Seed Phrases Explained: The BIP39 Word List and Recovery

A seed phrase is a sequence of 12 or 24 English words that serves as the master backup for your entire Bitcoin wallet. Also called a mnemonic phrase, recovery phrase, or backup phrase, this set of words encodes the cryptographic secret from which every private key and address in your wallet is derived. If you completed Lesson 2.1 on Bitcoin wallets and Lesson 2.2 on custodial vs. non-custodial wallets, you already know that controlling your own keys is what makes Bitcoin ownership real. The seed phrase is how that control is maintained — and how it can be restored if your device is lost, stolen, or destroyed.

This lesson covers the technical standard behind seed phrases (BIP39), how words become keys, the difference between 12-word and 24-word phrases, and the security rules that keep your bitcoin safe.

What Is a Seed Phrase?

When you set up a new Bitcoin wallet — whether it’s a mobile app like BlueWallet or a hardware device like a Coldcard — the software generates a random number and converts it into a human-readable list of words. That list is your seed phrase.

Here’s an example of what a 12-word seed phrase looks like:

abandon ability able about above absent absorb abstract absurd abuse access accident

(This is a publicly known example — never use it for a real wallet.)

The seed phrase has three defining properties:

• It encodes your master secret. Every Bitcoin address and private key your wallet will ever produce is mathematically derived from these words.
• It’s portable. You can enter these words into any compatible wallet application on any device, and it will reconstruct the exact same wallet with the same addresses and balances.
• It’s the single point of recovery — and the single point of failure. Anyone who has your seed phrase has your bitcoin. If you lose your seed phrase and your wallet device breaks, your bitcoin is gone permanently.

This dual nature — backup tool and attack vector — is why seed phrase management is the most important skill in Bitcoin self-custody.

Seed Phrase vs. Password

A common misconception is that the seed phrase works like a password. It does not. A password is something you choose and can reset. A seed phrase is generated randomly by your wallet software, and no one can reset it — not the wallet manufacturer, not any company, not any government. There is no “forgot my seed phrase” button. This is the price and the power of self-sovereignty.

How the BIP39 Word List Works

BIP39 stands for Bitcoin Improvement Proposal 39, a technical standard published in 2013 that defines how seed phrases are generated. Before BIP39, wallet backups were raw strings of hexadecimal characters — error-prone and hostile to write down. BIP39 replaced that with a structured word-based system that dramatically reduces human error.

The 2,048-Word List

BIP39 defines a fixed list of exactly 2,048 English words. Each word corresponds to a number from 0 to 2,047. The words were specifically selected to meet several criteria:

• The first four letters of each word are unique. This means you only need the first four characters to identify any word unambiguously. “abandon” can be identified as “aban,” “abstract” as “abst,” and so on. Many metal backup tools take advantage of this by only requiring four letters per word.
• Similar-looking words are avoided. The list minimizes words that could be confused when handwritten (e.g., no “woman” and “women” in the same list).
• Common, simple words are preferred. Most BIP39 words are everyday English: “apple,” “bird,” “coast,” “door.” This makes them easier to read, write, and remember accurately.

The full English BIP39 word list is published openly in the official BIP39 specification on GitHub. Word lists also exist in Spanish, Japanese, Korean, Chinese (Simplified and Traditional), French, Italian, Czech, and Portuguese — but the English list is the universal standard. Using the English list ensures maximum compatibility across wallet software.

From Entropy to Words

Here’s how the generation process works, step by step:

1. Generate entropy. The wallet generates a random number. For a 12-word phrase, this is 128 bits of entropy. For a 24-word phrase, it’s 256 bits.
2. Calculate checksum. The software takes the SHA-256 hash of the entropy and appends the first few bits of that hash as a checksum. For 128-bit entropy, 4 checksum bits are added (total: 132 bits). For 256-bit entropy, 8 checksum bits are added (total: 264 bits).
3. Split into 11-bit groups. The combined bits are divided into groups of 11 bits each. Since 2^11 = 2,048, each group maps to exactly one word in the BIP39 list.
4. Look up words. Each 11-bit number is used as an index to look up the corresponding word. 132 bits ÷ 11 = 12 words. 264 bits ÷ 11 = 24 words.

