Electrum Seed vs BIP39: Why Other Wallets Reject It

An Electrum seed is not a BIP39 phrase, even though new ones use words from the same 2048-word English list. Since version 2.0, Electrum checks a phrase with a hash-based version number instead of the BIP39 checksum and derives keys with a different salt and its own paths. Since 4.1.3, it also discards new seeds that happen to pass the BIP39 checksum. Wallets that check that checksum reject the phrase, and an older Electrum seed that slips through opens an empty wallet. This guide covers the format, a worked example, how to recognize each type, where it restores and how to move funds. For the standard itself, see what BIP39 is.

How an Electrum Seed Differs From BIP39

Electrum documents its format as the Seed Version System. The phrase is normalized (lowercased, with accents and extra spaces removed) and hashed with HMAC-SHA512, keyed with the string Seed version. The hex result must start with a registered prefix, which names the wallet type and doubles as the integrity check. Keys then come from PBKDF2-HMAC-SHA512 with 2048 rounds and the salt electrum plus the optional seed extension, as Electrum's mnemonic.py shows.

BIP39 appends a checksum taken from the SHA-256 hash of the entropy instead, 4 bits for 12 words (the BIP39 checksum checker shows it with test phrases), and uses the salt mnemonic plus the passphrase. Electrum's documentation objects that this checksum ties a phrase to a fixed word list and that a BIP39 phrase records no version, so future software has to guess how its keys were derived. Electrum's hash works on the text itself, so it needs no word list. BIP39's own text now lists the missing version among its shortcomings and says descriptor wallets largely mitigate it.

Why New Electrum Seeds Fail the BIP39 Checksum

With a 4-bit checksum, about 1 in 16 random 12-word phrases pass BIP39's check, and Electrum's developers gave the same odds for their own seeds in pull request #6001. Since version 4.1.3 (June 2021), Electrum's seed generator skips every candidate with a valid BIP39 checksum, according to its release notes, so every new Electrum seed fails that check. Twelve-word seeds from Electrum 2.7 to 4.1.2 pass it about 1 time in 16, and a BIP39 app then opens an empty wallet without any error. The 13-word seeds of Electrum 2.0 to 2.6 never pass, because BIP39 has no 13-word length.

Electrum Seed Versions

Electrum's version.py defines four prefixes. The first hex digit sets the prefix length: 0 means two digits, 1 means three.

Electrum 2.7 changed how 2FA keys are derived but kept the prefix, so Electrum tells older and newer 2FA seeds apart by length: 12 words since 2.7, more before it. Since 4.1.0 (March 2021), the wizard no longer asks for a seed type and creates segwit wallets.

Old Seeds From Electrum 1.x

Electrum 1.x seeds encode 128 bits in 12 words from Electrum's own list of 1,626 words, taken from a frequency list of words in contemporary poetry, with no checksum or version. Electrum recognizes an old seed when all 12 or 24 words are on that list. By our count, 861 of them are also BIP39 words, but words such as powerful, nobody and look are not in the BIP39 word list and give an old seed away. Old seeds take no seed extension, and their addresses start with 1.

Worked Example: Electrum's Public Test Seeds

Electrum's test suite, test_wallet_vertical.py, restores wallets from published example seeds and checks their addresses. Here is its segwit seed run through the formula. These phrases are public test data: never send funds to them.

phrase       bitter grass shiver impose acquire brush forget axis eager alone wine silver
HMAC-SHA512  key "Seed version"            100400bacf13fe2e…  -> prefix 100: segwit
BIP39        checksum                      invalid
PBKDF2       salt "electrum", 2048 rounds  8ff3b1fa35d0bace…
m/0'         account key                   zpub6nsHdRuY92FsMKdbn9BfjBCG6X8pyhCibNP6uDvpnw2cyrVhecvHRMa3Ne8kdJZxjxgwnpbHLkcR4bfnhHy6auHPJyDTQ3kianeuVLdkCYQ
m/0'/0/0     first receiving address       bc1q3g5tmkmlvxryhh843v4dz026avatc0zzr6h3af
m/0'/1/0     first change address          bc1qdy94n2q5qcp0kg7v9yzwe6wvfkhnvyzje7nx2p

The zpub and both addresses match Electrum's test; we derived them again with the @noble/hashes, @scure/bip32 and @scure/btc-signer libraries. The version check in Node.js, for test phrases only:

const { createHmac } = require('node:crypto');
const phrase = 'bitter grass shiver impose acquire brush forget axis eager alone wine silver';
console.log(createHmac('sha512', 'Seed version').update(phrase).digest('hex').slice(0, 3)); // 100

Other test phrases from the same file:

Under BIP39 rules, the segwit test seed gives an unrelated wallet. If you choose BIP39 seed in Electrum's options and type it, Electrum shows BIP39 checksum failed but lets you continue, and on the default path m/84'/0'/0' the first address is bc1qdlgh4gp7rsty5vt49alv9can6jalz37z0sy7t3.

How to Recognize Each Type

• Ask Electrum. In the restore wizard, with the seed type left on Electrum, a label under the words shows Seed Type: segwit, standard, old, 2fa or 2fa_segwit. No label and a grayed-out Next button mean the words are not a valid Electrum seed or contain a typo. In an open wallet, Wallet → Information shows the type next to Seed available.
• Count the words. BIP39 has no 13-word phrases, while Electrum 2.0 to 2.6 drew 136 random bits for each standard seed, so about 15 in 16 of those seeds have 13 words. A 13-word Bitcoin backup therefore points to an Electrum seed from that era.
• Check the words. A correctly spelled word missing from the BIP39 list, such as nobody, points to an old Electrum 1.x seed.
• Remember where it was made. A phrase from Electrum, or from Cake Wallet's Electrum seed type, is an Electrum seed even if it passes BIP39's checksum, as 12-word Electrum seeds made before 4.1.3 do about 1 time in 16. Cake Wallet's Electrum seeds have 24 words, the same length as a long BIP39 phrase.

