A seed phrase is a list of words, usually 12, 20 or 24, that serves as the master backup of your whole Bitcoin wallet. It’s also called a mnemonic, recovery phrase or backup phrase. The words encode one secret number from which every private key and address in your wallet is calculated. In What Is a Bitcoin Wallet? and Custodial vs Non-Custodial Wallets you saw that controlling your own keys is what makes Bitcoin ownership real. The seed phrase is how you keep that control, and how you get it back if your device is lost, stolen or destroyed.
This lesson covers the standard behind most seed phrases (BIP39), how words become keys, 12 versus 24 words, the recovery phrases that are not BIP39, and the rules that keep your words safe.
What Is a Seed Phrase?
When you set up a new wallet, whether a phone app like BlueWallet or a hardware device like a Coldcard, it generates a large random number and turns it into a list of words you can write down. That list is your seed phrase.
Here’s a 12-word list made of real words from the standard list:
abandon ability able about above absent absorb abstract absurd abuse access accident
(Never use a published example for a real wallet. This one isn’t even valid: its last word fails the checksum, so a wallet that follows the standard warns you or refuses it. You’ll see why below.)
A seed phrase has three defining properties:
- It encodes your master secret. Every address and private key your wallet will ever produce is calculated from these words.
- It’s portable. Type the words into another compatible wallet and it rebuilds the same wallet, with the same addresses and balance.
- It’s the single point of recovery and the single point of failure. Anyone who has the words has your bitcoin. Lose them and break your device, and the bitcoin is gone.
Seed Phrase vs. Password
A seed phrase is not a password. You choose a password and can reset it. A seed phrase is generated at random by your wallet, and nobody can reset it: not the maker, not any company, not any government.
How the BIP39 Word List Works
BIP39 (Bitcoin Improvement Proposal 39) is a standard published in 2013 that defines how most wallets turn a random number into words and back. Before it, many backups were long strings of hexadecimal characters, easy to miscopy. Words are much easier to write and read correctly.
The 2,048-Word List
BIP39 fixes a list of exactly 2,048 English words, each standing for a number from 0 to 2,047. The words were chosen so that:
- The first four letters of each word are unique. “aban” can only be “abandon”, “abst” only “abstract”. Many metal backups record just four letters per word.
- Similar words are avoided. The list leaves out pairs that are easy to confuse, such as “woman” and “women”.
- Words are common and simple. “apple”, “bird”, “coast”, “door”: easy to read and write accurately.
The full list is in the official BIP39 specification on GitHub. Lists also exist in Spanish, Japanese, Korean, Chinese (simplified and traditional), French, Italian, Czech and Portuguese, but English is by far the most widely supported, so it’s the safest choice.
From Random Number to Words
- Generate randomness. The wallet picks a random number: 128 bits for 12 words, 256 bits for 24.
- Add a checksum. It hashes that number with SHA-256 and appends the first few bits of the result: 4 bits for 128-bit numbers (132 bits in total), 8 bits for 256-bit numbers (264 in total). The checksum is a built-in error check.
- Split into 11-bit groups. Since 211 = 2,048, each group of 11 bits picks exactly one word: 132 ÷ 11 = 12 words; 264 ÷ 11 = 24 words.
The last word is a mix. In a 12-word phrase it holds the final 7 bits of the random number plus the 4 checksum bits; in a 24-word phrase, the final 3 bits plus 8 checksum bits. Because the checksum is calculated from the whole number, a wallet that follows the standard usually notices if you change any word. It isn’t foolproof: with 12 words, about one random single-word error in 16 still passes.
A Concrete Example
Suppose the random number were 128 zeros (a terrible choice for a real wallet, but easy to follow). Split into 11-bit groups, the first eleven groups are all 00000000000, number 0, which is “abandon”, the first word on the list. The twelfth group holds the last 7 zero bits plus the 4 checksum bits, which come out as 0011, so it’s number 3: “about”. The valid phrase is:
abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about
Now look again at the list near the top of this lesson. Its last word, “accident”, carries checksum bits that don’t match the number its twelve words spell out, so a wallet warns you or refuses it. That’s the checksum catching a phrase that was copied or made up wrongly.
What the checksum doesn’t do is decide the last word for you. For any eleven words, 128 of the 2,048 words on the list would complete a valid phrase (for 24 words, 8 would), and only one of them is yours. So the last word has to be written down and kept like all the others.
The mapping works both ways: the same number always gives the same words, and the same words always give back the same number.
