Glossary · Wallet security

Mnemonic phrase

Published 22 May 2025 · Updated 21 Oct 2026 · 12 min read

A mnemonic phrase is a list of words from a fixed wordlist that encodes the random number behind a wallet's keys. Most call these words a seed phrase. In BIP-39, the words encode 128 to 256 random bits plus a short checksum. PBKDF2 turns the words and an optional passphrase into the 64-byte seed that wallet keys come from.

  • BIP-39 encodes 128 to 256 random bits plus a checksum, not a password someone chooses.
  • The same random bits in another BIP-39 wordlist give a different seed and wallet when the words differ.
  • BIP-39 is common, but Electrum, Monero, Polyseed, SLIP-39 and aezeed are not interchangeable with it.
How a mnemonic phrase becomes wallet keysBIP-39 wordlists and their languagesWhy four letters identify a mnemonic wordMnemonic formats beyond BIP-39Generate a mnemonic phrase safelyMoving a mnemonic phrase between walletsEngineering mnemonic support in walletsMnemonic phrase FAQ

How a mnemonic phrase becomes wallet keys

BIP-39 calls the words a "mnemonic sentence" or "mnemonic code". Most wallets instead say seed phrase or recovery phrase. The standard reserves "seed" for the 64-byte result computed from those words. Allowed lengths are 12, 15, 18, 21 and 24 words. The 15-word, 18-word and 21-word forms encode 160, 192 and 224 entropy bits respectively. The last word holds seven entropy bits with 12 words, or three with 24 words, plus check bits.

Number 1

Entropy

Start with computer-generated entropy, from 128 to 256 random bits in multiples of 32. These bits supply the randomness encoded by the words.

Number 2

Checksum

Compute a SHA-256 cryptographic hash of the entropy. Append its first ENT/32 bits, where ENT means entropy length. This adds four bits for 128-bit entropy or eight for 256-bit entropy.

Number 3

Words

Split the combined bits into groups of 11 bits. Each group represents a number from 0 to 2,047, indexing one entry in a 2,048-word wordlist.

Number 4

Seed

PBKDF2-HMAC-SHA512 uses 2,048 iterations. Its password is the UTF-8, NFKD-normalized mnemonic sentence. Its salt is "mnemonic" plus the optional passphrase, also NFKD-normalized. The output is 64 bytes. An absent passphrase means an empty string.

Number 5

Keys

BIP-32 turns the seed into a master key and a tree of individual private keys. This is the key hierarchy behind an HD wallet.

Seed derivation can process any sentence. Software must check the checksum and warn if it fails, but need not refuse the sentence. Words, passphrases and wordlist language choices affect the seed. The conversion is one-way, so an arbitrary BIP-32 seed cannot be converted back into a corresponding mnemonic sentence. The seed phrase guide covers backup, theft, derivation paths and the passphrase in practice.

BIP-39 wordlists and their languages

The ten official wordlists each contain 2,048 words. They cover English, Japanese, Korean, Spanish, Simplified Chinese, Traditional Chinese, French, Italian, Czech and Portuguese. These lists are published in the bitcoin/bips repository, with language-specific rules alongside the shared encoding specification. The standard notes that most wallets support only English. It is "strongly discouraged to use non-English wordlists for generating the mnemonic sentences". The language selected for a mnemonic phrase therefore affects both seed calculation and compatibility.

Figure 1 · Ten official wordlistsOne number, different walletsChoose one of three public test entropies and a language. Compare words, numbers, the seed's first 16 bytes and Ethereum addresses across all ten lists.
Test entropy
Wordlist
Entropy9e885d952ad362caeb4efe34a8e91bd2Checksum bits 0001
1#1268ておくれ
2#535げざん
3#810しねま
4#685こりる
5#433きぼう
6#811しねん
7#1385ななおし
8#1790ほんやく
9#421きない
10#570けむり
11#567けまり
12#1313てんない
Seed, first 16 of 64 bytes523abe7358dc143b2e044fcd5e2e5c37…
First Ethereum address, m/44'/60'/0'/0/00xa5D7c6f2A9B37293Ec9405b9143181C1c5f2C58E
The same entropy in all ten lists
English0xd01D…d52f
Japanese0xa5D7…C58ESelected
Korean0x50C4…8944
Spanish0x5559…4b4a
Chinese, simplified0x1bAA…eD67
Chinese, traditional0x2418…89aB
French0x780a…e664
Italian0x73e9…Be4F
Czech0x3FF5…55c7
Portuguese0x8e0f…2148

The 12 word numbers stay unchanged, but PBKDF2 processes different text. This language therefore opens a different wallet.

