How BIP39 Works: From Entropy to Words
BIP39 turns 128–256 random bits into a seed phrase of 12–24 words: it appends a SHA-256 checksum, splits the bits into 11-bit groups and maps each group to one of 2048 words. Watch every step on the official test vector or on fresh random entropy.
Updated
Эта страница по-русски: Как работает BIP39: от энтропии к словам
Step 1. Entropy
128 random bits, shown in groups of 11. The last group is still short: the checksum completes it.
00000000000000000000000000000000
00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000····
Step 2. Checksum
SHA-256 of the entropy. Its first 4 bits become the checksum and are appended to the entropy.
- SHA-256
- 374708fff7719dd5979ec875d56cd2286f6d3cf7ec317a3b25632aab28ec37bb
- Checksum (4 bits)
- 0011
Step 3. Groups of 11 bits
Each group is a number from 0 to 2047, the index of a word in the list. Hover or tap a group to see its bits above.
Step 4. The phrase
The words in order are the mnemonic. Wallets then hash it with PBKDF2 into the seed.
abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about
Test phrase: never send funds to it.
See its seed and keys in the converterCheck a phrase in the checksum checker
The four steps of BIP39
The BIP39 specification turns a random number into words in four steps, the same in every compliant wallet:
- Entropy. The wallet draws 128 to 256 random bits, in steps of 32. This number, ENT, is the whole secret.
- Checksum. It hashes the entropy with SHA-256 and keeps the first ENT/32 bits of the hash, CS. For 128 bits of entropy that is 4 bits.
- Groups. It appends the checksum to the entropy and cuts the result into groups of 11 bits. Each group is a number from 0 to 2047.
- Words. Each number is an index into the list of 2048 words, counted from 0. The words in order are the mnemonic.
| Words | Entropy (ENT) | Checksum (CS) | Total bits |
|---|---|---|---|
| 12 | 128 bits | 4 bits | 132 = 12 × 11 |
| 15 | 160 bits | 5 bits | 165 = 15 × 11 |
| 18 | 192 bits | 6 bits | 198 = 18 × 11 |
| 21 | 224 bits | 7 bits | 231 = 21 × 11 |
| 24 | 256 bits | 8 bits | 264 = 24 × 11 |
Why the last word is special
The checksum always lands at the end, inside the last word. In a 12-word phrase the last word holds 7 bits of entropy and the 4 checksum bits, so once the first 11 words are fixed, only 128 of the 2048 words can end the phrase. In the test vector above, SHA-256 of 16 zero bytes begins with 0x37, binary 0011 0111, so the checksum is 0011 and the last index is 3: about. The last word calculator lists every valid ending for a test prefix, and the checksum checker runs the same test on a whole phrase.
From words to seed
The words are not used as a key directly. A wallet runs the mnemonic through PBKDF2-HMAC-SHA512 with 2048 iterations, with the text mnemonic plus an optional passphrase as the salt, and gets a 512-bit seed. BIP32 turns that seed into a master key, and the derivation path picks the keys for each account and address. The mnemonic code converter shows every one of those values for a test phrase.
Test vectors to try
BIP39 links to official test vectors in python-mnemonic, its reference implementation. Paste the entropy of any of these into the tool above; the words must match exactly. They are public, so never send funds to them.
| Entropy (hex) | Mnemonic |
|---|---|
| 00000000000000000000000000000000 | abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about |
| 7f7f7f7f7f7f7f7f7f7f7f7f7f7f7f7f | legal winner thank year wave sausage worth useful legal winner thank yellow |
| 80808080808080808080808080808080 | letter advice cage absurd amount doctor acoustic avoid letter advice cage above |
| ffffffffffffffffffffffffffffffff | zoo zoo zoo zoo zoo zoo zoo zoo zoo zoo zoo wrong |
| 0000…0000 (256 bits) | abandon × 23, then art |
Making entropy yourself is the risky part: people are poor random number generators. Our guide explains why you should never make up a seed phrase, and 12 vs 24 words compares the lengths.
How BIP39 Works — Frequently Asked Questions
Why does BIP39 use exactly 2048 words?
Because 2048 is 2 to the power of 11, so one word stores exactly 11 bits. Entropy plus checksum always comes to a multiple of 11 bits: 132 bits for 12 words, 264 for 24.
Is the checksum a security feature?
No. It only catches mistakes: a mistyped or swapped word usually breaks it, so wallets refuse the phrase instead of opening an empty wallet. It adds no secrecy, because anyone can compute it from the entropy.
Can I turn my own entropy into a phrase?
Technically yes, as the tool above shows, but only fair dice or coins give real randomness.
Do other languages work the same way?
Yes. The bits and the indexes are identical; only the list of 2048 words differs. Index 0 is abandon in English and ábaco in Spanish, so the same entropy gives a different phrase, and a different seed, in each language.
Guides
- What Is BIP39? The Standard Behind Seed Phrases
BIP39 turns random entropy into a 12 to 24 word mnemonic phrase that generates your wallet's private keys, the standard for crypto wallet recovery.
- 12 vs 24 Word Seed Phrase: Which Is More Secure?
A 24-word seed phrase has 256 bits of entropy and a 12-word one 128, but both are beyond brute force; 24 words help mainly when part of a backup is exposed.
- Why You Should Never Create Your Own Seed Phrase
Words you pick are far easier to guess than random ones; brain wallets made from invented phrases were usually drained within a day. Use a generator or dice.