BIP-85 Explained: Derive Multiple Seeds From One

The evolution of Bitcoin wallet security and management has led to numerous innovations in how we handle private keys and seed phrases. Among these developments, BIP-85 stands as a particularly elegant solution to the challenge of managing multiple wallets while maintaining robust security practices. This sophisticated protocol enables users to derive multiple deterministic seed phrases from a single parent seed, revolutionizing how we approach wallet hierarchies and backup management.

The fundamental architecture of BIP-85 builds upon several core concepts in Bitcoin’s technical infrastructure, particularly the foundations laid by BIP-39 and BIP-32. At its heart, BIP-85 operates not on the mnemonic phrases themselves, but rather on the underlying cryptographic material - specifically, the BIP-32 root extended private key. This distinction is crucial for understanding the protocol’s flexibility and capabilities.

When we examine the technical implementation of BIP-85, we find that it’s agnostic to the length of the parent seed phrase. Whether using 12 words or 24 words, the critical element is that the parent seed successfully generates a valid BIP-32 root extended private key. This key serves as the foundation for all subsequent derivations, making the original mnemonic length irrelevant to the protocol’s operation.

The protocol’s design demonstrates remarkable elegance in its approach to entropy generation. Rather than working directly with mnemonic phrases, BIP-85 leverages the BIP-32 infrastructure to create deterministic entropy, which can then be used to generate new mnemonic phrases of varying lengths, from 12 to 24 words. This process ensures that child seeds are both secure and recoverable, provided one maintains access to the parent seed.

Five boxes from left to right. Any wallet does the first two: your 12 or 24 parent words, plus an optional passphrase, become a 512-bit seed and then a root key (the BIP32 master key). BIP-85 starts from that key, so a 12-word and a 24-word parent both work. It derives a child key at a fixed path for each child, mixes it one way with HMAC-SHA512 into 512 bits, and keeps the first 128 or 256 bits as 12 or 24 new words. There is no way back from the child words to the parent's. The same parent, passphrase and path always give the same child words, and a weak or exposed parent makes every child weak or exposed too. — **BIP-85 starts from the root key, not from the words.** A one-way mix turns the parent’s key into fresh randomness, and that randomness becomes ordinary 12 or 24 words. The same inputs always give the same child; the child can’t lead back to the parent.

Implementation of BIP-85 across various hardware wallets and software solutions has sometimes led to confusion regarding requirements and capabilities. While some implementations might impose specific requirements, these should be understood as implementation choices rather than protocol limitations. The BIP-85 specification itself places no restrictions on the parent seed’s mnemonic length.

The practical implications of this design are significant for Bitcoin users managing multiple wallets. The ability to derive child seeds from any valid parent seed, regardless of its length, provides greater flexibility in wallet management strategies. Users can maintain a single secure parent seed while generating multiple child wallets for various purposes, each with its own independent seed phrase.

Security considerations in BIP-85 implementations deserve careful attention. The protocol’s design ensures that child seeds are cryptographically secure and independent, while maintaining deterministic derivation from the parent seed. This balance between security and recoverability makes BIP-85 particularly valuable for both individual users and institutional applications.

Looking toward the future, BIP-85’s flexible design positions it well for continued adoption and integration into various Bitcoin custody solutions. The protocol’s ability to work with different seed lengths and generate various types of child entropy makes it adaptable to evolving security needs and wallet implementations.

As we conclude this analysis, it’s worth emphasizing that BIP-85’s power lies in its ability to create deterministic hierarchies of wallets while maintaining robust security properties. The protocol’s independence from parent mnemonic length demonstrates the elegant separation of concerns between human-readable seed phrases and the underlying cryptographic operations that secure our Bitcoin.

Step-by-Step Guide

Follow these steps to set up BIP-85 derived wallets using a compatible hardware wallet.

1. Verify Your Hardware Wallet Supports BIP-85

Check your device’s firmware documentation for BIP-85 support. Coldcard has it in its menu (Advanced/Tools on the Mk4, Mk5 and Q). Blockstream Jade offers it under Options > Wallet > BIP85, with 12- or 24-word children. SeedSigner can also derive BIP-85 child seeds. If your device does not support BIP-85, don’t work around it with a web page or a program on a computer, even an offline one: that means typing your parent seed into a computer, and the parent unlocks every child. Use a device that supports it, or skip BIP-85.

