What we claim
- No input leaves your device. All BIP39 calculations run in your browser. The site sends a Content Security Policy with
connect-src 'none', which makes the browser block any network connection from page scripts. - No third-party code. Scripts and styles load only from this domain. There are no ads, analytics, chat widgets, session recording, fonts or CDNs.
- No storage of secrets. Inputs are never written to cookies, localStorage, sessionStorage, IndexedDB or the URL. The only thing stored is your light/dark theme choice.
- No forms. Sensitive inputs are not inside a form, so they cannot be submitted into a URL or to a server, even if a script fails.
- Correctness is tested. Every build checks all 24 official English BIP39 test vectors and 120 cross-checks against the independent python-mnemonic library.
How to verify it yourself
- Open developer tools → Network, then use any tool. No request should appear.
- Look at the response headers of this page for
Content-Security-Policy. - For the strongest guarantee, use the offline file: check its SHA-256, disconnect, and open it locally.
What this does not protect against
- A compromised server. Whoever controls this website could serve different code tomorrow. Browser-side code is only as trustworthy as its delivery. The offline file with a verified hash addresses this.
- Your device. Malware, keyloggers, screen recording and clipboard monitoring can see anything on screen.
- Browser extensions with permission to read pages can read what you type.
- Memory. Clearing a field resets the page, but JavaScript cannot guarantee every copy is erased from browser or system memory.
- Phishing copies of this site. Check the address is exactly
bip39.ai.
Our guidance
| Data | Website | Offline file |
|---|---|---|
| Official test vectors | Yes | Yes |
| Newly generated test phrases | Yes | Yes |
| A real recovery phrase or passphrase | No | Yes, on a disconnected, trusted device |
For a wallet holding significant funds, let a hardware wallet generate and keep the phrase.
What we do not claim
This project has not had an independent security audit. It does not offer reproducible builds or signed releases yet. These are listed as “Not yet available” on the offline page and will be updated with details if they happen.
Reporting a vulnerability
Please report vulnerabilities privately through GitHub security advisories, not in public issues. Include the version shown in the page footer and steps to reproduce. We aim to acknowledge reports within 7 days.