- Home
- / How BIP39 Works
How BIP39 Works: From Entropy to Words
Watch random bits become a seed phrase: the entropy, its SHA-256 checksum, the 11-bit groups and the words they point to. Start from the official test vector or make new test entropy.
For learning only: never enter the entropy or words of a real wallet here.
Step 1. Entropy
128 random bits, shown in groups of 11. The last group is still short: the checksum completes it.
00000000000000000000000000000000
00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000····
Step 2. Checksum
SHA-256 of the entropy. Its first 4 bits become the checksum and are appended to the entropy.
- SHA-256
- 374708fff7719dd5979ec875d56cd2286f6d3cf7ec317a3b25632aab28ec37bb
- Checksum (4 bits)
- 0011
Step 3. Groups of 11 bits
Each group is a number from 0 to 2047, the index of a word in the list. Hover or tap a group to see its bits above.
Step 4. The phrase
The words in order are the mnemonic. Wallets then hash it with PBKDF2 into the seed.
abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about
Test phrase: never send funds to it.
See its seed and keys in the converterCheck a phrase in the checksum checker
The four steps of BIP39
The BIP39 specification turns a random number into words in four steps, the same in every compliant wallet:
- Entropy. The wallet draws 128 to 256 random bits, in steps of 32. This number, ENT, is the whole secret.
- Checksum. It hashes the entropy with SHA-256 and keeps the first ENT/32 bits of the hash, CS. For 128 bits of entropy that is 4 bits.
- Groups. It appends the checksum to the entropy and cuts the result into groups of 11 bits. Each group is a number from 0 to 2047.
- Words. Each number is an index into the list of 2048 words, counted from 0. The words in order are the mnemonic.
| Words | Entropy (ENT) | Checksum (CS) | Total bits |
|---|---|---|---|
| 12 | 128 bits | 4 bits | 132 = 12 × 11 |
| 15 | 160 bits | 5 bits | 165 = 15 × 11 |
| 18 | 192 bits | 6 bits | 198 = 18 × 11 |
| 21 | 224 bits | 7 bits | 231 = 21 × 11 |
| 24 | 256 bits | 8 bits | 264 = 24 × 11 |
Why the last word is special
The checksum always lands at the end, inside the last word. In a 12-word phrase the last word holds 7 bits of entropy and the 4 checksum bits, so once the first 11 words are fixed, only 128 of the 2048 words can end the phrase. In the test vector above, SHA-256 of 16 zero bytes begins with 0x37, binary 0011 0111, so the checksum is 0011 and the last index is 3: about. The last word calculator lists every valid ending for a test prefix, and the checksum checker runs the same test on a whole phrase.
From words to seed
The words are not used as a key directly. A wallet runs the mnemonic through PBKDF2-HMAC-SHA512 with 2048 iterations, with the text mnemonic plus an optional passphrase as the salt, and gets a 512-bit seed. BIP32 turns that seed into a master key, and the derivation path picks the keys for each account and address. The mnemonic code converter shows every one of those values for a test phrase.
Test vectors to try
BIP39 links to official test vectors in python-mnemonic, its reference implementation. Paste the entropy of any of these into the tool above; the words must match exactly. They are public, so never send funds to them.
| Entropy (hex) | Mnemonic |
|---|---|
| 00000000000000000000000000000000 | abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about |
| 7f7f7f7f7f7f7f7f7f7f7f7f7f7f7f7f | legal winner thank year wave sausage worth useful legal winner thank yellow |
| 80808080808080808080808080808080 | letter advice cage absurd amount doctor acoustic avoid letter advice cage above |
| ffffffffffffffffffffffffffffffff | zoo zoo zoo zoo zoo zoo zoo zoo zoo zoo zoo wrong |
| 0000…0000 (256 bits) | abandon × 23, then art |
Making entropy yourself is the risky part: people are poor random number generators. Our guide explains why you should never make up a seed phrase, and 12 vs 24 words compares the lengths.
How BIP39 Works — Frequently Asked Questions
Why does BIP39 use exactly 2048 words?
Because 2048 is 2 to the power of 11, so one word stores exactly 11 bits. Entropy plus checksum always comes to a multiple of 11 bits: 132 bits for 12 words, 264 for 24.
Is the checksum a security feature?
No. It only catches mistakes: a mistyped or swapped word usually breaks it, so wallets refuse the phrase instead of opening an empty wallet. It adds no secrecy, because anyone can compute it from the entropy.
Can I turn my own entropy into a phrase?
Technically yes, as the tool above shows, but only fair dice or coins give real randomness, and you would have to do it on an offline computer, never on a web page. For a real wallet, let a hardware wallet or a wallet app create the phrase.
Do other languages work the same way?
Yes. The bits and the indexes are identical; only the list of 2048 words differs. Index 0 is abandon in English and ábaco in Spanish, so the same entropy gives a different phrase, and a different seed, in each language.
Guides
- What Is BIP39? The Standard Behind Seed Phrases
BIP39 turns random entropy into a 12 to 24 word mnemonic phrase that generates your wallet's private keys, the standard for crypto wallet recovery.
- 12 vs 24 Word Seed Phrase: Which Is More Secure?
12 vs 24 word seed phrase: entropy and checksum bits, why both beat brute force, when 24 words help, wallet defaults and which length to choose.
- Why You Should Never Create Your Own Seed Phrase
Manually creating your own seed phrase undermines security since human-picked words lack true randomness; use proper BIP39 generation instead.