2. Secure Your Parent Seed

Your parent seed is the master key from which all child seeds derive. Stamp or engrave it on a metal backup plate. Store it in a secure location — a home safe or bank safe deposit box — and keep two or three complete copies in separate places. If the parent has a passphrase, back that up too, stored apart from the words: without the exact passphrase, the parent words can’t regenerate the children derived under it. The parent seed lives on paper, metal and the hardware wallet that derives the children; it is never typed into a computer or phone, online or offline (see Seed Phrase Storage). If the parent seed is compromised, every derived child wallet is compromised too. The same goes for a weak parent: if it was created on a Coldcard running firmware affected by the July 2026 flaw, every child derived from it is affected as well, unless you added at least 50 independent, private dice rolls when you created it, as the Coldcard advisory describes. If the parent is affected, replace it first and move the funds from every funded child.

3. Navigate to the BIP-85 Derivation Menu

On a Coldcard Mk4 or Mk5, go to Advanced/Tools > Derive Seed B85 (on the Q, Advanced/Tools > Derive Seeds (BIP-85)); on a Jade, Options > Wallet > BIP85. Select the child index number (starting from 0) and the desired word count for the child seed (12, 18, or 24 words on a Coldcard; 12 or 24 on a Jade). Each unique index produces a completely different child seed. Index 0 gives you one wallet, index 1 gives you a completely separate wallet, and so on.

The word count and the index are part of the child’s path. Change either one and the same parent gives an unrelated wallet, so both go on the child’s backup. The index can run to about 2.1 billion; a Coldcard allows 0 to 9,999 unless you turn on its B85 Idx Values setting.

4. Record the Derived Child Seed

Write down the child seed phrase displayed on your hardware wallet screen. This child seed functions as a fully independent wallet — it can be restored in any wallet that accepts BIP-39 words of that length (a Jade, for example, takes only 12 or 24), and for savings that should be a hardware wallet (step 5). Label it clearly with the index number used for derivation (for example, “BIP-85 child index 0, 12 words”) so you can regenerate it later if the backup is lost. If a passphrase was active on the parent when you derived the child, note that too (not the passphrase itself): the child comes from the wallet that was loaded at the time, so regenerating it later takes the parent words plus that exact passphrase. A wrong one gives no error, just different words.

5. Import the Child Seed Into a Separate Wallet

Load the child seed into the wallet it is meant for. This wallet operates independently — it has its own addresses, its own xpub, and its own transaction history. For savings, use a second hardware wallet, so the child’s words never touch a computer. A child typed into a phone or desktop wallet becomes that hot wallet’s seed: keep only spending money in it. Its exposure doesn’t reveal the parent or any other child, which is what makes this compartmentalization useful.

One parent seed, kept on a metal backup and in a hardware wallet, derives three wallets: index 0 in a phone for spending money, and indexes 1 and 2 in hardware wallets for savings. If the phone is hacked and index 0's words leak, only index 0 is exposed: the parent and the other two children stay safe. If someone gets the parent's words (and its passphrase, if it has one), all four are exposed, because the parent can make every child. Keep the parent on metal and in the hardware wallet, never in a computer or phone. — **A leaked child exposes one wallet; a leaked parent exposes them all.** That is why the spending child can live in a phone while the parent never touches one.

6. Test Recovery Before Sending Funds

Before depositing any bitcoin into the child wallet, verify that you can regenerate the same child seed from the parent. On your hardware wallet, derive index 0 again (with the same passphrase loaded, if you used one) and confirm the words match your written backup. Then restore the child seed on the destination wallet and confirm the addresses match. Only after both verifications should you begin using the child wallet.

7. Document Your Derivation Scheme

Create a map of which index numbers correspond to which wallets, purposes and address types. Store this documentation separately from your seed backups — it contains no secret material, just organizational information. For example: “Index 0 = phone spending wallet, Index 1 = savings (Coldcard #2, native SegWit), Index 2 = second savings wallet (Jade).” This map is essential for recovery if you ever need to regenerate all child wallets from the parent seed (and its passphrase, if it has one), because a wallet set to another address type can show a restored child as empty.

