BIP85: Derive Many Seed Phrases From One Seed

BIP85 lets one master seed produce any number of independent child seed phrases. You choose a number, the index, and a BIP85 wallet turns your master key into a new BIP39 phrase, usually of 12 or 24 words, that any BIP39 wallet can restore. The same master and index always give the same child back, so one backup covers them all, and a child that leaks exposes neither the master nor the other children. The standard, Deterministic Entropy From BIP32 Keychains, also derives WIF keys, xprvs, hex, passwords, RSA keys, dice rolls and Nostr keys. This guide covers how the derivation works, every application and its path, the official test vector reproduced in Node, wallet support and when BIP85 is the wrong tool. New to seed phrases? Start with what BIP39 is.

How BIP85 Works

BIP85 starts from a BIP32 master key, however that key was made, from a BIP39 phrase or another scheme. Each child takes four steps:

1. Choose a path. It is fully hardened and starts with m/83696968', followed by the application number, its parameters and the index. 83, 69, 69 and 68 are the ASCII codes of S, E, E and D, so the first level after m spells SEED.
2. Derive the key. Ordinary BIP32 hardened derivation gives the 32-byte private key k at that path.
3. Hash it. HMAC-SHA512, keyed with bip-entropy-from-k, turns k into 64 bytes of entropy.
4. Keep what the application needs. Each application uses as many bytes as it needs and truncates the rest: a 12-word phrase keeps the first 16 bytes, a 24-word phrase the first 32.

k       = private key at m/83696968'/{app}'/{parameters}'/{index}'
entropy = HMAC-SHA512(key = "bip-entropy-from-k", msg = k)

The BIP85 specification adds the HMAC step out of caution: hardened derivation already keeps a leaked child key from exposing the parent tree, and the HMAC keeps the output safe even if an implementation skipped the hardening. Both steps are one-way, so a child phrase leads back neither to k, nor to the master key, nor to the siblings at other indexes.

Every level of the derivation path changes the result, including language and word count. The 12-word and 24-word children at index 0 are unrelated phrases, not a short and a long version of one.

BIP85 Applications and Path Numbers

Version 2.1.0 of the spec, from August 2026, defines these applications. Their numbers are meant to be meaningful: 39’ and 32’ are BIP numbers, and 828365 spells RSA in ASCII codes.

The spec fills in the details:

• Languages follow the BIP39 word lists: 0’ English, 1’ Japanese, 2’ Korean, 3’ Spanish, 4’ Chinese (Simplified), 5’ Chinese (Traditional), 6’ French, 7’ Italian, 8’ Czech, 9’ Portuguese. The words code is the word count, from 12’ (128 bits) to 24’ (256 bits).
• XPRV takes the first 32 bytes as the chain code and the second 32 as the private key, the reverse of BIP32’s order, and the spec warns about it. The output is a root-level xprv (a tprv for a testnet master), the private counterpart of an xpub; see our guide to xpub, ypub and zpub.
• RSA and DICE can need more than 64 bytes, so they use the entropy to seed BIP85-DRNG, a SHAKE256 stream. A 62-sided die gives alphanumeric passwords.
• Nostr, added in 2.1.0, reserves identity 0’ and account 0’ for future key management, so usable keys start at 1’.

BIP85 is an Informational BIP by Ethan Kosakovsky, numbered in March 2020, with Aneesh Karve as co-author since October 2024. It was marked Final that October and became Deployed in January 2026, after BIP3, the updated BIP process, merged Final and Active into that status. A Deployed BIP is considered final, and changes beyond bug fixes, minor amendments, added test vectors and editorial edits should be avoided. Version 2.1.0 added Nostr without changing any earlier path or output.

The BIP39 Test Vector, Reproduced in Node

The spec publishes a master key with expected outputs for every application except RSA. The key is public, so never use it for funds. This script derives the 12-word English child at index 0 with @scure/bip32 1.7, @scure/bip39 1.6 and @noble/hashes 1.8:

import { HDKey } from '@scure/bip32';
import { entropyToMnemonic } from '@scure/bip39';
import { wordlist } from '@scure/bip39/wordlists/english';
import { hmac } from '@noble/hashes/hmac';
import { sha512 } from '@noble/hashes/sha2';
import { bytesToHex, utf8ToBytes } from '@noble/hashes/utils';

// Master key of the BIP85 test vectors (public: never use it for funds)
const root = HDKey.fromExtendedKey(
  'xprv9s21ZrQH143K2LBWUUQRFXhucrQqBpKdRRxNVq2zBqsx8HVqFk2uYo8kmbaLLHRdqtQpUm98uKfu3vca1LqdGhUtyoFnCNkfmXRyPXLjbKb'
);

const k = root.derive("m/83696968'/39'/0'/12'/0'").privateKey;
const entropy = hmac(sha512, utf8ToBytes('bip-entropy-from-k'), k).slice(0, 16);

console.log(bytesToHex(entropy));
console.log(entropyToMnemonic(entropy, wordlist));

