BIP39 Mnemonic

about this tool

What a BIP39 phrase is

A recovery phrase is a long random number written as words. The number, called the entropy, is 128 to 256 random bits. A checksum is added (the first few bits of the SHA-256 of the entropy), and the whole is cut into 11-bit pieces, each naming one of the 2048 words on the BIP39 list. Twelve words hold 128 bits; twenty-four hold 256.

Every word on the English list is told apart by its first four letters, so lega is enough for legal. The checker reads four-letter abbreviations, and longer starts of a word when they could not also be a typo for another word, and says what it read each one as.

Three ways to use it

• New phrase draws fresh entropy from your browser's cryptographic random source and writes it as 12, 15, 18, 21 or 24 words.
• Check a phrase checks each word against the list, suggests the word you probably meant for any that is not on it, checks the count, and checks the checksum, as a wallet does when it restores. A backup written as a numbered list reads the same as the bare words. A phrase can be made of real words and still fail the checksum: a word is wrong, or two are swapped. The checksum is a few bits, so about one wrong phrase in 16 still passes at 12 words, and one in 256 at 24.
• From entropy turns entropy written as hex into its phrase, for checking another tool or the published test vectors.

The seed

A wallet does not use the words directly. It turns them into a 64-byte seed with PBKDF2-HMAC-SHA512: 2048 rounds, the words as the password, and mnemonic plus an optional passphrase as the salt, all normalised to Unicode NFKD so the same text always gives the same seed. A different passphrase gives a different seed, and so a different wallet, from the same words. The results match the reference test vectors.

Safety and limits

A phrase is the money it protects. Make one for real savings on a hardware wallet or an offline machine; anything a browser shows can be read by its extensions or a screen recording. Nothing here is sent, stored, or put in the page's address. The tool stops at the seed: deriving keys and addresses from it (BIP32 and BIP44) is the wallet's job. Only the English word list is included.

For passwords rather than recovery phrases, use the password generator.

questions

Is it safe to make a recovery phrase in a browser?

For learning and testing, it is fine: the phrase is made from your browser’s cryptographic random source and nothing is sent or stored. For real savings, make the phrase on a hardware wallet or an offline machine, because anything shown in a browser can be read by its extensions or a screen recording. Never type a phrase that holds funds into any web page, this one included.

How does the checker know a phrase is wrong?

The last word of a BIP39 phrase carries a checksum: a few bits of the SHA-256 of the rest. Change a word, or swap two, and the checksum fails 15 times in 16 for a 12-word phrase and 255 times in 256 for 24 words. So the checker catches a misspelt word (and suggests the words you probably meant), a phrase of the wrong length, and most phrases whose words are all real but wrong; a phrase that passes is very likely, not certain, to be the one you wrote down.

What is the passphrase?

An optional extra, sometimes called the 25th word. The seed is derived from the phrase and the passphrase together, so the same twelve words with a different passphrase open a different wallet. Lose the passphrase and the words alone will not bring the funds back.

Are 12 words enough, or should I use 24?

Twelve words carry 128 bits of entropy, far beyond any brute-force search, and most wallets use them. Twenty-four words carry 256 bits; they guard against weakness in the random source rather than against guessing. Either is fine for a phrase made with good randomness.

Does it derive addresses?

No. It goes as far as the 64-byte BIP39 seed, which is the same for every coin. Turning that seed into keys and addresses is the wallet’s job (BIP32 and BIP44), and differs between coins and wallets.