--- title: "TON Seed Phrase: 24-Word Format vs 12-Word BIP39 Phrases" url: "https://bip39-phrase.com/seed-phrase-format-for-ton-wallets/" language: "en" published: "2024-05-16T00:00:00+00:00" updated: "2026-10-16T00:00:00+00:00" --- [ Seed Phrases ](/topics/seed-phrases/) Published May 16, 2024 Updated October 16, 2026 # TON Seed Phrase: 24-Word Format vs 12-Word BIP39 Phrases Читать по-русски: [Сид-фраза TON: 24 слова Tonkeeper и 12 слов BIP39 — в чём разница](/ru/sid-fraza-ton/) ![TON Seed Phrase: 24-Word Format vs 12-Word BIP39 Phrases](/wp-content/uploads/2024/05/seed-phrase-format-for-ton-wallets-hero.webp) A classic TON seed phrase has 24 words taken from the same 2,048-word English list that BIP-39 uses, but it is not a BIP-39 phrase (see [how a standard BIP-39 seed phrase works](/recovery-seed-phrase-guide/)). TON does not use the BIP-39 checksum: a wallet accepts the phrase only if TON’s own hash check passes, then derives a single Ed25519 key from it with HMAC-SHA512 and 100,000 rounds of PBKDF2, so the same words give different keys in a TON wallet than in a Bitcoin or Ethereum wallet. [TON’s documentation](https://docs.ton.org/contracts/standard/wallets/mnemonics) also describes a newer 12-word “multichain” phrase, a regular BIP-39 phrase from which the first TON key is derived at the [derivation path](/derivation-path/) m/44’/607’/0’, and recommends it for new wallets, so some apps may show 12 words instead of 24. ## TON Phrases and BIP39 at a Glance | | Classic TON phrase | TON multichain phrase | Bitcoin BIP39 phrase | | -------------- | -------------------------------------------- | ----------------------------------- | ------------------------------------------ | | Words | 24 | 12 (24 also defined) | 12 to 24 | | Wordlist | BIP39 English | BIP39 English | Any official BIP39 list | | Validity check | TON’s own hash check | BIP39 checksum | BIP39 checksum | | Key derivation | HMAC-SHA512, then PBKDF2 with 100,000 rounds | BIP39 seed, then path m/44’/607’/0’ | BIP39 seed, then paths such as m/84’/0’/0’ | | Key type | Ed25519 | Ed25519 | secp256k1 | ## How a Wallet Checks and Uses the 24 Words TON’s documentation and its reference code ([ton-crypto](https://github.com/ton-org/ton-crypto/blob/master/src/mnemonic/mnemonic.ts), which follows tonlib) process a classic phrase in three steps: 1. **Hash the words.** The 24 words, joined with spaces, are the key of an HMAC-SHA512\. Its message is an optional TON password, normally empty. 2. **Check validity.** That hash goes through PBKDF2-HMAC-SHA512 with the salt `TON seed version` and 390 iterations. The phrase is valid only if the first byte of the result is zero. 3. **Derive the key.** The same hash goes through PBKDF2-HMAC-SHA512 with the salt `TON default seed` and 100,000 iterations, and the first 32 bytes become the Ed25519 private key. Because one byte has to be zero, only about 1 in 256 random 24-word combinations is a valid TON phrase, the same odds as the 8-bit checksum of a 24-word BIP39 phrase that the [BIP39 checksum checker](/bip39-checksum-checker/) demonstrates; a wallet creating a phrase draws random words and repeats until the check passes. That is also why you cannot pick the words yourself: nearly every choice fails, and a human choice that passed would be far easier to guess than a random one. The documentation adds two rules for apps that import 24 words. A TON phrase can pass the BIP-39 checksum by chance, and some apps generate a new phrase when that happens to avoid ambiguous imports. An app that recognizes several schemes for the words you enter should show you each candidate account rather than choose one silently. ## One Phrase, Several Addresses A TON wallet is a smart contract, and its address is calculated from the contract’s initial code and data, not from the public key alone. The same phrase therefore leads to different addresses, each with its own balance, for every wallet contract version (such as V3R2, V4R2 and V5R1) and every subwallet ID. According to TON’s [wallet comparison](https://docs.ton.org/standard/wallets/comparison), most wallet apps create V5R1 wallets by default, while Telegram uses its own WalletTg contract. The [wallet history](https://docs.ton.org/standard/wallets/history) recommends V3R2 and V4R2 only for legacy compatibility, so an older wallet may well use one of them. One account can also be written in several forms. In this example from TON’s [address documentation](https://docs.ton.org/foundations/addresses/formats), the bounceable (`EQ…`) and non-bounceable (`UQ…`) forms differ only in