Seed Phrase Formats by Network: BIP39 and the Exceptions

Many wallets back up their keys as 12 to 24 words from the BIP39 word list, but the same-looking phrase does not give the same keys everywhere. Bitcoin, Ethereum, Cosmos, TRON, Solana and Stellar wallets turn the words into a standard BIP39 seed and then differ in curve, derivation method and path. Cardano and Polkadot use the same words but derive their keys another way. The XRP Ledger, Algorand, Monero and TON have formats of their own. Even within one network, two wallets can derive different keys from the same words. This reference compares how 12 networks turn words into keys, gives the default path of each and lists test vectors for the public test phrase, so you can check any tool against them.

Seed Phrase Formats at a Glance

In this table, BIP39 means the whole standard: the words go through PBKDF2-HMAC-SHA512 with 2,048 rounds, with mnemonic plus an optional passphrase as the salt, which gives a 64-byte seed (BIP39). “BIP39 words, own seed” means the phrase and its checksum are standard, so the phrase passes a BIP39 check, but the keys come from its entropy by another route, and tools built for BIP39 seeds cannot reproduce them. The default path is the one in the network’s reference software or documentation; individual wallets can differ, as the sections below explain. For how the three Bitcoin standards fit together, see BIP39 vs BIP32 vs BIP44.

BIP39 Seed and BIP32 Keys: Bitcoin, Ethereum, Cosmos, TRON

These four networks follow the classic pipeline: a BIP39 seed, a BIP32 master key on the secp256k1 curve and a BIP44-style path whose second number is the network’s coin type from the SLIP-44 registry. One phrase therefore holds separate keys for all of them, and a BIP39 passphrase changes every one.

Bitcoin

BIP39 was written for Bitcoin. A phrase has 12, 15, 18, 21 or 24 words, and the checksum takes 4 to 8 bits of the last word. The standard links to ten official word lists but strongly discourages non-English ones, because most wallets support only English. BIP32 turns the 64-byte seed into a master key, and the first number of the path selects the address type: 44' for legacy addresses that start with 1, 49' for 3, 84' for bc1q and 86' for bc1p. The derivation path guide lists the first address of each for the test phrase.

Bitcoin Core, the reference wallet, has no seed phrase at all. It creates a random master key and derives descriptors on the same four paths, with native SegWit (m/84'/0'/0'/0/*) as its default address type. The main pitfall on Bitcoin is the address type: a wallet restored on the BIP44 path does not see coins received on BIP84 addresses and shows an empty balance until you pick the right type.

Ethereum and EVM Chains

Ethereum uses the same BIP39 seed and BIP32 keys with coin type 60. Go-ethereum sets its default base path to m/44'/60'/0'/0/0 and counts further accounts in the last number (accounts/hd.go), and MetaMask supports only that branch for an imported phrase. The address is the last 20 bytes of the Keccak-256 hash of the public key, so one key has the same 0x address on every EVM chain, such as BNB Smart Chain, Polygon or Arbitrum, with a separate balance on each (how EVM addresses are built).

The pitfall is account numbering. When MetaMask connects a Ledger, it offers three path options, Ledger Live, Legacy (MEW / MyCrypto) and BIP44, and each counts accounts at a different level: Ledger Live at m/44'/60'/x'/0/0, BIP44 at m/44'/60'/0'/0/x and Legacy at m/44'/60'/0'/x, so the same device can show different account lists. The derivation path guide compares the MetaMask and Ledger numbering with test addresses.

Cosmos

The Cosmos SDK uses BIP39 phrases and BIP32 keys on secp256k1, with coin type 118 for the Cosmos Hub’s ATOM, so the first account sits at m/44'/118'/0'/0/0 (Cosmos SDK documentation). The address is the RIPEMD-160 hash of the SHA-256 hash of the compressed public key, written in Bech32 with the chain’s prefix: cosmos1… on the Cosmos Hub.

The pitfall is that each chain in the ecosystem picks its own coin type. Osmosis and Celestia keep 118, so the same words give the same 20-byte account under another prefix: for the test phrase, cosmos19rl4cm2hmr8afy4kldpxz3fka4jguq0auqdal4 and osmo19rl4cm2hmr8afy4kldpxz3fka4jguq0a5m7df8 differ only in the prefix and the six checksum characters. According to the Cosmos chain registry, Terra uses 330, Secret Network 529 and Cronos POS Chain (formerly Crypto.org Chain) 394, while Injective and Dymension use 60 with Ethereum-style keys. A wallet that applies the wrong coin type shows an address with no history.