12 Words vs. 24 Words: Which Should You Use?
| Feature | 12-Word Phrase | 24-Word Phrase |
|---|---|---|
| Randomness (entropy) | 128 bits | 256 bits |
| Possible combinations | 2128 ≈ 3.4 × 1038 | 2256 ≈ 1.16 × 1077 |
| Checksum bits | 4 | 8 |
| Who makes it by default | Many phone wallets, such as Phoenix | Ledger, Coldcard and BitBox02 (Trezor Safe devices default to 20 words, a different standard: see below) |
| Security | Far beyond brute force | Far, far beyond brute force |
To put the numbers in perspective: 2128 is about 340 followed by 36 zeros. At a trillion guesses per second, trying them all would take about 1019 years, nearly a billion times the age of the universe. 2256 is 2128 multiplied by itself.
Practical Recommendation
- Either length is safe if the randomness behind it is real. Use whatever your hardware wallet makes; for long-term storage, 24 words give a free extra margin.
- 12 words are fine for phone wallets with spending money, and a little easier to write down.
- Avoid anything below 12 words (128 bits).
Word count sets the maximum randomness, not the actual randomness. In July 2026 Coinkite disclosed a firmware flaw that made some Coldcard seeds far weaker than their length suggests: about 40 bits on the Mk2 and Mk3 and about 72 bits on the Mk4, Q and Mk5, by its own preliminary estimates (Coinkite’s technical backgrounder). A seed should have at least 128. If a Coldcard made your seed, use our two-minute Coldcard check. For dice rolls, see “Can I add my own randomness?” in the FAQ.
Not Every Recovery Phrase Is a BIP39 Seed
Many guides, including older versions of this one, say any 12 or 24 words restore anywhere. That’s only true for BIP39 phrases. Know which kind you have, because some won’t restore in an ordinary Bitcoin wallet:
- Trezor Safe 3, 5 and 7: the default backup is 20 words using SLIP-39, a different standard with its own 1,024-word list. (A Safe 3 set up before June 2024 made 12 BIP39 words, and a Model T may have 12 or 20; count yours.) A 20-word backup restores on every Trezor except the original Trezor One, and on wallets that Trezor lists as supporting it, such as Sparrow, Electrum, BlueWallet (first account only), Wasabi and the Keystone hardware wallet, but not on Ledger or Coldcard. If you want a 12- or 24-word BIP39 backup instead, Trezor Suite lets you pick one from its backup format option when you create the wallet (Trezor: Single-share Backup).
- Electrum: creates seeds in its own format, not BIP39. They restore in Electrum but not in most other wallets. (Electrum can restore a BIP39 phrase made elsewhere.) The Electrum lesson explains.
- Wallet of Satoshi’s self-custody mode: its 12 words are a recovery phrase for Spark, a separate system. The company says they will not recreate your balance in a hardware wallet or another BIP39 wallet.
- Lightning wallets in general: even when the words are BIP39 (Phoenix’s are), they restore your Lightning balance only in the same app. Another wallet may show nothing, because Lightning funds sit in payment channels the app manages. The Lightning wallets lesson covers this.
Rule of thumb: write down, next to your words, which wallet made them and which standard they use.
From Seed Phrase to Private Keys: The Derivation Process
In plain terms: your words are turned into one big secret number, and every key and address is calculated from that number in a fixed, repeatable way. That’s why one phrase backs up unlimited addresses. The steps below show how; you can skip to “Why This Architecture Matters” if you don’t need the detail.
Step 1: Words → Binary Seed (BIP39)
The words, plus an optional passphrase (see Seed Phrase Storage), go through a deliberately slow function called PBKDF2, which runs 2,048 rounds of HMAC-SHA512 and produces a 512-bit seed. A different passphrase, or none, gives a completely different seed and therefore a completely different wallet. That’s the idea behind the “25th word”.
Step 2: Binary Seed → Master Key (BIP32)
The 512-bit seed is hashed once more to produce a master private key and a “chain code”. Together they are the root of a hierarchical deterministic (HD) tree of keys, defined in BIP32.
Step 3: Master Key → Child Keys (Derivation Paths)
From the root, the wallet calculates child keys along a path, written like:
m / purpose' / coin_type' / account' / change / address_index
Different paths give different address formats:
| BIP Standard | Path | Address Type | Starts With |
|---|---|---|---|
| BIP44 | m/44'/0'/0' | Legacy (P2PKH) | 1... |
| BIP49 | m/49'/0'/0' | Nested SegWit (P2SH-P2WPKH) | 3... |
| BIP84 | m/84'/0'/0' | Native SegWit (P2WPKH) | bc1q... |
| BIP86 | m/86'/0'/0' | Taproot (P2TR) | bc1p... |
Each path gives a completely separate set of addresses. Many wallets scan the common paths when you restore; some only check one, which is why a restore can look empty (see below). Which address type to choose, and how to tell them apart, is the subject of Bitcoin Address Types and Derivation Paths.