a flag and the checksum, and both decode to the same raw address: ```text EQDKbjIcfM6ezt8KjKJJLshZJJSqX7XOA4ff-W72r5gqPrHF bounceable UQDKbjIcfM6ezt8KjKJJLshZJJSqX7XOA4ff-W72r5gqPuwA non-bounceable 0:ca6e321c7cce9ecedf0a8ca2492ec8592494aa5fb5ce0387dff96ef6af982a3e raw ``` The documentation recommends the non-bounceable form for wallets. ## What a TON Phrase Looks Like A TON wallet shows its phrase as 24 numbered, lowercase words from the BIP-39 English list. Words outside the list (“strawberry”, “xylophone”) never work, and 24 valid words still work only if they pass TON’s check. Never use a phrase you have seen published anywhere, including in examples: everyone who has seen it can empty the wallet. TON’s documentation also describes a “rotation” phrase used only by the WalletTg contract: 24 words made of two 12-word multichain halves. An app without support for that scheme should reject it, so restore such a wallet in an app that supports it. ## Wallets for TON TON (The Open Network) offers several popular wallets that support the use of seed phrases for creating and [restoring wallets](/recovery-seed-phrase-guide/). Among them: ### Keeper (formerly Tonkeeper) Keeper, formerly Tonkeeper, began as a popular mobile wallet for Toncoin, tokens and NFTs and now supports several blockchains, including TON. It lets you create a new wallet or import an existing one using a seed phrase. **Website:** [keeperwallet.com](https://keeperwallet.com) ### Tonhub Tonhub describes itself as a non-custodial TON wallet with a debit card. It supports creating new wallets and importing existing ones using seed phrases. **Website:** [tonhub.com](https://tonhub.com) ### My Wallet (formerly MyTonWallet) My Wallet, formerly MyTonWallet, started as a web wallet for the TON blockchain and now supports several blockchains, including TON. It supports creating and restoring wallets using a seed phrase. **Website:** [mywallet.io](https://mywallet.io) ## Creating a TON Wallet 1. Install the app through the link on the wallet’s official website, listed above. 2. Choose to create a new wallet. The app generates the phrase; never replace it with words of your own. 3. Write the words in order on paper, numbered, and check each one. Don’t take a screenshot or save them in notes or cloud storage. 4. Confirm the words if the app asks you to, then set a passcode. The passcode only locks the app on this device; the phrase is what restores the wallet anywhere else. ## Restoring a TON Wallet 1. In a TON wallet app, choose to import or restore an existing wallet. 2. Enter every word in its original order. 3. If the app finds more than one wallet or version, pick the one whose address you recognize or that holds your balance. 4. Set a new passcode for this device. ## Keeping a TON Phrase Safe No app needs your phrase to connect to your wallet. [TON Connect](https://docs.ton.org/ecosystem/ton-connect/overview), the standard wallet connection protocol for TON, lets an app read your address and request signatures and transactions without ever touching your keys. Any Telegram bot, mini app, airdrop page or “support” agent that asks for the words is a scam ([how to protect a wallet from phishing](/protect-crypto-wallet-from-phishing/)). Keep the paper copy offline and away from the device ([how to store a seed phrase](/store-a-seed-phrase/)). ## Frequently Asked Questions ### Can I import a TON phrase into MetaMask or a Bitcoin wallet? No. A BIP-39 wallet checks the BIP-39 checksum, which most TON phrases fail. If one passes by chance, the wallet derives different keys the BIP-39 way and shows an empty wallet. Restore a TON phrase in a TON wallet; [seed phrase formats by network](/seed-phrase-formats-by-network/) lists the other networks with formats of their own. ### Why does my restored TON wallet show a different address? The app has probably opened a different wallet version or subwallet: the address depends on the contract as well as on the phrase. Before assuming the funds are gone, compare the address with one from an old transaction or look the old address up in a TON block explorer, then check the app’s wallet version settings. ### Is a 12-word TON phrase the same as a Bitcoin 12-word phrase? In format, yes. The multichain phrase is a standard BIP-39 phrase, and the first TON key comes from the path m/44’/607’/0’, following [BIP44](/bip-44-multi-account-hierarchy-for-deterministic-wallets/) with TON’s coin type 607\. A multichain wallet can use the same words for other networks too, so the one phrase protects all of them. [ Back to Blog ](/blog/)