TRON

TRON uses standard BIP39 phrases and BIP44 derivation on secp256k1 with coin type 195; its wallet developer guide gives the path m/44'/195'/0'/0/<index>. The address is built like Ethereum’s, from the last 20 bytes of the Keccak-256 hash of the public key, but with the prefix byte 0x41 and Base58Check encoding, so it starts with T and has 34 characters. Because the coin types differ, the same phrase gives unrelated TRON and Ethereum accounts.

BIP39 Seed and SLIP-10 Keys: Solana and Stellar

Solana and Stellar sign with ed25519. Their wallets start from the BIP39 seed but derive keys with SLIP-10, which uses the key ed25519 seed instead of BIP32’s Bitcoin seed and allows only hardened steps. Every number in the path therefore carries an apostrophe, and no child key can be computed from a public key.

Solana

Solana’s coin type is 501, but one phrase can lead to at least four different keys:

• m/44'/501'/0'/0', then m/44'/501'/1'/0' for the next account. Phantom calls this path bip44Change and describes it as the most common one and the default in newer wallets.
• m/44'/501'/0', Phantom’s bip44 option and the path it lists for Ledger Live accounts.
• m/44'/501', what the Solana command-line tools derive by default when you enter a phrase at a prompt:// input; prompt://?key=0/0 gives m/44'/501'/0'/0' instead (Solana CLI documentation).
• No path at all. solana-keygen new prints a phrase but, unless it is given a derivation path, makes the keypair from the first 32 bytes of the BIP39 seed. The CLI documentation calls this the legacy raw keypair, which the ASK keyword selects.

The CLI promotes every index to hardened, so m/44/501/0/0 means the same as m/44'/501'/0'/0' there. None of the paths Phantom lists for recovery phrases is the raw keypair, so a phrase made with plain solana-keygen new opens a different, empty account in Phantom. The test vectors below show all four addresses for one phrase.

Stellar

SEP-0005, a final Stellar standard, fixes one scheme: a BIP39 phrase, SLIP-10 on ed25519 and the path m/44'/148'/x', where m/44'/148'/0' is the primary key. It strongly recommends 24 words. Each account is a single hardened step at the third level, with no change or index levels below it. Public keys are written as 56-character strings that start with G, and secret keys as 56-character strings that start with S. The SEP’s fifth test vector uses the public test phrase, so it doubles as a check for any SLIP-10 implementation.

BIP39 Words, Their Own Keys: Cardano and Polkadot

Cardano’s and Polkadot’s own wallets create and check phrases exactly as BIP39 does, but their standard schemes do not feed the words into the BIP39 seed function. Both start from the entropy, the 128 to 256 random bits the words encode, so a generic BIP39 tool derives keys from their phrases that these wallets never use. Hardware wallets follow other rules, and that is where the pitfalls begin.

Cardano

CIP-3 documents the master key algorithms used on Cardano. The recommended one, Icarus, which Yoroi and Daedalus use, runs PBKDF2-HMAC-SHA512 with 4,096 rounds, the entropy as the salt and the optional passphrase as the password, then adjusts a few bits of the 96-byte result to form an extended ed25519 key. From there Cardano uses BIP32-Ed25519, a variant of BIP32 for ed25519 keys that, unlike SLIP-10, also allows non-hardened children. CIP-1852 sets the path m/1852'/1815'/account'/role/index, with role 0 for receiving, 1 for change and 2 for the staking key; 1852 is the year Ada Lovelace died and 1815 the year she was born. A Shelley base address, which starts with addr1, combines hashes of the payment key at …/0/0 and the stake key at …/2/0.

The Cardano Foundation’s cardano-wallet backend accepts 15 to 24 words for Shelley wallets and 12 to 24 for legacy Byron wallets. Byron-era Daedalus wallets used a deprecated scheme whose addresses start with Ddz.