Only public BIP-39 test vectors are used, with an empty passphrase. Never fund these addresses.

Spanish shares no exact words with other lists, but removing accents produces 49 matches. French and Spanish matching ignores accents. Japanese ideographic spaces normalize to ordinary spaces. In October 2026, Trezor, Ledger, MetaMask, Sparrow and Coldcard accept English phrases only, while ethstaker-deposit-cli and btcrecover accept all ten languages. The last list was added in December 2020, and new ones have been declined since July 2021.

Why four letters identify a mnemonic word

The first four letters identify each English list word. This supports wallet autocomplete, short hardware input and four-letter metal backups. Yet 49 three-letter entries, including "act", also start longer words such as "action". Completing a short word is different from narrowing the candidates to one. Format matters too. SLIP-39 shares 750 four-letter prefixes with the English list, but 197 name different words. For example, "acro" is "across" in BIP-39 and "acrobat" in SLIP-39.

Spanish and French treat accents as plain letters when matching prefixes. Italian, Czech and Portuguese have no accents. All six Latin-script lists distinguish words within four letters, counting complete short words separately. In English, 34 entries become unique after two letters, 604 after three and 1,361 after four. Italian includes 151 nine-letter words, despite its notes specifying four to eight. Japanese needs at most three kana, Korean at most two syllables, and each Chinese word is a single character.

Figure 2 · Six Latin-script listsFind one word by prefixChoose among six Latin-script lists and add letters with on-screen keys. Watch matching counts shrink to one and unavailable letters gray out.
Wordlist
Letters so far14 of 2,048 words matchac
14 words start with “ac”Add a letter to narrow it down.
and 2 more
English list, 2,048 words
Unique after 2 letters34
Unique after 3 letters604
Unique after 4 letters1,361
Only as a whole word49
BIP-39 says the first four letters are enough to identify any English word.SLIP-39 uses its own 1,024-word English list. 750 four-letter prefixes appear in both lists, and 197 of them stand for different words.
Lists in other scripts
JapaneseEvery word is identified by its first 3 kana.
KoreanEvery word is identified by its first 2 syllables.
ChineseEach word is a single character.
Simplified and traditional1,275 of 2,048 positions hold the same character in both lists.

English has 49 short, complete words like act that also start longer words. The SLIP-39 line shows when the same four letters mean another word.

These counts were computed from the official wordlists in the bitcoin/bips repository on 21 October 2026.

Mnemonic formats beyond BIP-39

Mnemonic formats differ even when words look familiar. BIP-39's shortcomings section, added on 24 July 2026, explains that the seed depends on the wordlist. Its checksum is short and cannot correct errors. There is no versioning. A Related Work section added the same day says the authors proposed SLIP-39 as "an intended successor".

