--- title: "How BIP39 Works: Entropy, Checksum and Words, Step by Step" url: "https://bip39-phrase.com/how-bip39-works/" language: "en" updated: "2026-10-19T00:00:00+00:00" --- # How BIP39 Works: From Entropy to Words BIP39 turns 128–256 random bits into a seed phrase of 12–24 words: it appends a SHA-256 checksum, splits the bits into 11-bit groups and maps each group to one of 2048 words. Watch every step on the official test vector or on fresh random entropy. Updated October 19, 2026 Эта страница по-русски: [Как работает BIP39: от энтропии к словам](/ru/kak-rabotaet-bip39/) ## The four steps of BIP39 The [BIP39 specification](https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki) turns a random number into words in four steps, the same in every compliant wallet: 1. **Entropy.** The wallet draws 128 to 256 random bits, in steps of 32\. This number, ENT, is the whole secret. 2. **Checksum.** It hashes the entropy with SHA-256 and keeps the first ENT/32 bits of the hash, CS. For 128 bits of entropy that is 4 bits. 3. **Groups.** It appends the checksum to the entropy and cuts the result into groups of 11 bits. Each group is a number from 0 to 2047. 4. **Words.** Each number is an index into the [list of 2048 words](/), counted from 0\. The words in order are the mnemonic. | Words | Entropy (ENT) | Checksum (CS) | Total bits | | ----- | ------------- | ------------- | ------------- | | 12 | 128 bits | 4 bits | 132 = 12 × 11 | | 15 | 160 bits | 5 bits | 165 = 15 × 11 | | 18 | 192 bits | 6 bits | 198 = 18 × 11 | | 21 | 224 bits | 7 bits | 231 = 21 × 11 | | 24 | 256 bits | 8 bits | 264 = 24 × 11 | ![BIP39 pipeline on the official test vector: 128 zero bits of entropy, a SHA-256 hash starting with 0x37, the checksum 0011, twelve 11-bit groups and the words abandon ×11 and about.](/images/diagrams/bip39-entropy-to-words.webp) From entropy to words: the first 4 bits of SHA-256(entropy) are the checksum (0011), and the 132 bits, cut into 11-bit groups, pick the words “abandon” ×11 + “about”. ## Why the last word is special The checksum always lands at the end, inside the last word. In a 12-word phrase the last word holds 7 bits of entropy and the 4 checksum bits, so once the first 11 words are fixed, only 128 of the 2048 words can end the phrase. In the test vector above, SHA-256 of 16 zero bytes begins with 0x37, binary 0011 0111, so the checksum is 0011 and the last index is 3: _about_. The [last word calculator](/bip39-last-word-calculator/) lists every valid ending for a test prefix, and the [checksum checker](/bip39-checksum-checker/) runs the same test on a whole phrase. ## From words to seed The words are not used as a key directly. A wallet runs the mnemonic through PBKDF2-HMAC-SHA512 with 2048 iterations, with the text `mnemonic` plus an optional [passphrase](/bip39-passphrase/) as the salt, and gets a 512-bit seed. BIP32 turns that seed into a master key, and the [derivation path](/derivation-path/) picks the keys for each account and address. The [mnemonic code converter](/seed-phrase-to-private-key-converter/) shows every one of those values for a test phrase. ## Test vectors to try BIP39 links to official test vectors in [python-mnemonic](https://github.com/trezor/python-mnemonic/blob/master/vectors.json), its reference implementation. Paste the entropy of any of these into the tool above; the words must match exactly. They are public, so never send funds to them. | Entropy (hex) | Mnemonic | | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 00000000000000000000000000000000 | [abandon](/bip39-word/abandon/) [abandon](/bip39-word/abandon/) [abandon](/bip39-word/abandon/) [abandon](/bip39-word/abandon/) [abandon](/bip39-word/abandon/) [abandon](/bip39-word/abandon/) [abandon](/bip39-word/abandon/) [abandon](/bip39-word/abandon/) [abandon](/bip39-word/abandon/) [abandon](/bip39-word/abandon/) [abandon](/bip39-word/abandon/) [about](/bip39-word/about/) | | 7f7f7f7f7f7f7f7f7f7f7f7f7f7f7f7f | [legal](/bip39-word/legal/) [winner](/bip39-word/winner/) [thank](/bip39-word/thank/) [year](/bip39-word/year/) [wave](/bip39-word/wave/) [sausage](/bip39-word/sausage/) [worth](/bip39-word/worth/) [useful](/bip39-word/useful/) [legal](/bip39-word/legal/) [winner](/bip39-word/winner/) [thank](/bip39-word/thank/) [yellow](/bip39-word/yellow/) | | 80808080808080808080808080808080 | [letter](/bip39-word/letter/) [advice](/bip39-word/advice/) [cage](/bip39-word/cage/) [absurd](/bip39-word/absurd/) [amount](/bip39-word/amount/) [doctor](/bip39-word/doctor/) [acoustic](/bip39-word/acoustic/) [avoid](/bip39-word/avoid/) [letter](/bip39-word/letter/) [advice](/bip39-word/advice/) [cage](/bip39-word/cage/) [above](/bip39-word/above/) | | ffffffffffffffffffffffffffffffff | [zoo](/bip39-word/zoo/) [zoo](/bip39-word/zoo/) [zoo](/bip39-word/zoo/) [zoo](/bip39-word/zoo/) [zoo](/bip39-word/zoo/) [zoo](/bip39-word/zoo/) [zoo](/bip39-word/zoo/) [zoo](/bip39-word/zoo/) [zoo](/bip39-word/zoo/) [zoo](/bip39-word/zoo/) [zoo](/bip39-word/zoo/) [wrong](/bip39-word/wrong/) | | 0000…0000 (256 bits) | [abandon](/bip39-word/abandon/) × 23, [then](/bip39-word/then/) [art](/bip39-word/art/) | Making entropy yourself is the risky part: people are poor random number generators. Our guide explains [why you should never make up a seed phrase](/why-you-should-never-create-your-own-seed-phrase/), and [12 vs 24 words](/12-vs-24-word-seed-phrase/) compares the lengths. ## How BIP39 Works — Frequently Asked Questions Why does BIP39 use exactly 2048 words? Because 2048 is 2 to the power of 11, so one word stores exactly 11 bits. Entropy plus checksum always comes to a multiple of 11 bits: 132 bits for 12 words, 264 for 24. Is the checksum a security feature? No. It only catches mistakes: a mistyped or swapped word usually breaks it, so wallets refuse the phrase instead of opening an empty wallet. It adds no secrecy, because anyone can compute it from the entropy. Can I turn my own entropy into a phrase? Technically yes, as the tool above shows, but only fair dice or coins give real randomness. Do other languages work the same way? Yes. The bits and the indexes are identical; only the list of 2048 words differs. Index 0 is abandon in English and ábaco in Spanish, so the same entropy gives a different phrase, and a different seed, in each language. ## Guides - [What Is BIP39? The Standard Behind Seed Phrases](/bip39-the-foundation-of-crypto-wallet-security/) BIP39 turns random entropy into a 12 to 24 word mnemonic phrase that generates your wallet's private keys, the standard for crypto wallet recovery. - [12 vs 24 Word Seed Phrase: Which Is More Secure?](/12-vs-24-word-seed-phrase/) A 24-word seed phrase has 256 bits of entropy and a 12-word one 128, but both are beyond brute force; 24 words help mainly when part of a backup is exposed. - [Why You Should Never Create Your Own Seed Phrase](/why-you-should-never-create-your-own-seed-phrase/) Words you pick are far easier to guess than random ones; brain wallets made from invented phrases were usually drained within a day. Use a generator or dice.