CIP-3 lists two more schemes that are still in use, and each gives the same words different keys:

• Ledger and BitBox02 derive the master key from the standard BIP39 seed with HMAC-SHA512 under the key ed25519 seed, so the same words open a different wallet on those devices than in Yoroi.
• Trezor follows Icarus except with 24 words, where its firmware passes the checksum byte together with the entropy, so a 24-word phrase opens a different wallet there too.

The test vectors below show the Icarus and Ledger addresses of the same 12 words.

Polkadot

Subkey and the wallets built on Polkadot.js use the BIP39 word list and checksum, but, as the Polkadot wiki explains, they generate the key from the entropy rather than from the BIP39 seed. In Substrate’s substrate-bip39 code, that means PBKDF2-HMAC-SHA512 with 2,048 rounds over the entropy, with mnemonic plus an optional password as the salt. The first 32 bytes become a mini-secret key for sr25519, the Schnorr signature scheme on the Ristretto group that Substrate uses. Subkey creates 12 words by default, accepts 12 to 24 and uses sr25519 unless told otherwise.

Subkey and Polkadot.js use no BIP44 path: the phrase alone gives the root key, and further accounts are written after the phrase as hard (//) and soft (/) junctions, with /// for a password. The same public key becomes a different SS58 address on each network: Polkadot’s prefix 0 gives addresses that start with 1, Kusama’s prefix 2 a capital letter and the generic Substrate prefix 42 an address that starts with 5.

The pitfalls come from other schemes. Ledger’s Polkadot app follows BIP44 instead, with ed25519 keys at m/44'/354'/0'/0'/0' derived from the standard BIP39 seed by BIP32-Ed25519, so a phrase restored on a Ledger shows a different account than in Polkadot.js, and Ledger Wallet (formerly Ledger Live) shows only that first account. Polkadot.js can also create ed25519 or secp256k1 keys from the same phrase, each with its own address.

Formats of Their Own: XRP Ledger, Algorand, Monero, TON

These four networks use backup formats that are not BIP39 phrases. Three of them now also have a BIP39-based option, which leaves the same network with two kinds of backup that cannot be swapped.

XRP Ledger

The XRP Ledger derives keys from a 16-byte seed, as its cryptographic keys documentation describes. The seed is usually written as a base58 string that starts with s, such as snoPBrXtMeMyMHUVTgbuqAfg1SUTb in the documentation’s example for the server’s wallet_propose method; in xrpl.js, seeds for ed25519 keys start with sEd. The same method can also show the seed as 12 RFC 1751 words, a field it marks as deprecated, and the Xaman wallet issues it as “secret numbers”, eight blocks of six digits. Keys come from the seed by the ledger’s own algorithm, not BIP32: for secp256k1, hashes of the seed give a root key and an intermediate key that are added together, and for ed25519 the SHA-512Half of the seed is the secret key.

The server defaults to secp256k1, while client libraries such as xrpl.js default to ed25519 when they generate keys, and the documentation warns that one seed can give different addresses in different tools unless the algorithm is specified. BIP39 phrases are a separate route: xrpl.js derives them with BIP32 at m/44'/144'/0'/0/0 by default, in a method the library now marks as deprecated, so a phrase and a seed do not lead to the same account.

Algorand

Algorand’s original backup, which its documentation now calls Algo25 and treats as legacy, is not a seed: the 25 words are the account’s 32-byte ed25519 private key itself, cut into 11-bit pieces and mapped to the BIP39 English list. The 256 bits fill 23 words with 3 bits left over, so the 24th word is always one of the first eight on the list (abandon to abstract), and the 25th is a checksum taken from the SHA-512/256 hash of the key. One phrase holds one account, with no path or passphrase, and the phrase is as sensitive as a private key, because it is one.

The Algorand documentation now prefers xHD, a 24-word phrase that generates a hierarchical deterministic set of accounts. The Algorand Foundation’s xHD libraries derive them from the standard BIP39 seed with a variant of BIP32-Ed25519 at m/44'/283'/account'/0/index. Algo25 and xHD phrases are not interchangeable, and Algorand’s algokey tool reads only Algo25.

Monero

Monero’s standard seed is 25 words from its own lists of 1,626 words, available in 12 languages. The words encode a 256-bit number, the account’s private spend key, from which the view key is derived, and the 25th word repeats one of the first 24 as a checksum, chosen by a CRC-32 over the first letters of the words (three for English). Our Monero seed guide works through an example.