FormatWordsWhat the words carryHow errors are caught
BIP-39Words12, 15, 18, 21 or 24 words, ten 2,048-word listsWhat the words carryEntropy plus appended check bitsHow errors are caughtTruncated SHA-256 checksum for detecting some errors
ElectrumWordsAbout 12 words from BIP-39's English listWhat the words carry132 random bits, selected for a matching seed versionHow errors are caughtHMAC-SHA512 seed version prefixes, including 01 for standard and 100 for segwit
MoneroWords25 words from 1,626-word lists in 12 languagesWhat the words carryThe 32-byte private spend key in the first 24 wordsHow errors are caughtCRC-32 over prefixes, selecting a repeated word as the checksum
PolyseedWords16 words from 2,048-word lists in ten languagesWhat the words carry150 secret bits, five feature bits and ten wallet birthday bitsHow errors are caughtPolynomial check detecting every single-word error
SLIP-39WordsUsually 20 or 33 words per share, separate 1,024-word English listWhat the words carryShamir share identification, iteration exponent, grouping data and share valueHow errors are caughtReed-Solomon checksum detecting errors affecting up to three words
aezeedWords24 words from the 2,048-word English listWhat the words carryEncrypted entropy, version and wallet birthday, with salt and check dataHow errors are caughtVersion byte and CRC-32C validation of encoded data
CardanoWords15 words (Yoroi) or 24 (Daedalus, Lace), BIP-39 wordsWhat the words carryEntropy used for Cardano's own master key generationHow errors are caughtThe usual SHA-256 word checksum
Polkadot and SubstrateWords12, 15, 18, 21 or 24 words from a 2,048-word English listWhat the words carryEntropy rather than mnemonic text as the input to seed derivationHow errors are caughtThe usual SHA-256 checksum over the entropy
AlgorandWords25 words from the 2,048-word English listWhat the words carryThe 32-byte private key itself, without PBKDF2 or a passphraseHow errors are caughtSHA-512/256 key checksum, plus zero padding in word 24
Figure 3 · Eight formats, every one-word typoWhen a changed word passesChoose a format and select a public test word. See its bit roles, accepted replacements and the full phrase's error-detection rate.
Format
Random entropyChecksum
Word 12, picnic: 7 random entropy bits, 4 checksum bits. 127 of the 2,047 other words in this position still pass.Official BIP-39 test vector from python-mnemonic. It is public, so it must never hold funds.
One wrong word caught94.06%1,459 of 24,564 one-word changes still pass
Two neighbouring words swappedCaught 11 of 11Every adjacent swap on this phrase
Words and list12 of 2,048128 bits of entropy, 4-bit checksum

The four-bit check misses 1,459 of 24,564 tested substitutions, or 5.94%. An accepted typo usually opens a different, empty wallet.

Random entropyChecksum
Word 24, length: 3 random entropy bits, 8 checksum bits. 7 of the 2,047 other words in this position still pass.Official BIP-39 test vector from python-mnemonic. It is public, so it must never hold funds.
One wrong word caught99.59%203 of 49,128 one-word changes still pass
Two neighbouring words swappedCaught 23 of 23Every adjacent swap on this phrase
Words and list24 of 2,048256 bits of entropy, 8-bit checksum

The eight-bit check misses 203 of 49,128 substitutions, or 0.41%. More check bits catch more typos, but not every wrong word.

Random entropy
Word 12, identify: 11 random entropy bits. 1 of the 2,047 other words in this position still pass. 10 would load as some Electrum seed type.Test seed from Electrum's own test suite. It is public, so it must never hold funds.
One wrong word caught99.98%6 of 24,564 one-word changes still pass
Two neighbouring words swappedCaught 11 of 11Every adjacent swap on this phrase
Words and list12 of 2,048132 bits of entropy, seed type in an HMAC prefix

The seed version check accepts six substitutions as segwit and 119 as other types. A typo can therefore change the wallet structure.

Private keyChecksum
Word 25, wrap: a checksum word that repeats word 19. 0 of the 1,625 other words in this position still pass.English test seed from Monero's unit tests, written there as three-letter prefixes and shown here as full words from the 1,626-word English list. It is public, so it must never hold funds.
One wrong word caught96.07%1,598 of 40,625 one-word changes still pass
Two neighbouring words swappedCaught 24 of 24Every adjacent swap on this phrase
Words and list25 of 1,62632-byte private spend key, checksum word, English list

The repeated-word check accepts 1,598 substitutions, or 3.93%. Neither changing the check word nor changing the word it repeats passes.

ChecksumSecret seedFeature bitsWallet birthday
Word 16, language: 10 secret seed bits, 1 wallet birthday bit. 0 of the 2,047 other words in this position still pass.Test phrase from the Polyseed library's tests. It is public, so it must never hold funds.
One wrong word caught100%0 of 32,752 one-word changes still pass
Two neighbouring words swappedCaught 15 of 15Every adjacent swap on this phrase
Words and list16 of 2,048150-bit secret, 10-bit birthday, 5 feature bits

Its polynomial check rejects all 32,752 substitutions tested. It detects every single-word error and can correct one missing word.