The checksum embedded in the last word means that if you accidentally change one word, a properly implemented wallet will detect the error during recovery. This isn’t foolproof — it won’t catch every possible mistake — but it catches most single-word errors.

A Concrete Example

Imagine the wallet generates the 128-bit random number. Expressed in binary, that’s a string of 128 zeros and ones. The SHA-256 hash is computed, and the first 4 bits are appended, making 132 bits. Those 132 bits are split into twelve 11-bit segments. Segment one might be 00000000000 (decimal 0), which maps to “abandon” — the first word on the list. Segment two might be 00000000001 (decimal 1), mapping to “ability.” And so on for all 12 words.

This mathematical mapping is deterministic: the same entropy always produces the same words, and the same words always reconstruct the same entropy. No information is lost in the conversion.

12 Words vs. 24 Words: Which Should You Use?

The choice between a 12-word and 24-word seed phrase comes down to the level of entropy — the raw randomness that protects your wallet from brute-force attacks.

Feature	12-Word Seed Phrase	24-Word Seed Phrase
Entropy	128 bits	256 bits
Possible combinations	2128 ≈ 3.4 × 1038	2256 ≈ 1.16 × 1077
Checksum bits	4	8
Common usage	Mobile wallets, some desktop wallets	Hardware wallets (Coldcard, Trezor, Ledger)
Security level	Far beyond brute-force capability	Far, far beyond brute-force capability

To put the numbers in perspective: 2¹²⁸ is approximately 340 undecillion (340 followed by 36 zeros). If every computer on Earth tried a billion seed phrases per second, it would take trillions of times the current age of the universe to try them all. The 24-word version, 2²⁵⁶, is the square of that — a number so vast it exceeds the estimated number of atoms in the observable universe.

Practical Recommendation

Both lengths are secure against any known or foreseeable brute-force attack. The practical considerations are:

• Use 24 words for hardware wallets and long-term cold storage. Most hardware wallets generate 24-word phrases by default. The extra security margin is free, and you’re already committed to careful physical backup.
• 12 words are acceptable for mobile wallets with smaller balances. The reduced length makes manual backup slightly easier, and the security is still astronomical.
• Never reduce entropy below 12 words (128 bits). Some obscure wallets have used shorter phrases — avoid them.

If you’re purchasing a hardware wallet for the first time, check out the hardware wallet buying guide for current recommendations.

From Seed Phrase to Private Keys: The Derivation Process

The seed phrase itself is not directly used as a private key. Instead, it goes through a multi-step derivation process that generates an entire tree of keys. Understanding this process explains why one seed phrase can produce unlimited Bitcoin addresses.

Step 1: Seed Phrase → Binary Seed (BIP39)

The words are fed into a key-stretching function called PBKDF2, along with an optional passphrase (more on this in Lesson 2.4). PBKDF2 runs 2,048 rounds of HMAC-SHA512 hashing, producing a 512-bit binary seed. This step is intentionally slow to make brute-force attacks more expensive.

If you use a passphrase, it’s combined with the seed words during this step. A different passphrase (or no passphrase) produces a completely different 512-bit seed — and therefore a completely different wallet. This is the basis of the “25th word” concept.

Step 2: Binary Seed → Master Key (BIP32)

The 512-bit seed is processed through HMAC-SHA512 to produce a master private key and a master chain code. Together, these form the root of a hierarchical deterministic (HD) wallet tree, as defined in BIP32.

Step 3: Master Key → Child Keys (Derivation Paths)

From the master key, the wallet derives child keys using a path notation like:

m / purpose' / coin_type' / account' / change / address_index

Different derivation paths correspond to different Bitcoin address formats:

BIP Standard	Path	Address Type	Starts With
BIP44	m/44’/0’/0′	Legacy (P2PKH)	1…
BIP49	m/49’/0’/0′	Nested SegWit (P2SH-P2WPKH)	3…
BIP84	m/84’/0’/0′	Native SegWit (P2WPKH)	bc1q…
BIP86	m/86’/0’/0′	Taproot (P2TR)	bc1p…

Each path produces a completely independent sequence of keys and addresses. A modern wallet typically scans all standard paths during recovery to find your funds.