Why This Architecture Matters
- One backup covers everything the wallet has made or ever will make.
- A fresh address every time, which helps privacy, all from the same seed.
- Different wallets can rebuild the same addresses, as long as both follow BIP39/BIP32 and use the same path.
More in Seed Phrase vs. Private Key: The Key Difference.
How to Recover a Wallet Using Your Seed Phrase
Step-by-Step Recovery Process
- Get a compatible wallet. For a BIP39 phrase that includes hardware wallets (Coldcard, Trezor, Ledger, BitBox02), desktop wallets (Sparrow, Electrum) and phone wallets (BlueWallet, Nunchuk); you don’t need the same brand. For a Trezor 20-word backup, use a Trezor other than the original Trezor One, or a wallet that supports SLIP-39. For savings, restore on a hardware wallet: you type the words on the device itself, while a desktop or phone wallet puts them on an internet-connected machine (Rule 1 below).
- Choose “Recover”, “Restore” or “Import”.
- Enter the words in the exact order, spelled as written. Many wallets auto-complete after a few letters.
- Enter your passphrase if you used one. A missing or wrong passphrase opens a different, empty wallet, with no error message.
- Let the wallet scan. It recalculates your addresses and looks up their history; this takes seconds to minutes.
- Check the balance and history against what you expect.
Why Word Order Matters
The words are a sequence, not a set. Like a phone number, the same digits in a different order reach someone else: the same words in a different order make a different wallet, and usually fail the checksum. Always number each word when you write it: “1. abandon 2. ability 3. able…”.
What If Recovery Shows Zero Balance?
- Word order or spelling. Check each word against your backup and its number.
- Passphrase. If you used one and didn’t enter it (or mistyped it), you’re looking at a different wallet.
- Derivation path or address type. Try the other script types in the wallet’s settings (Legacy, Nested SegWit, Native SegWit, Taproot); the address types lesson shows how to work out which one your old wallet used.
- Scan depth. Some wallets stop after a number of unused addresses; look for a “gap limit” setting and raise it.
- Backup type. A Trezor 20-word backup, an Electrum seed or a Lightning wallet’s words may simply not restore in this wallet (see the section above).
Don’t start typing your words into other programs to experiment. Wallets Recovery lists the paths each wallet uses, and your wallet’s maker can help through its official website. Real support never asks for your words.
Critical Seed Phrase Security Rules
Rule 1: Enter Your Words Only to Restore, Only in a Real Wallet
Your words go into a device only to restore a wallet or to run your hardware wallet’s built-in backup check. Words that protect savings are typed only on the hardware wallet itself. A small spending wallet’s words go only into a genuine wallet app you installed yourself from the maker’s official website or app store. For a Lightning wallet, restore the Lightning balance in the same app that created the words, and use another wallet only where the maker’s own instructions say so: Phoenix, for example, tells you to use Electrum for funds that come back on-chain after a force-close (see the Lightning wallets lesson). Never type your words into a website, browser extension, email, message, online form or support chat. Fake wallet apps, fake “support” and phishing sites that ask for the words are among the most common ways people lose bitcoin.
Rule 2: Never Photograph or Screenshot Them
Photos sync to cloud services automatically, and any image is a digital copy that malware, a data breach or anyone with your cloud login can reach.
Rule 3: Never Store Them Digitally
No email drafts, documents, notes apps, password managers or encrypted files. Keep the words only on paper or metal.
Rule 4: Never Share Them
No real company, wallet maker, support agent or developer will ever ask for your words. Anyone who does, on social media, Discord, Reddit, Telegram or by phone, is trying to steal your bitcoin. The Scams That Empty Self-Custody Wallets shows how these tricks work.
Rule 5: Write Them Down Immediately
When the wallet shows the words, write them on paper straight away, numbered. Where to keep them, and when to move them onto metal, is the subject of Seed Phrase Storage: Metal Backups, Passphrases and Best Practices.
Common Seed Phrase Mistakes
- Writing words out of order or unnumbered. Order is data. Use a ballpoint pen and clear block capitals.