With version 2 of these libraries, the current npm release, the same functions are exported only under paths ending in .js, so add .js to the four subpath imports, as in @noble/hashes/hmac.js. Either way, the script prints:

6250b68daf746d12a24d58b4787a714b
girl mad pet galaxy egg matter matrix prison refuse sense ordinary nose

Both lines match the spec. Set the words level to 18' and keep 24 bytes, or to 24' and keep 32, and the script returns the spec’s 18- and 24-word vectors, which begin “near account window” and “puppy ocean match”. We checked every other vector in the spec the same way, from the raw test cases and the DRNG to WIF, XPRV, HEX, both password formats, dice and Nostr, and all matched. One trap if you try it: the XPRV vector’s DERIVED ENTROPY line shows only the second 32 bytes, the private key, not the chain code. The entropy becomes words like any BIP39 entropy, with a checksum appended; the seed phrase generator shows random test phrases next to their entropy.

Children of the Public Test Phrase

Started from the seed of the public BIP39 test phrase (abandon abandon … about) instead of the spec’s key, the same derivation gives these children. They are public too, so never send funds to them:

These are not official vectors: we computed them with the same libraries and confirmed them with an independent implementation that uses only Python’s standard library. Index 1 bears no visible relation to index 0. And because a BIP39 passphrase changes the master key, the same words with TREZOR, the passphrase of the official BIP39 test vectors, give different children.

Which Wallets Support BIP85

Any BIP39 wallet can restore a child, but deriving one takes a wallet that implements BIP85. These document the feature as of October 2026:

BitBox02 added the feature in firmware 9.18.0 (April 2024), Jade in 0.1.45 (February 2023), SeedSigner in 0.6.0 (February 2023) and Krux in 24.07.0 (July 2024), so update first if the menu is missing. Two details differ between wallets:

• Index range. COLDCARD accepts 0 to 9999 unless you allow larger numbers in its Danger Zone menu. SeedSigner and BitBox02 accept up to 2,147,483,647 (2^31 − 1), the largest hardened index.
• Passphrase. COLDCARD treats the active passphrase as part of the recovery context, BitBox notes that a missing or different passphrase produces a different child, and Jade derives the child from the active wallet, passphrase included, so the same wallet must be loaded to show it again. Krux drops the parent’s passphrase when it loads a child.

Benefits and Risks

What BIP85 gives you:

• One backup for many wallets. The parent re-creates every child. AirGap Vault’s guide says a child needs no backup of its own, and COLDCARD asks you to keep the recovery context, such as format, index and passphrase, with the parent backup.
• Isolation. A phone wallet, a Lightning node or a test wallet gets its own phrase. Blockstream notes that an attacker who compromises a child still cannot learn the parent phrase.
• Compatibility. The child works in wallets that know nothing about BIP85.
• Regenerated secrets. Passwords, PINs and GPG keys can be derived again instead of stored.

What it costs:

• The master unlocks everything. COLDCARD’s guide puts it plainly: anyone who obtains the parent wallet and its derivation context can reproduce every child below it.
• No new randomness. A child is only as strong as its master. COLDCARD’s security status page describes a July 2026 incident in which a firmware bug weakened seed generation and notes that fixed firmware does not repair a seed already affected; its BIP-85 page now asks users to create the parent on fixed firmware before deriving children. Children computed from a weak master are exactly as weak.
• Lost context. Re-creating a child needs the application, language, word count, index and any passphrase. A forgotten index means searching through numbers.
• Tool dependence. Re-deriving requires a BIP85 implementation. Several exist, but a child holding real money may deserve its own written backup too.

When to Use BIP85 and When Not

If you use it, the master seed becomes your most valuable secret: protect it as described in how to store a seed phrase, and note each child’s index, word count and passphrase status next to its purpose.

Frequently Asked Questions

Is a BIP85 child seed a normal seed phrase?

Yes. It is a standard BIP39 phrase with a valid checksum, and a wallet that restores it cannot tell that it was derived.

Can someone with a child phrase find my master seed?

No. Hardened derivation and HMAC-SHA512 cannot be reversed, so a child reveals neither the master nor the other children. The reverse does not hold: the master re-creates every child.

Do I need to back up each child phrase?

Not strictly: the master backup and the derivation details re-create any child, which is why COLDCARD and Jade ask you to keep track of the index. A separate backup of an important child removes the dependence on a BIP85 tool.

Does a BIP39 passphrase change BIP85 children?

Yes. The passphrase goes into the BIP39 seed and so changes the master key: the same words with and without it give different children, as the test phrase table shows.

How is a BIP85 child different from a second account?

A second account, such as m/44'/0'/1' in the BIP44 scheme, is another branch of the same seed and restores only with the original phrase. A BIP85 child is a separate seed phrase that you can load into another wallet on its own.