Why This Architecture Matters

The HD wallet structure means:

• One backup covers everything. Your seed phrase backs up every address the wallet has generated or ever will generate.
• No address reuse is needed. The wallet can generate a fresh address for every transaction, improving privacy, all from the same seed.
• Different wallets can derive the same addresses. Because the derivation process is standardized, you can recover funds across different wallet software — as long as it follows BIP39/BIP32 standards.

For a deeper look at the relationship between seed phrases and the keys they produce, see Seed Phrase vs. Private Key: The Key Difference.

How to Recover a Wallet Using Your Seed Phrase

Wallet recovery is the reason your seed phrase exists. Whether your phone breaks, your hardware wallet is stolen, or you’re migrating to new software, recovery follows the same basic process.

Step-by-Step Recovery Process

1. Get a compatible wallet application. Any wallet that supports BIP39 recovery will work. This includes hardware wallets (Coldcard, Trezor, Ledger, BitBox02), desktop wallets (Sparrow, Electrum), and mobile wallets (BlueWallet, Nunchuk). You do not need to use the same brand or software as the original wallet.
2. Select “Recover” or “Import” wallet. Every BIP39-compatible wallet has this option during setup.
3. Enter your words in the exact correct order. The wallet will prompt you to enter each word. Type them precisely as written on your backup. Many wallets offer auto-complete after the first few characters.
4. Enter your passphrase if you used one. If you set a BIP39 passphrase (the “25th word”), enter it when prompted. Omitting it or entering it incorrectly will open a different (empty) wallet — not produce an error.
5. Wait for the wallet to scan the blockchain. The wallet re-derives your keys and scans Bitcoin’s blockchain for any transactions associated with your addresses. Depending on the wallet and your transaction history, this can take seconds to several minutes.
6. Verify your balance and transaction history. Once the scan is complete, you should see your full balance and all historical transactions.

Why Word Order Matters

Seed phrase words are not a set — they are a sequence. The order encodes specific bits of data. If you enter the same 12 or 24 words in a different order, the wallet will derive completely different keys and produce a completely different (empty) wallet. In many cases, a wrong order will also fail the checksum validation, and the wallet will reject the input.

When writing down your seed phrase, always number each word. Write “1. abandon 2. ability 3. able …” — never just a list without numbers.

What If Recovery Shows Zero Balance?

If your wallet shows zero balance after recovery, check these common causes:

• Wrong word order. Double-check each word against your backup, paying attention to the numbering.
• Missing or wrong passphrase. If you used a passphrase and didn’t enter it, you’re looking at the wrong wallet.
• Wrong derivation path. Some wallets default to different address types. Try selecting different script types (Legacy, SegWit, Taproot) in the wallet settings.
• Incomplete blockchain scan. Some wallets need to scan more addresses. Look for a “gap limit” setting and increase it.

Critical Seed Phrase Security Rules

Your seed phrase is the one thing an attacker needs to steal all your bitcoin. Every security measure you take should focus on protecting these words. Here are the non-negotiable rules:

Rule 1: Never Enter Your Seed Phrase on a Computer or Phone

The only time your seed phrase should touch a digital device is during wallet recovery on a trusted device — ideally a hardware wallet. Never type it into a website, browser extension, email, messaging app, or any online form. Phishing attacks that ask for your seed phrase are the number-one way people lose their bitcoin.

Rule 2: Never Photograph or Screenshot Your Seed Phrase

Photos sync to cloud services (iCloud, Google Photos) automatically. Screenshots are stored in accessible folders. Any image of your seed phrase is a digital copy that can be extracted by malware, seen in a data breach, or accessed by anyone with your cloud account credentials.

Rule 3: Never Store Your Seed Phrase Digitally

No email drafts. No Google Docs. No Notes app. No password managers (unless you deeply understand the threat model and accept the risks). No encrypted files on your desktop. Digital storage creates digital attack surfaces. Your seed phrase should exist only in physical form.

Rule 4: Never Share Your Seed Phrase with Anyone

No legitimate company, wallet provider, support representative, or Bitcoin developer will ever ask for your seed phrase. Anyone who asks is attempting to steal your bitcoin — without exception. This includes people on social media, in Discord groups, on Reddit, or in Telegram channels claiming to offer “help.”

