, most wallets were backed up as files of raw keys, and the few word-based schemes, such as Electrum’s, worked only in their own wallet. The specification’s stated goal is to carry computer-generated randomness in a form people can write on paper or read out over the telephone. The phrase ultimately generates the private keys that control access to cryptocurrency funds on the blockchain, functioning essentially as the master password to your digital wealth. A 12-word phrase holds 128 bits of [entropy](/can-you-guess-a-seed-phrase-probability-and-real-risks/) and a 24-word phrase 256 bits, both far beyond the reach of any brute-force search with today’s computers. The weak points are elsewhere: how the words were generated and how they are stored. Because the format is standardized, a phrase created in one BIP39 wallet can be restored in another, so your backup is not tied to a single vendor. That portability is a large part of how BIP39 balances security with accessibility. ## Inside BIP39: Entropy, Checksum and Words The BIP39 process involves several key steps that transform random data into a recoverable seed for generating crypto wallet keys: - **Entropy generation:** The process begins with creating random data (entropy) — typically 128 to 256 bits depending on the desired mnemonic length. ![BIP39 pipeline on the official test vector: 128 zero bits of entropy, a SHA-256 hash starting with 0x37, the checksum 0011, twelve 11-bit groups and the words abandon ×11 and about.](/images/diagrams/bip39-entropy-to-words.webp) From entropy to words: the first 4 bits of SHA-256(entropy) are the checksum (0011), and the 132 bits, cut into 11-bit groups, pick the words “abandon” ×11 + “about”. - **Checksum creation:** A checksum is generated from this entropy using SHA-256 hashing, which helps verify the mnemonic’s integrity later. - **Word mapping:** The combined entropy and checksum bits are split into groups of 11 bits, with each group corresponding to a specific word from the BIP39 wordlist. - **Mnemonic formation:** These mapped words form the mnemonic phrase that users write down and store. - **Seed derivation:** When recovery is needed, the mnemonic phrase is processed through PBKDF2 (with HMAC-SHA512) to generate a 512-bit seed, which can optionally include a passphrase for added security. This guide focuses on what BIP39 is and why it matters, so the list above is only an outline. Our interactive walkthrough shows [how BIP39 works step by step](/how-bip39-works/), from the random entropy and its SHA-256 checksum to the word each 11-bit group points to. The conversion between binary data and human-readable words is what makes BIP39 particularly practical. As the [official BIP39 specification](https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki) describes, the wordlist is carefully constructed to minimize the possibility of mistakes: it is enough to type the first four letters to identify a word unambiguously, and near-identical pairs such as “build” and “built” were left out. The first feature is particularly important for [hardware wallet](/hardware-wallets-explained/) implementations where typing can be cumbersome. ## How Does BIP39 Work With Other Standards? BIP39 doesn’t exist in isolation — it’s part of a suite of BIPs that together define how modern cryptocurrency wallets function. BIP39 ends at the seed; the other standards take it from there: - **BIP32:** Defines [hierarchical deterministic wallets](/bip-32/), allowing every key and address to be derived from that single seed. - **BIP44:** Establishes the [account hierarchy](/bip-44-multi-account-hierarchy-for-deterministic-wallets/) for wallet structures, enabling support for multiple cryptocurrencies from a single seed; BIP49, BIP84 and BIP86 do the same for newer Bitcoin address types. - **BIP85:** A standard, Deployed since January 2026, for the [deterministic derivation of multiple BIP39 mnemonic seeds](/bip85/) from a master seed. Together, these standards let a single backup restore every account and address derived from the same seed, which is what makes this integrated approach both robust and practical. Our comparison of [BIP39, BIP32 and BIP44](/crypto-seed-standards-bip39-vs-bip32-vs-bip44/) shows how the layers fit. ### Which Wallets Use BIP39? Ledger, MetaMask, Trust Wallet, Exodus, Coinbase Wallet and Phantom use BIP39 recovery phrases. Trezor’s Model One and Model T create BIP39 phrases by default, while the Safe 5, the Safe 7 and Safe 3 devices set up since June 2024 default to SLIP-39 shares instead, according to [Trezor’s guide to its backups](https://trezor.io/learn/security-privacy/personal-security-standards/understanding-trezor-wallet-backups-12-20-or-24-words). Electrum creates its own seed format by default but can import BIP39 phrases (see [Electrum seed vs BIP39](/electrum-seed-vs-bip39/)). This wide adoption means you can usually move between wallet providers without losing access to your funds. The new wallet has to accept the same phrase length and passphrase and look on the same [derivation path](/derivation-path/); otherwise it opens an empty-looking wallet even though the words are right. ## How Safe Is a BIP39 Phrase? While BIP39 provides robust cryptographic security, its implementation in real-world scenarios introduces human factors that must be carefully managed: ### Physical Storage Solutions Handwritten paper records remain popular, but specialized metal backup solutions offer better protection against fire, water and corrosion. Products like Cryptosteel, Billfodl, or CryptoTag are made for long-term seed phrase storage; our [metal backup guide](/metal-seed-phrase-backup/) compares how such plates hold up in tests. ### Passphrase Implementation Adding a BIP39 passphrase (sometimes called a “25th word”) substantially increases security by creating a second factor that must be provided alongside the mnemonic: even if someone obtains your mnemonic phrase, they cannot access your funds without the passphrase. It also provides what the [BIP39 specification](https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki) calls “plausible deniability”: every passphrase generates a valid wallet, but only the correct one opens yours. You can keep a small decoy balance under one passphrase