IdentifierExtendable flagIteration exponentGroup and member dataShare valueChecksum
Word 20, keyboard: 10 checksum bits. 0 of the 1,023 other words in this position still pass.Official SLIP-39 test vector 1, a single share. It is public, so it must never hold funds.
One wrong word caught100%0 of 20,460 one-word changes still pass
Two neighbouring words swappedCaught 18 of 18Every adjacent swap on this phrase
Words and list20 of 1,024128-bit share of a secret, 30-bit RS1024 checksum

The Reed-Solomon check rejects all 20,460 substitutions tested. It guarantees detection of errors affecting up to three words in a share.

VersionEnciphered seedSaltChecksum
Word 24, royal: 11 checksum bits. 0 of the 2,047 other words in this position still pass.Test vector from lnd's aezeed tests. It is public, so it must never hold funds.
One wrong word caught100%0 of 49,128 one-word changes still pass
Two neighbouring words swappedCaught 23 of 23Every adjacent swap on this phrase
Words and list24 of 2,048Enciphered seed, 5-byte salt, CRC-32C checksum

The version byte and CRC-32C reject all 49,128 substitutions tested. A single wrong word fails these checks in this test phrase.

Private keyZero paddingChecksum
Word 25, invest: 11 checksum bits. 0 of the 2,047 other words in this position still pass.Test phrase for the all-zero key from go-algorand's tests. It is public, so it must never hold funds.
One wrong word caught99.96%21 of 51,175 one-word changes still pass
Two neighbouring words swappedCaught 1 of 1Every adjacent swap on this phrase
Words and list25 of 2,04832-byte private key, 8 zero bits, checksum word

The key hash check accepts 21 substitutions, or 0.041%. A wrong word can pass, usually producing a different, empty wallet.

Every one-word change was tested on the public test phrase shown for each format on 21 October 2026.

BIP-85 derives child mnemonics from one master seed. The codex32 format uses 48 characters for 128-bit seeds or 74 for 256-bit seeds, with checksums that can be verified by hand. The ethstaker-deposit-cli tool creates a 24-word BIP-39 mnemonic in any of ten languages before deriving validator keys. A mnemonic phrase works only in software implementing the same format, regardless of familiar words or matching length.

Generate a mnemonic phrase safely

Length alone does not establish randomness. A mnemonic phrase can have the right number of words and still come from a weak source. Generation must start with unpredictable bits, then apply the format's encoding and checks. Choosing words first reverses that process.

Device-generated randomness

Start with a device or operating system random generator. A hardware wallet can combine device-generated values with user-supplied randomness, as Coldcard does with dice.

Dice or coins

Use 50 fair dice rolls for 12 words or 100 for 24. Fair coins require 128 or 256 flips. Coldcard and SeedSigner request at least 99 rolls, about 255.9 bits, for 24 words.

Do not choose words

A person-selected mnemonic phrase is not the computer-generated randomness BIP-39 encodes. Books, lyrics and personal details create a brain wallet, not a sound entropy source.

Test the implementation

Verify generation and import against each format's public test vectors. The python-mnemonic vectors use passphrase "TREZOR". Audit wallet code, including randomness and normalization. Never fund public test phrases.

Weak-generator cases include Trust Wallet's late 2022 extension and Libbitcoin Explorer's August 2023 disclosure, both using 32-bit entropy, plus Coinkite's 30 July 2026 Coldcard report. A passing check validates the encoding, not the quality of its randomness. Reviewing the generator is therefore separate from checking the finished words.

Moving a mnemonic phrase between wallets

An import screen may reject a mnemonic phrase because the format, length or language is unsupported. A BIP-39 importer cannot interpret a 25-word Monero or Algorand phrase, or a 20-word SLIP-39 share. Electrum generates its own seed format. Word count alone cannot identify an encoding, because several schemes share both their length and their vocabulary. In particular, a 24-word aezeed phrase passes BIP-39's checksum about once in 256, opening an unrelated wallet.

Accepted words do not guarantee matching accounts. Cardano's Icarus scheme derives keys from entropy using PBKDF2-HMAC-SHA512 with 4,096 iterations. Substrate also applies PBKDF2 to entropy rather than the mnemonic text. Other wallets can differ in derivation paths or an optional passphrase. BIP-39 words do not record the format, the wordlist language, the passphrase or the derivation path. Before moving funds, confirm the source format, supported language and key-generation method, then check that the destination shows the expected accounts.

