BIP39 is a standard for turning random data into a list of 12 to 24 common English words, and for turning those words into a 512-bit seed that a wallet uses to create keys. The words are easier to write down and check than a long number, and a built-in checksum catches most mistakes.
BIP stands for Bitcoin Improvement Proposal. BIP39 was proposed in 2013 and is now used by most cryptocurrency wallets, not only Bitcoin ones. Last reviewed 2026-09-24.
How BIP39 works
128–256 random bits
→ 11-bit groups
12–24 words you write down
2048 rounds + passphrase
512 bits, the input to wallet key derivation
- Entropy. A wallet picks 128–256 random bits. Try it in the generator.
- Checksum. It hashes those bits with SHA-256 and appends the first few bits of the hash.
- Words. The bits are split into 11-bit numbers, each selecting one of 2048 words.
- Seed. The words, plus an optional passphrase, go through PBKDF2-HMAC-SHA512 with 2048 rounds to produce a 512-bit seed. See it in the converter.
What BIP39 solves
- Human-friendly backups. Twelve words are easier to write, read aloud and check than 32 hex characters.
- Error detection. A checksum makes most typos fail instead of restoring the wrong wallet.
- Portability. Any wallet that implements BIP39 (and the same derivation paths) can restore the same funds.
What BIP39 does not do
- It does not encrypt or hide the words. Whoever has them controls the funds.
- It does not define how keys or addresses are made from the seed — that is BIP32, BIP44 and related standards.
- It does not guarantee randomness. A weak random source gives a weak phrase with a perfectly valid checksum.
- It cannot tell you whether a phrase has funds or which wallet created it.
Word counts and entropy
| Words | Entropy bits | Checksum bits | Possible phrases |
|---|---|---|---|
| 12 | 128 | 4 | 2128 |
| 15 | 160 | 5 | 2160 |
| 18 | 192 | 6 | 2192 |
| 21 | 224 | 7 | 2224 |
| 24 | 256 | 8 | 2256 |
The checksum
The checksum is the first ENT/32 bits of SHA-256(entropy): 4 bits for 12 words, 8 bits for 24. It lives in the last word, which is why you can’t pick the last word freely. The checksum page walks through every step with real test vectors.
The optional passphrase
BIP39 lets you add a passphrase, sometimes called the “25th word”. Every passphrase produces a different valid seed, so a typo opens a different empty wallet instead of showing an error. Try it with a test vector.
BIP39 vs BIP32 and BIP44
These standards are often mentioned together but do different jobs:
| Standard | Job |
|---|---|
| BIP39 | Random bits ↔ words; words + passphrase → seed |
| BIP32 | Seed → a tree of keys (hierarchical deterministic wallets) |
| BIP44, 49, 84, 86 | Which branch of that tree a wallet uses for each coin and address type (the “derivation path”) |
Two wallets can use the same BIP39 phrase and still show different addresses if they use different derivation paths.
Safety advice
- Let a hardware wallet or a trusted offline tool generate your phrase. Don’t invent words yourself.
- Never type a real recovery phrase into a website, chat, email, cloud note or photo. Legitimate support will never ask for it.
- Store backups offline; consider a metal backup for fire and water resistance.
- If you use a passphrase, back it up separately with the same care.
- To experiment, use test vectors or the offline tool.
Sources
- BIP39 specification (bitcoin/bips)
- Official English word list
- Official test vectors (trezor/python-mnemonic)