and reveal that one under duress, while your main funds stay behind another. The flip side is that a forgotten passphrase cannot be reset, so back it up as carefully as the words; our guide to the [BIP39 passphrase](/bip39-passphrase/) covers the details. ### Inheritance Planning Creating secure processes for [seed phrase inheritance](/crypto-inheritance/) presents unique challenges. Multi-signature setups, timelock contracts, and dead man’s switch mechanisms provide technical solutions, while legal frameworks like the Uniform Fiduciary Access to Digital Assets Act offer regulatory approaches. ### Critical Security Warnings - **Never store seed phrases digitally** (screenshots, cloud documents, email, or password managers) - **Never enter your seed phrase on websites** — legitimate wallet providers will never ask for this information - **Never share your mnemonic phrase** with anyone, including support personnel - **Verify recipient addresses** multiple times before confirming transactions ## What Are BIP39’s Limitations? The specification itself lists the known shortcomings of the format: - **The seed depends on the word list.** The words, not the entropy behind them, go into the seed, so the same entropy written with the Spanish list gives a different wallet. A phrase cannot be translated into another language. - **The conversion is one-way.** Any BIP39 phrase gives a BIP32 seed, but an arbitrary BIP32 seed cannot be written as a BIP39 phrase. - **The checksum is short.** It misses 1 random error in 256 with 24 words (8 checksum bits) and about 1 in 16 with 12 words (4 bits), and it cannot say which word is wrong. The [BIP39 checksum checker](/bip39-checksum-checker/) tests a phrase, and our guide to [fixing seed phrase errors](/how-to-fix-seed-phrase-errors/) covers finding the mistake. - **No version.** A phrase does not record which address type or path it was used with; descriptors (BIP380) now carry that information alongside the seed. Its authors later proposed [SLIP-39](/slip39-vs-bip39/) as the intended successor that addresses these points. One more limit is by design: the specification says BIP39 is a way to transport computer-generated randomness, not to turn sentences people make up (“brainwallets”) into a wallet seed. When researchers scanned the Bitcoin blockchain for such brain wallets, they found 884 in use between 2011 and 2015, and all but 21 had been drained, usually within 24 hours and often within minutes ([Vasek et al., Financial Cryptography 2016](https://discovery.ucl.ac.uk/id/eprint/10154816/1/vasekfc16.pdf)). ## What Builds on BIP39? The standard itself is settled, but several schemes build on it or around it: ### Shamir Secret Sharing [SLIP-39](https://github.com/satoshilabs/slips/blob/master/slip-0039.md), a separate standard from SatoshiLabs, uses Shamir’s Secret Sharing to split a wallet’s master secret into multiple shares, requiring a predefined threshold of shares to reconstruct it. It does not extend BIP39: it has its own 1,024-word list, and its shares [cannot be converted into a BIP39 phrase](/slip39-vs-bip39/), so moving to SLIP-39 normally means creating a new wallet and transferring your funds to it. This approach removes the single point of failure of one written phrase. ### Social Recovery Systems Smart contract-based wallets are increasingly implementing [social recovery](https://vitalik.eth.limo/general/2021/01/11/recovery.html) mechanisms, in which a majority of trusted contacts (“guardians”) can approve switching the wallet to a new signing key. This lets them collectively help [recover wallet](/recovery-seed-phrase-guide/) access without individually having complete control; the mechanism lives in the wallet’s smart contract, not in a BIP39 phrase. ### One Phrase, Many Networks The same BIP39 seed can hold coins on many networks, because each network gets its own branch of the key tree through a coin type number, and networks on the ed25519 curve use their own derivation, SLIP-10\. A few, such as Monero, use seed formats of their own; our overview of [seed phrase formats by network](/seed-phrase-formats-by-network/) lists the exceptions. ## Frequently Asked Questions ### Can I create my own BIP39 mnemonic phrase? While technically possible, self-created mnemonics often lack sufficient randomness. Cryptographically secure random number generators used by wallet software provide significantly stronger security than human-generated phrases, which tend to have unconscious patterns. Let the wallet generate the words instead; our guide to [creating a seed phrase safely](/create-a-seed-phrase/) walks through the process. ### If I lose my wallet device, can I recover my crypto with just the seed phrase? Yes, this is exactly what BIP39 was designed for. Your seed phrase can be used with any compatible wallet software or hardware to restore access to your funds, regardless of the original device used. If you added a passphrase, you need it too, and the new wallet must use the same derivation path; see [how to restore a wallet from a seed phrase](/restore-wallet-from-seed-phrase/). ### Does changing wallet software affect my seed phrase? No. The phrase stays the same, and so do the keys derived from it, because the keys, not the app, control your coins on the blockchain. You can use the same BIP39 mnemonic across different wallet applications as long as they support the BIP39 standard and the same derivation path. ### What happens if I lose part of my seed phrase? Partial recovery may be possible depending on how many words are missing. One missing word leaves at most 2,048 candidates, and only some of them pass the checksum, so recovery tools can test them all quickly. Every further missing word multiplies the work by 2,048, so recovery becomes impractical after a few words, and knowing the missing positions helps a great deal. A longer phrase does not change this much: the 8-bit checksum of a 24-word phrase filters out more wrong candidates than the 4-bit checksum of a 12-word one, but each missing word still adds 2,048 possibilities. ### Is BIP39 only for Bitcoin? No. Despite its name, BIP39 phrases back up wallets for Ethereum, Solana, TRON and many other networks, each deriving its own keys from the same seed. [ Back to Blog ](/blog/)