Monero Seed Phrase: 25 Words, Polyseed and Private Keys

A Monero seed phrase is 25 words from Monero’s own list of 1,626 words: the first 24 encode the wallet’s 256-bit private spend key, and the 25th is a checksum. Like a standard BIP39 seed phrase, it restores the wallet and all of its funds and must be kept secret, but it is a different format, so it does not work in Bitcoin or Ethereum wallets. Newer wallets such as Feather and Cake Wallet create 16-word Polyseed phrases instead, and old MyMonero wallets used 13 words. This guide explains each format, the spend and view keys behind them, and a worked example from Monero’s own test suite.

Monero Seed Formats at a Glance

Spend Key and View Key: Monero’s Two Private Keys

A private key is a secret number that allows cryptocurrency to be spent. A Monero wallet has two key pairs:

• Spend key: signs transactions, so it is what moves the funds.
• View key: finds your incoming payments on the blockchain and reads their amounts, but cannot spend them.

In a wallet restored from a 25-word seed, the private view key is not random: it is the Keccak-256 hash of the private spend key, reduced modulo the order of the Ed25519 curve, so the seed restores both. Each private key multiplied by the curve’s base point gives the matching public key.

How the 25 Words Encode the Spend Key

Monero’s seed phrase differs from Bitcoin and Ethereum wallets in several ways:

• Its own word list. The words come from Monero’s English list of 1,626 words, not from the 2,048-word BIP39 list, and the first three letters of a word identify it. The Monero documentation lists word lists in 12 languages, from English and Spanish to Esperanto and Lojban.
• 25 words. Every three words encode 32 bits, so 24 words carry the 256-bit private spend key. The 25th word is a checksum: the first three letters of the 24 words are joined, a CRC-32 of that string modulo 24 picks one of them, and that word is repeated at the end. Most typos in the first three letters make that check fail.
• The address carries both public keys. A standard address is the network byte (18 on mainnet), the public spend key, the public view key and a 4-byte checksum, encoded in Monero’s own Base58. It is 95 characters long and starts with 4; subaddresses start with 8, and integrated addresses are 106 characters long.

Because the encoding is different, a 25-word Monero seed cannot be restored in a BIP39 wallet, and a BIP39 phrase cannot be typed into a Monero wallet as is.

Worked Example: A Public Test Wallet

The wallet below is a public test wallet from the Monero project’s own test suite (tests/functional_tests/wallet.py). Anyone can restore it, so never send funds to it.

Seed phrase (25 words): velvet lymph giddy number token physics poetry unquoted nibs useful sabotage limits benches lifestyle eden nitrogen anvil fewest avoid batch vials washing fences goat unquoted

The last word, unquoted, is the checksum: it repeats the eighth word.

Primary address: 42ey1afDFnn4886T7196doS9GPMzexD9gXpsZJDwVjeRVdFCSoHnv7KPbBeGpzJBzHRCAs9UxqeoyFQMYbqSWYTfJJQAWDm

We checked every value: decoding the 24 words with Monero’s English list gives the spend key above, and the view key, both public keys and the 95-character address follow from it.

Sharing the private view key lets someone see incoming payments without being able to spend them, which is how view-only wallets and audits work, much as an extended public key lets a Bitcoin wallet watch an account without spending from it. The private spend key, like the seed phrase, must never leave your control.

Polyseed: The 16-Word Format

Polyseed packs a Monero wallet into 16 words from lists based on the BIP39 word list (Polyseed specification). The words hold a 150-bit secret, 5 feature bits, an 11-bit checksum and the wallet’s creation date, stored with a resolution of about a month (Monero documentation). The date tells the wallet where to start scanning the blockchain, so you no longer need to note a restore height. The private key comes from the secret through PBKDF2-HMAC-SHA256 with 10,000 iterations, and a coin flag mixed into the phrase makes a Monero Polyseed fail in a wallet for another coin.

Support as of October 2026:

• Feather uses Polyseed for its 16-word seeds. It can show a 25-word seed for a Polyseed wallet, but not the other way round, because the key derivation cannot be reversed: to get a Polyseed, you create a new wallet (Feather documentation).
• Cake Wallet gives new Monero wallets a 16-word Polyseed by default and also offers the 25-word legacy seed or a 12-word BIP39 phrase (Cake Wallet documentation).
• The official wallets still create 25-word seeds in their 0.18 releases. Polyseed support for the CLI wallet, the wallet RPC server and the wallet API was merged into the development branch in September 2026 (pull request #10765).

Sixteen is not a BIP39 length, so a BIP39 wallet rejects a Polyseed phrase even though its words come from lists based on BIP39’s.

Can You Restore a Monero Seed in a BIP39 Wallet?

No. A 25-word seed encodes the spend key directly with Monero’s own list, a Polyseed has a length BIP39 does not allow, and a BIP39 wallet derives its keys a different way in any case. Restore a 25-word seed in any Monero wallet and a Polyseed in a wallet that supports it, such as Feather or Cake Wallet. For a 25-word seed, keep the wallet’s restore height, the block from which to scan, next to the backup: Feather notes that it makes restoring faster. Seed phrase formats by network compares Monero with a dozen other networks.

Why Monero Is Considered a Privacy Coin

Monero is built on the CryptoNote protocol and applies its privacy features to every transaction by default:

• Ring signatures hide which output is being spent among decoys.
• Stealth addresses give every payment a one-time destination, so payments cannot be linked to the recipient’s address.
• Ring Confidential Transactions (RingCT) hide the amounts.

On Bitcoin, by contrast, addresses and amounts are public, and privacy depends on how carefully each user behaves.

Privacy by default is not perfect anonymity. Researchers have shown that older versions of the protocol leaked information, metadata such as IP addresses or exchange records can still identify users, and some exchanges do not list Monero for regulatory reasons: anti-money-laundering rules expect them to monitor where funds come from and where they go. More about the project is on its official site, getmonero.org.

How to Keep the Seed Safe

The rules for any seed phrase apply: write the words down offline, keep two copies in separate places, and never give them to anyone who asks, since no developer or support agent needs them. Monero adds two points: keep the restore height of a 25-word seed with the backup, and remember that the private view key reveals your incoming payments to whoever holds it. How to store a seed phrase covers paper, metal and where to keep the copies.

Frequently Asked Questions

Why does a Monero seed have 25 words?

Twenty-four words carry the 256-bit private spend key, three words for every 32 bits, and the 25th repeats one of them as a checksum.

Can I turn my 25-word seed into a Polyseed?

No. A Polyseed derives the spend key from its secret through a one-way function, so an existing key cannot be expressed as a Polyseed. Create a new Polyseed wallet and send your funds to it.

Is it safe to share my private view key?

It cannot spend your funds, but it shows every payment you receive. Share it only with someone who needs to watch the wallet, such as an auditor, or use it for a view-only wallet of your own.