- Misspelling words. Check your written copy against the right list: BIP39’s 2,048 words, or Trezor’s SLIP-39 list for a 20-word Trezor backup.
- Keeping a single copy in one place. One fire or theft takes it. Seed Phrase Storage covers copies and locations.
- Not testing the backup before loading funds. For savings, use your hardware wallet’s built-in check, which erases nothing: you type the words from the paper on the device and it tells you if they match. Never type savings words into a phone or computer to test them. A small phone wallet with no hardware wallet behind it is tested in that same genuine app before you load money: restore it from your paper (on another phone, or on the same one after deleting the still-empty wallet) and check that it shows the same first receiving address. See How to Test Your Seed Phrase Backup.
- Choosing your own words. People are bad at randomness; words that “feel random” are much easier to guess. Let the wallet generate the phrase.
Frequently Asked Questions
What happens if I lose my seed phrase?
If you also lose or break the device, the bitcoin is gone for good; nobody can recover it. If the device still works, act now: move the funds to a new wallet with a new seed and a new, tested backup. Trezor gives the same advice for a lost backup: move the funds first, then wipe the device (Trezor: move crypto to a new wallet backup). If someone may have seen your words, a fresh copy of the same words doesn’t help; only a new seed does.
Can someone guess my seed phrase?
Not if it was made from real randomness: a 12-word phrase has 2128 possibilities, and checking a trillion per second would take about 1019 years. The exception is a seed made from broken randomness. The Coldcard flaw disclosed in July 2026 produced seeds attackers could search, and wallets built on them were emptied (our Coldcard advisory has the details).
Are all seed phrases 12 or 24 words?
BIP39 allows 12, 15, 18, 21 or 24 words (128 to 256 bits); 12 and 24 are by far the most common. Ledger always makes 24; Coldcard lets you pick 12 or 24; BitBox02 defaults to 24. Trezor Safe devices now default to 20 words, which are SLIP-39, not BIP39.
Can I add my own randomness with dice?
You can, and you don’t have to. For most people the device’s normal setup is the right choice. Dice help only if each roll is a real throw of a fair die, entered as it lands, never recorded and kept private; done carelessly, they can make a seed weaker. About 99 rolls of a six-sided die supply roughly 256 bits. For the July 2026 Coldcard flaw, Coinkite says it does not consider a seed at risk from that flaw alone if at least 50 fair, private rolls were added when it was made. Devices use rolls differently: some mix them with their own randomness, while the BitBox02’s dice method uses your rolls instead of it. Enter the rolls (or the words they give you) only on the hardware wallet itself, following its instructions. Our dice rolls guide shows the arithmetic.
Can I create my own seed phrase by choosing words?
No. Human choices are predictable and much easier to guess. Let the wallet generate the words.
What’s the difference between a seed phrase and a private key?
A private key controls only the coins locked to that one key, which a wallet normally uses for a single address. A seed phrase is the root from which an unlimited number of private keys are calculated: have the root and you can regrow every branch. Read Seed Phrase vs. Private Key.
Already Have a Seed?
Most seeds are fine. Five questions find the few that aren’t, and you can answer them without typing or showing your words anywhere: they’re at the end of Seed Phrase Storage, and our seed backup checkup walks you through them one by one.
Check Your Understanding
1. Why does “abandon ability able … access accident” fail in a wallet while “abandon … abandon about” works?
Answer
The last word holds the final 7 bits of the random number plus a 4-bit checksum calculated from all 128 bits. In “abandon … abandon about” those checksum bits match the number the words spell out; in “abandon ability … access accident” they don’t, so the wallet knows the list is wrong. The first eleven words don’t fix the last one, though: 128 of the 2,048 words would make a valid phrase with them, so a lost last word can’t be read off the others.
2. Your Trezor Safe 5 showed you 20 words. Can you restore them on a Ledger?
Answer
No. A 20-word Trezor backup uses SLIP-39, not BIP39. It restores on every Trezor except the original Trezor One, and on wallets that support SLIP-39 (Trezor’s list includes Sparrow, Electrum, BlueWallet, Wasabi and the Keystone hardware wallet; BlueWallet restores only the first account), not on Ledger or Coldcard. If you need a BIP39 backup, choose the 12- or 24-word format when you create the wallet.
3. You restored your words in a new wallet and it shows a zero balance. What do you check, and what don’t you do?
Answer
Check word order and spelling, whether you used a passphrase, the address type or derivation path, the scan depth (gap limit), and whether the backup type is supported by that wallet. Don’t type your words into other apps or websites to experiment, and don’t give them to anyone offering help.