Seed Phrase Examples: 12, 18 and 24 BIP39 Mnemonic Phrases
A BIP39 seed phrase is a list of 12, 15, 18, 21 or 24 words from a fixed list of 2,048, for example ozone drill grab fiber curtain grace pudding thank cruise elder eight picnic. That 12-word phrase is an official BIP39 test vector: it encodes 128 random bits plus a 4-bit checksum, and because it is published for wallet developers, anyone can open its wallet, so never send funds to it. This page lists 12-, 18- and 24-word examples with their entropy, the test vectors developers use most, why a random list of words is usually not a valid phrase, and what phrases from non-BIP39 wallets look like. New to the idea? Start with what a seed phrase is and how it works.
Seed Phrase Examples at a Glance
| Words | Entropy | Checksum | Example (official test vector) |
|---|---|---|---|
| 12 | 128 bits | 4 bits | ozone drill grab fiber curtain grace pudding thank cruise elder eight picnic |
| 18 | 192 bits | 6 bits | gravity machine north sort system female … stable narrow fog |
| 24 | 256 bits | 8 bits | hamster diagram private dutch cause delay … delay length |
Each word stands for 11 bits, its position in the list counted from zero, and the last word mixes the final entropy bits with the checksum. The 15- and 21-word lengths, with 160 and 224 bits, are valid too, but few wallets create them.
What a Seed Phrase Is Made Of
- Words from one list. Every word comes from the 2,048-word BIP39 word list, chosen so that the first four letters identify each word.
- A fixed order. The same words in a different order make a different phrase.
- A checksum in the last word. The first bits of the entropy’s SHA-256 hash are appended before the bits are cut into words (BIP39), so the last word depends on all the others.
- Repeats are allowed. A word can appear twice, as “private” and “delay” do in the 24-word example.
The phrase is not the key itself. Together with an optional passphrase, it goes through PBKDF2-HMAC-SHA512 into a 512-bit seed, and the wallet derives every key and address from that seed along a derivation path.
Examples for Each Length
The examples below are official BIP39 test vectors, published with the reference implementation so that wallet developers can check their code, including BIP39 generators written in Python. Because they are public, never send funds to a wallet created from them: anyone can open it.
12 Words
Entropy (128 bits): 9e885d952ad362caeb4efe34a8e91bd2
ozone drill grab fiber curtain grace pudding thank cruise elder eight picnic
12 words × 11 bits = 132 bits: 128 bits of entropy plus a 4-bit checksum. This is the length most software wallets create.
18 Words
Entropy (192 bits): 6610b25967cdcca9d59875f5cb50b0ea75433311869e930b
gravity machine north sort system female filter attitude volume fold club stay feature office ecology stable narrow fog
18 words carry 192 bits of entropy plus a 6-bit checksum.
24 Words
Entropy (256 bits): 68a79eaca2324873eacc50cb9c6eca8cc68ea5d936f98787c60c7ebc74e6ce7c
hamster diagram private dutch cause delay private meat slide toddler razor book happy fancy gospel tennis maple dilemma loan word shrug inflict delay length
24 words carry 256 bits of entropy plus an 8-bit checksum. Ledger devices create this length; 12 vs 24 words explains when the extra words help.
Test Vectors Developers Use Most
| Entropy | Mnemonic |
|---|---|
00000000000000000000000000000000 | abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about |
7f7f7f7f7f7f7f7f7f7f7f7f7f7f7f7f | legal winner thank year wave sausage worth useful legal winner thank yellow |
80808080808080808080808080808080 | letter advice cage absurd amount doctor acoustic avoid letter advice cage above |
The full set is in the BIP39 test vectors of the reference implementation. Paste any entropy on this page into our visualizer to trace each 11-bit group to its word and get exactly the mnemonic shown.
Why a Random List of Words Is Not a Valid Phrase
Because the last word holds a checksum, most sequences of list words are rejected. A 12-word phrase has 4 checksum bits, so only about 1 in 16 random sequences of 12 list words passes; with 24 words and 8 bits, about 1 in 256. Twelve times “abandon” fails, while eleven times “abandon” followed by “about”, the first vector in the table above, passes: once the first 11 words are fixed, exactly 128 of the 2,048 words can end a 12-word phrase. The BIP39 checksum checker shows the check bit by bit, and the last word calculator lists the valid endings for any 11 or 23 words.
That is also why you should not pick words yourself to make a phrase for real use: a human choice is far easier to guess than random bits, as why you should never create your own seed phrase explains.
Phrases That Look Similar but Are Not BIP39
| Wallet or standard | Words | Word list | Restores in a BIP39 wallet? |
|---|---|---|---|
| Electrum seed | 12 | BIP39 English | No: its own version check and salt |
| Classic TON phrase | 24 | BIP39 English | No: its own validity check and key derivation |
| Monero seed | 25, or 16 for Polyseed | Monero’s own lists; Polyseed lists based on BIP39 | No |
| SLIP-39 share | 20 or 33 | Its own list of 1,024 words | No |
Seed phrase formats by network covers a dozen networks, including those that use BIP39 words but derive their keys differently.
Why Every BIP39 Wallet Uses the Same Words
BIP39 was assigned in September 2013 to give wallets one way to turn random bits into words and words into a seed. Because the list, the checksum and the seed calculation are fixed, a phrase from one BIP39 wallet restores in another: the same words with the same passphrase always give the same seed. Wallets can still differ in the derivation paths and address types they scan, so a restored wallet occasionally shows an empty balance until you choose the right one (how to restore a wallet from a seed phrase).
The list is designed for reliable writing rather than secrecy: the words are common and 3 to 8 letters long, the first four letters are unique, and similar words were avoided, so fewer backups fail because of a miscopied word.
How to Keep Your Own Phrase Safe
Unlike the public test vectors above, the phrase your own wallet generates must stay secret: anyone who sees it can take the funds, so write it down offline as soon as the wallet shows it, and never share it or save it on an internet-connected device. For paper and steel backups, where to keep the copies and how to test them, see how to store a seed phrase safely.
Frequently Asked Questions
How can I securely store my mnemonic phrase?
Write it on paper or stamp it into a metal backup, keep it in a secure place such as a safe, keep a second copy somewhere else, and avoid digital copies.
Is a 12-word phrase secure enough for long-term use?
Yes. 128 bits are far beyond brute force, and the keys a Bitcoin wallet derives offer about 128-bit security whatever the phrase length. A 24-word phrase adds margin mainly when part of a backup could be seen; see 12 vs 24 words.
Can I change my mnemonic phrase?
No. A mnemonic cannot be edited: to get a new one, create a new wallet and move your funds to it. If a phrase is lost, there is no way to recover the wallet without it.
What happens if I lose my phrase?
Losing your mnemonic phrase means losing access to your wallet once the device or app that holds it is gone. Always keep a backup in a secure location.
Can mnemonic phrases be used on multiple wallets?
Yes. A BIP39 phrase restores in any wallet that supports BIP39 and its length, though you may need to pick the same derivation path. Electrum seeds, classic TON phrases and Monero seeds are the exceptions in the table above.
Is it safe to store a mnemonic phrase in a password manager?
It is better than a plain note, but the phrase then depends on your master password, your devices and the provider. For the key to your funds, offline paper or steel is safer.