Common Mistakes to Avoid

1. Treating Child Seeds as Dependent on the Parent Device

A common misconception is that child wallets stop working if the parent hardware wallet breaks. BIP-85 child seeds are fully independent once generated. The child seed controls its own wallet regardless of what happens to the parent device. The parent seed is only needed to regenerate the child seed if the child backup is lost. Both parent and child backups should exist independently.

2. Forgetting the Index Number Used for Derivation

If you derive a child seed at index 3 but record it as index 2, deriving index 2 from the parent won’t bring it back. The wrong index produces a completely different seed with different addresses and no access to the funds. Always label your child seed backups with the exact index and word count used during derivation. Without this information, recovery requires brute-forcing through index numbers — possible but slow.

3. Using BIP-85 as a Substitute for Proper Backups

Some users skip backing up child seeds because they assume they can always regenerate from the parent. This creates a single point of failure: if the parent seed is destroyed or inaccessible, every child loses its only backup at once, and each wallet then lives only on its device. Back up each child seed independently on metal. BIP-85 derivation is a recovery mechanism of last resort, not a replacement for direct backups.

Four cases. If a child's written backup is destroyed, the parent (with its passphrase, if it has one) and the index map bring it back: derive the same index and word count again. If a child's phone or hardware wallet breaks, that child's own backup brings it back, or you derive it again from the parent. If the parent's hardware wallet breaks, the children keep working and you restore the parent from its metal backup. If the parent's backup and device are both lost and no child was backed up, nothing can restore them: each child lives only on its device, so send its funds to a new wallet you back up. Give every child two ways back: its own backup, and the parent (with its passphrase, if it has one) plus the index map. — **Back up the parent and every child.** With both, each child has two ways back; skip the child backups and losing the parent leaves every child hanging on a single device.

4. Deriving Child Seeds on a Computer

Running BIP-85 derivation through a web page or software wallet means typing your parent seed into a computer, and an offline machine doesn’t change that rule: the parent unlocks every child, so it must never be typed into a computer or phone. Derive children only on a hardware wallet that supports BIP-85, where the parent never leaves the device.

Frequently Asked Questions

Can I use a 12-word parent seed to derive 24-word child seeds?

Yes. BIP-85 operates on the BIP-32 root key derived from your seed, not on the mnemonic words directly. A 12-word seed produces a valid root key, and BIP-85 can derive child entropy of any length from it — including 24-word mnemonics. The child seed’s security depends on the derivation process, not on matching the parent’s word count. A child is never stronger than its parent, though: a 24-word child of a 12-word parent rests on the parent’s 128 bits of randomness, which is already far beyond brute force.

Are BIP-85 child seeds compatible with all Bitcoin wallets?

Child seeds derived via BIP-85 are standard BIP-39 mnemonic phrases. Any wallet that accepts BIP-39 seed import can use a BIP-85 derived seed — it does not matter whether the wallet knows about BIP-85 or not. The child wallet treats the seed as an ordinary mnemonic. Only the derivation side needs BIP-85 support; the receiving wallet just sees a normal seed phrase. Like any seed, a child only goes into a wallet that takes its word count (some take just 12 or 24), and when you restore one that already holds coins, set the wallet to the address type it used before, or it can look empty.

What types of entropy can BIP-85 derive besides seed phrases?

BIP-85 can derive multiple types of deterministic entropy. Beyond BIP-39 mnemonics (the specification allows 12, 15, 18, 21 or 24 words; devices usually offer 12, 18 or 24), it defines WIF private keys, XPRV extended private keys, raw hex entropy, passwords, RSA keys, dice rolls and Nostr keys. This flexibility makes BIP-85 useful for any application that needs deterministic secret material derived from a single master backup. Each output is a secret in its own right: if it goes into a computer or phone, treat it as that device’s key, and keep the parent on your hardware wallet.

How many child seeds can I derive from a single parent?

The index in BIP-85 is a hardened derivation index, which allows about 2.1 billion (2³¹) child seeds of each type from a single parent. In practice, you will never exhaust this space; a Coldcard, for example, offers indexes from 0 to 9,999 by default (to restore a child at a higher index, set Advanced/Tools > Danger Zone > B85 Idx Values to Unlimited). Each index is independent — knowing one child seed reveals nothing about the parent or any other child. You can safely create hundreds of child wallets for different purposes without any security degradation.

Related Resources

Part of our free Bitcoin course: This topic is covered in the Bitcoin Wallets & Self-Custody course.

Filed under: Bitcoin Security