How the BIP39 checksum works
BIP39 defines two formulas:
CS = ENT / 32 MS = (ENT + CS) / 11
ENT is the entropy length in bits, CS the checksum length in bits, and MS the mnemonic length in words. Taking the first CS bits of the SHA-256 hash and appending them to the entropy makes the total a multiple of 11, so it splits exactly into word indexes.
| ENT | CS | ENT + CS | Words (MS) | Checksum bits in last word |
|---|---|---|---|---|
| 128 | 4 | 132 | 12 | 4 of 11 |
| 160 | 5 | 165 | 15 | 5 of 11 |
| 192 | 6 | 198 | 18 | 6 of 11 |
| 224 | 7 | 231 | 21 | 7 of 11 |
| 256 | 8 | 264 | 24 | 8 of 11 |
What the checksum is for
The checksum catches most transcription mistakes: a wrong word, a swapped pair, a missing word. Wallets refuse to import a mnemonic whose checksum fails, which prevents silently restoring the wrong wallet from a typo.
It is not encryption and adds no security. Anyone with the words can recompute it.
Implementation notes
- Hash the entropy bytes, not the hex string.
- Take bits from the most significant bit of the first hash byte.
- Read 11-bit groups big-endian: the first bit is the most significant bit of the index.
- Check your implementation against all 24 English vectors in the official test vectors. You can step through each of them above.
To check a complete mnemonic, use the validator. To produce new test mnemonics, use the generator.