Engineering mnemonic support in wallets

A mnemonic input field sits between human-readable words and key-generation code. PixelPlex treats that boundary as several engineering tasks, not one text-validation rule. Its crypto wallet development work separates encoding, interpretation and import behavior. The wallet development guide provides broader context for teams planning an application around those flows.

PixelPlex case icon

PixelPlex built Qtum Wallet, which backs up private keys with a 12-word seed phrase and adds Shamir's secret sharing. It also built Console Wallet for the Canton Network, where there is no seed phrase to back up or lose. The two projects show that mnemonic support follows from a wallet's key-management design.

  1. Entropy and encoding

    Define allowed entropy sizes and word counts for each supported mnemonic format. Keep random generation separate from deterministic encoding and seed derivation.

  2. Language and normalization

    Make wordlist language support explicit. Apply the correct normalization rules to the mnemonic sentence and passphrase, then verify the resulting bytes against known vectors.

  3. Input and warnings

    Autocomplete within the selected list, distinguish complete short words, and show checksum warnings. Do not treat a matching prefix as proof of format.

  4. Import format recognition

    Identify the mnemonic type before deriving keys. Similar words and lengths cannot distinguish every format, and successful validation does not prove account compatibility.

  5. Vectors and code review

    Test every supported mnemonic generation and import path against its own vectors. Review randomness handling, encoding boundaries and error reporting in wallet code.

Plan mnemonic support for your wallet project

We can discuss supported formats, import behavior and test coverage for your wallet, without assuming every design needs recovery words.

Discuss wallet requirements

Mnemonic phrase FAQ

Is a mnemonic phrase the same as a seed phrase?

In everyday wallet language, the names usually refer to the same words. BIP-39 separates the human-readable mnemonic from its 64-byte binary seed. The standard itself never uses the term "mnemonic phrase", although wallets and users commonly do. The document's title is "Mnemonic code for generating deterministic keys".

How many words does a mnemonic phrase contain?

BIP-39 permits exactly 12, 15, 18, 21 or 24 words. Other encodings use different lengths, including 16 for Polyseed and 25 for Monero or Algorand. SLIP-39 shares have 20 or 33 words for 128-bit or 256-bit secrets. Word count helps identify a format but cannot establish compatibility on its own.

Why does BIP-39 use exactly 2,048 words?

Each word represents an 11-bit number, giving 2,048 possible values. Combining those fixed-size groups lets the algorithm represent entropy and check bits as readable words. The index values run from zero to 2,047. The list is sorted for efficient lookup, and similar entries such as "build" and "built" are avoided.

Can a mnemonic phrase use another language?

Yes, BIP-39 has ten official wordlists, but strongly discourages generating phrases with non-English lists. In October 2026, most consumer wallets accept only English. The same random bits in another language produce a different seed when the words change. Spanish shares no exact words with other lists, while English and French share 100.

Can I make up my own mnemonic phrase?

No, the encoding is designed to carry computer-generated randomness rather than a sentence someone invents. A 12-word phrase has 2^128 valid possibilities when generated correctly. For 24 words, the valid space contains 2^256 possibilities. Picking memorable words does not reproduce that random process, even if the resulting sentence passes its check.

What happens if one word is misspelled?

In BIP-39, about 1 in 16 wrong-word substitutions pass the checksum for 12 words, and about 1 in 256 for 24 words. A passing wrong word opens a different, usually empty wallet. Software must warn when the check fails, but it does not have to refuse the sentence. The check cannot locate or repair the mistake.

Do Electrum or Monero phrases work in BIP-39 wallets?

No, their native encodings follow different rules even when some words look familiar. Monero's words encode its private spend key directly. Electrum can import BIP-39, but does not generate it. Since June 2021, its generator also prevents newly created Electrum seeds from accidentally passing BIP-39's check.

Related terms

All definitions
Sources (39)

Get updates about blockchain, technologies and our company

We will process the personal data you provide in accordance with our Privacy policy. You can unsubscribe or change your preferences at any time by clicking the link in any email.

Follow us on social networks and don't miss the latest tech news

  • facebook
  • X
  • linkedin
  • instagram
Stay tuned and add value to your feed