The Monero documentation lists two more formats. MyMonero seeds have 13 words. Polyseed has 16 words from lists based on BIP39’s. It stores a 150-bit secret, feature flags and the wallet’s creation date, which lets a restore skip older blocks; the key comes from PBKDF2-HMAC-SHA256 with 10,000 rounds, and a coin flag makes a Polyseed phrase fail on other coins. Feather Wallet creates Polyseed phrases, while the official CLI and GUI wallets still create 25-word seeds; Polyseed support for the CLI wallet was merged into the project’s development code in September 2026. None of these formats is BIP39, and none uses a derivation path.

TON

A classic TON phrase is 24 words from the BIP39 English list, but TON ignores the BIP39 checksum. The words are hashed with HMAC-SHA512; a PBKDF2 pass with the salt TON seed version and 390 rounds must return a first byte of zero for the phrase to be valid, and a second pass with TON default seed and 100,000 rounds yields the ed25519 key. There is no path, and the address also depends on the wallet contract version, so one phrase can show several addresses.

For new wallets, TON’s documentation recommends a 12-word multichain phrase: a regular BIP39 phrase whose TON key comes from SLIP-10 at m/44'/607'/0'. A 24-word TON phrase can pass the BIP39 checksum by chance, so the documentation asks wallets that recognize more than one scheme to show every candidate account rather than pick one silently. Our TON seed phrase guide covers both formats.

A Note on Electrum Seeds

Electrum, a Bitcoin wallet, has used its own seed format since version 2.0 and does not generate BIP39 seeds. New Electrum seeds are 12 words from the BIP39 English list, but Electrum checks them with a version number taken from an HMAC-SHA512 of the phrase, whose prefix names the wallet type (01 standard, 100 SegWit, 101 and 102 two-factor), and derives keys with the salt electrum instead of mnemonic. Current versions also discard any candidate that happens to pass the BIP39 checksum, so a BIP39 wallet rejects the seed. The Electrum seed guide explains how to recognize and restore one. SatoshiLabs’ SLIP-39 Shamir backup is another format that is not BIP39: shares of 20 or 33 words from a list of 1,024 that cannot be converted into a BIP39 phrase.

Test Vectors for the Public Test Phrase

Every value below comes from the public BIP39 test phrase abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about with an empty passphrase. Anyone can derive these keys, so never send funds to these addresses. We computed each value with two independent implementations, after checking the code against official vectors: BIP84 for Bitcoin, SEP-0005 for Stellar, SLIP-10 for ed25519 derivation, CIP-3, CIP-11 and CIP-19 for Cardano, Subkey’s documented example and Substrate’s own test vectors for Polkadot, the polkadot-js test suite for Polkadot’s Ledger path and the xrpl.js tests for the XRP Ledger path.

Network     Scheme and path                                   First address
Bitcoin     BIP84, m/84'/0'/0'/0/0                            bc1qcr8te4kr609gcawutmrza0j4xv80jy8z306fyu
Ethereum    m/44'/60'/0'/0/0                                  0x9858EfFD232B4033E47d90003D41EC34EcaEda94
Solana      m/44'/501'/0'/0'                                  HAgk14JpMQLgt6rVgv7cBQFJWFto5Dqxi472uT3DKpqk
Solana      m/44'/501'/0'                                     GjJyeC1r2RgkuoCWMyPYkCWSGSGLcz266EaAkLA27AhL
Solana      m/44'/501' (CLI prompt:// default)                D2PPQSYFe83nDzk96FqGumVU8JA7J8vj2Rhjc2oXzEi5
Solana      no path (solana-keygen new)                       EHqmfkN89RJ7Y33CXM6uCzhVeuywHoJXZZLszBHHZy7o
Cardano     Icarus, m/1852'/1815'/0'/0/0 and /2/0             addr1qy8ac7qqy0vtulyl7wntmsxc6wex80gvcyjy33qffrhm7sh927ysx5sftuw0dlft05dz3c7revpf7jx0xnlcjz3g69mq4afdhv
Cardano     Ledger, m/1852'/1815'/0'/0/0 and /2/0             addr1qy2vzmtlgvjrhkq50rngh8d482zj3l20kyrc6kx4ffl3zfqayfawlf9hwv2fzuygt2km5v92kvf8e3s3mk7ynxw77cwqf7zhh2
Polkadot    sr25519, no path (Subkey, Polkadot.js)            13KVd4f2a4S5pLp4gTTFezyXdPWx27vQ9vS6xBXJ9yWVd7xo
Polkadot    Ledger, ed25519, m/44'/354'/0'/0'/0'              12aRjLzT5ycoWGHwoHLoXxd5QBa6bxuqivMQSGsPonzd9MWa
Cosmos Hub  m/44'/118'/0'/0/0                                 cosmos19rl4cm2hmr8afy4kldpxz3fka4jguq0auqdal4
TRON        m/44'/195'/0'/0/0                                 TUEZSdKsoDHQMeZwihtdoBiN46zxhGWYdH
XRP Ledger  BIP39, m/44'/144'/0'/0/0                          rHsMGQEkVNJmpGWs8XUBoTBiAAbwxZN5v3
Stellar     SEP-0005, m/44'/148'/0'                           GB3JDWCQJCWMJ3IILWIGDTQJJC5567PGVEVXSCVPEQOTDN64VJBDQBYX