Rule 5: Write It Down Immediately and Securely

The moment your wallet displays your seed phrase, write it down on paper. Then, consider upgrading to a metal backup for fire and flood resistance. Your next lesson — Seed Phrase Storage Best Practices — covers storage strategies in detail.

For a comprehensive deep dive on every aspect of protecting your seed, see The Complete Guide to Bitcoin Seed Phrase Security.

Common Seed Phrase Mistakes

Even careful users make errors that put their bitcoin at risk. Here are the most frequent mistakes and how to avoid them.

Writing Words in the Wrong Order

As discussed above, word order is data. Always number your words when writing them down. Use a pen (not pencil, which fades) and write clearly. If your handwriting is poor, use block capitals.

Misspelling Words

BIP39 words were chosen so that the first four letters of each word are unique within the list. If you can read the first four letters, you can unambiguously identify the word. However, a misspelled word on your backup could cause confusion during recovery. Always cross-reference your written backup against the BIP39 word list — especially for words that look similar.

Storing the Backup in a Vulnerable Location

A seed phrase written on paper and left in a desk drawer is vulnerable to fire, flood, curious visitors, and cleaning crews. A backup stored only in a single location is one disaster away from total loss. Use fire-resistant storage and consider multiple geographic locations.

Creating Only One Copy

A single backup is a single point of failure. If that one copy is destroyed, your bitcoin is gone. Most security experts recommend at least two physical copies stored in separate locations. The trade-off is that more copies increase theft risk, so each copy must be physically secured.

Not Testing Recovery Before Loading Funds

This is perhaps the most dangerous mistake: sending bitcoin to a new wallet without first confirming that you can successfully recover it from the seed phrase. Always perform a test recovery on a separate device before trusting the wallet with real funds. For a full walkthrough, see How to Test Your Seed Phrase Backup.

Generating Your Own Seed Phrase

Humans are terrible at generating randomness. If you pick words yourself — even if they “feel random” — the result is dramatically less secure than a properly generated random seed. Always let your wallet software or hardware wallet generate the seed phrase. The cryptographic random number generator in your device is purpose-built for this task.

Frequently Asked Questions

What happens if I lose my seed phrase?

If you lose your seed phrase and your wallet device also fails or is lost, your bitcoin is permanently inaccessible. No company, developer, or authority can recover it for you. This is why having multiple physical backups in separate secure locations is essential. As long as your wallet device still works, you can display the seed phrase again (on most wallets) and create a new backup — do this immediately if your original backup is compromised.

Can someone guess my seed phrase?

Not with current or foreseeable technology. A 12-word seed phrase has 2¹²⁸ possible combinations — that’s 340,282,366,920,938,463,463,374,607,431,768,211,456 possibilities. A 24-word phrase has 2²⁵⁶. Even if an attacker could check a trillion seed phrases per second, exhausting a 12-word seed phrase would take roughly 10¹⁹ years — billions of times the age of the universe. Your seed phrase is not going to be guessed.

Are all seed phrases 24 words?

No. BIP39 supports seed phrases of 12, 15, 18, 21, or 24 words, corresponding to 128, 160, 192, 224, or 256 bits of entropy. In practice, 12 and 24 are by far the most common. Most hardware wallets default to 24 words. Some mobile wallets use 12 words. The other lengths are rarely used.

Can I create my own seed phrase by choosing words?

You should not. Human-chosen “randomness” is predictable and dramatically weakens security. Cryptographic random number generators are specifically designed to produce true randomness. Let your wallet software or hardware device generate the seed phrase. Advanced users who want to add their own entropy sometimes use dice rolls combined with the wallet’s randomness — but this requires a deep understanding of the process and should never be done by overriding the wallet’s built-in generator entirely.

What’s the difference between a seed phrase and a private key?

A private key is a single cryptographic key that controls one specific Bitcoin address. A seed phrase is the master backup from which an unlimited number of private keys can be derived. Think of it this way: the seed phrase is the root of a tree, and private keys are the branches. If you have the root, you can regrow every branch. For a detailed comparison, read Seed Phrase vs. Private Key: The Key Difference.