Most wallets create your recovery phrase in the same way, following a standard called BIP39. This guide explains how it works. It is part of our guide to what a recovery phrase is.

What BIP39 is

BIP stands for Bitcoin Improvement Proposal. BIP39, published in 2013, describes a way to turn a random number into words that people can write down reliably. It was written for Bitcoin, and is now used across most of crypto.

How your phrase is made

  1. Randomness. Your wallet generates 128 to 256 bits of random data.
  2. Checksum. It takes a fingerprint of that data, using SHA-256, and adds a few bits to the end.
  3. Splitting. The result is cut into pieces of 11 bits each.
  4. Words. Each piece is a number from 0 to 2,047, which picks one word from the list.
  5. Seed. Your words pass through a function called PBKDF2, with 2,048 rounds of HMAC-SHA512, producing a 512-bit seed.

That seed then produces all of your keys. See how one phrase controls many accounts.

Why the list looks the way it does

The English list of 2,048 words was chosen with care:

  • Each word can be identified by its first four letters. See why you need only four letters.
  • Similar words were avoided, to reduce mix-ups.
  • Words are sorted, so that lookups are fast.

What the checksum does

Because the last word includes a checksum, most random mistakes produce an invalid phrase, and your wallet will warn you. This catches typing errors, but it is not a security feature. With a 12-word phrase, one in 16 random word lists will pass.

What a phrase looks like

Here is the best-known public test phrase from the standard itself. Never use it. Anyone sending funds to this wallet loses them, since the whole world knows it.

abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about

Why BIP39 matters to you