The Ethereum address is the same on every EVM chain. Algorand, Monero and TON have no row: their native formats do not take a BIP39 phrase, and a TON address also depends on the wallet contract. The seed phrase to private key converter reproduces the Bitcoin, Ethereum and TRON rows in your browser; use only the public test phrase there.

How to Tell Which Format a Phrase Uses

The words alone do not record which scheme made them: BIP39 itself lists the missing versioning scheme among its shortcomings. Keep a note of the wallet app, its version and the network next to your backup; the note reveals no keys. Without it, the word count and the word list narrow things down:

• 12 to 24 words, all on the BIP39 list. Usually BIP39, but the words do not say which network or scheme. Electrum seeds (usually 12 words) and classic TON phrases (24) look the same without being BIP39, and Cardano, Polkadot and Algorand xHD phrases are BIP39 phrases that need a wallet of their own network.
• 25 words. Monero if the words come from Monero’s list; Algorand Algo25 if every word is on the BIP39 list, and then the 24th word is one of abandon, ability, able, about, above, absent, absorb or abstract.
• 16 words. Polyseed, the newer Monero format; 16 is not a BIP39 length.
• 13 words. An old MyMonero seed.
• 20 or 33 words. SLIP-39 shares.
• Eight groups of six digits. Secret numbers from the Xaman wallet for the XRP Ledger.
• A string instead of words. An XRP Ledger seed, a base58 string that starts with s, or a Stellar secret key, 56 characters starting with S.

Never type a real phrase into a website to find out, including the tools on this site, which are for public test phrases only. Restore it in a wallet for its network, and if the wallet opens with an empty balance, check the scheme and the path before assuming the funds are gone: see restoring a wallet from a seed phrase.

Frequently Asked Questions

Which blockchains use BIP39?

Bitcoin, Ethereum and other EVM chains, Solana, Cosmos SDK chains, TRON and Stellar use standard BIP39 phrases and seeds and differ in curve, derivation and path. Cardano and Polkadot use BIP39 words but derive keys from the entropy their own way. The XRP Ledger, Algorand (Algo25), Monero and classic TON phrases are formats of their own, although xrpl.js, Algorand’s xHD and TON’s multichain phrase add BIP39-based options.

Can one seed phrase hold several networks?

A BIP39 phrase in a multichain wallet can, because each network has its own coin type and path. A Monero seed, an Algo25 phrase or a classic TON phrase belongs to one network. Either way, a phrase protects everything derived from it, so a leak exposes every network at once.

Why does my restored wallet show a different address?

The wallet probably used another scheme or path for the same words: a different Solana path, Cardano’s Ledger or Trezor scheme, Polkadot’s Ledger path or another Bitcoin address type. Find out which wallet created the phrase and restore it with the same scheme; the funds are still at the original address.

Is Algorand’s 25-word phrase the same as Monero’s?

No. Algorand’s uses the BIP39 English list and encodes the private key directly; Monero’s uses Monero’s own lists of 1,626 words and encodes the private spend key. Neither restores in the other network’s wallets or in a BIP39 wallet.