Never paste a real phrase into a website for these checks, including this site's tools, which are for public test phrases only.

Where Each Seed Restores

Checked against each project's documentation or code in October 2026:

BlueWallet asks for the seed extension if you turn on Import with a passphrase in the ⋯ menu of its import screen. Cake Wallet's restore code accepts an Electrum seed only if it has the segwit prefix. SeedSigner keeps Electrum seeds on Electrum's own paths and disables SeedQR backups and BIP-85 for them. Sparrow's tooltip suggests importing the Electrum wallet file instead.

How to Restore an Electrum Seed in Electrum

Steps for Electrum 4.8.2, the current version, on the desktop:

1. Start the wizard. It opens on first launch; otherwise choose File → New/Restore, name the wallet file and click Next.
2. Choose the wallet type. Standard wallet takes old, standard and segwit seeds; Wallet with two-factor authentication takes 2FA seeds. If you pick the wrong one, Electrum names the seed type it found and suggests the other wallet type.
3. Choose I already have a seed and type the words, leaving the seed type on Electrum. Check that the label shows the type you expect.
4. Add the seed extension, if you set one. Click Options, tick Extend this seed with custom words and type the extension on the next screen.
5. For a 2FA seed, choose Keep or Disable. Disable stores two of the three master private keys in the wallet, so you can spend without TrustedCoin's server.
6. Set a password. It encrypts the wallet file and is not part of the seed.

Electrum skips the derivation path screen for its own seeds, because the prefix says which paths to use. On Android, choose Electrum under Seed Type. For installation and other features, see our Electrum wallet overview.

How to Restore a BIP39 Phrase in Electrum

The same wizard imports BIP39 phrases from other wallets: choose Standard wallet and I already have a seed, click Options, select BIP39 seed and tick the extension box if the wallet had a passphrase. Unlike its own seeds, a BIP39 phrase then needs a script type and derivation path: Detect Existing Accounts scans for used accounts, or you pick legacy (p2pkh) at m/44'/0'/0', p2sh-segwit (p2wpkh-p2sh) at m/49'/0'/0' or native segwit (p2wpkh) at m/84'/0'/0', the default. The step-by-step version for Electrum and other wallets is in how to restore a wallet from a seed phrase, and the paths are explained in derivation paths. What changes compared with an Electrum seed:

• A typo does not stop you. Electrum shows BIP39 checksum failed, or Unknown BIP39 wordlist for a word that is not on the list, but still lets you continue into a different, empty wallet, so check every word.
• No Taproot. The script types end at native segwit, so a BIP86 wallet does not restore.
• No promise of future support. Electrum warns that it imports BIP39 phrases so that you can reach funds from other wallets but does not generate them, because they do not meet its safety standard. It adds that their missing version number compromises compatibility with future software and that "We do not guarantee that BIP39 imports will always be supported in Electrum."
• No recoverable Lightning channels. These exist only in wallets with an Electrum seed, so a BIP39 wallet needs a fresh wallet-file backup after each new channel.

Seed Extension vs BIP39 Passphrase

Both are optional extra words that open a different wallet when they change, and Electrum uses one checkbox for both, but they are treated differently:

A forgotten capital letter therefore does not lock you out of an Electrum-seed wallet, but it does in any BIP39 wallet, Electrum's BIP39 mode included. Neither is the wallet password, which only encrypts the file on your computer.

Moving From an Electrum Seed to a BIP39 Wallet

There is no conversion. Both formats feed the words themselves into PBKDF2 with different salts, then follow different paths: the same 12 words lead to bc1q3g5t… in Electrum and to bc1qdlgh… under BIP39 rules. Working backwards is not possible either, since the BIP39 text itself notes that its conversion is one-way and an existing BIP32 seed cannot be expressed as a BIP39 sentence. Moving means sending the coins:

1. Open the Electrum wallet in Electrum, restoring it if needed, and let it sync.
2. Create the new wallet in the app or device you are moving to, and write down and check its new BIP39 phrase.
3. Send a small test amount to the new wallet and wait for it to arrive.
4. Send the rest. In the Send tab, paste the address and click Max. Close any Lightning channels first, so those funds are back on-chain.
5. Keep the old seed until the Electrum wallet is empty and nobody will pay to its old addresses.

To open the same wallet in Sparrow instead, import the Electrum wallet file with File → Import Wallet. Sparrow's Electrum importer reads wallet files made from standard and segwit seeds but rejects 2FA wallets, and the backup is still the Electrum seed.

Frequently Asked Questions

Can I convert an Electrum seed into a BIP39 phrase?

No. With different salts and paths, no BIP39 phrase opens the same wallet. Create a new BIP39 wallet and send the funds to it.

Why does my wallet say my Electrum seed is invalid?

It checks the BIP39 checksum, which every Electrum seed made since version 4.1.3 fails on purpose and most older ones fail by chance; a 13-word seed also has a length BIP39 does not allow. Restore the phrase in Electrum or another wallet from the table above. If Electrum rejects it too, look for a typo or swapped words with our guide on how to fix seed phrase errors.

Is an Electrum seed less secure than a BIP39 phrase?

Not in practice. Electrum's documentation counts 132 bits of entropy for a 12-word seed, against 128 bits plus a 4-bit checksum for 12 BIP39 words, but it also notes that the version prefix weakens key stretching: an attacker can discard most wrong guesses after one quick hash, without running PBKDF2. Either format is far beyond brute force; the real difference is compatibility, since fewer wallets restore Electrum seeds.