BIP39: The Words That Can Rebuild a Wallet

The device is replaceable; the starting point matters

Imagine replacing a broken wallet device. The replacement has never seen your transactions, yet an ordered word backup can let compatible software recreate the keys needed to access the same funds. It is not pulling coins out of the paper. The assets remain on the network; the backup restores the means of controlling them. This is an illustrative situation, not an account of a particular owner’s loss.^[4]

That possibility rests on two different design jobs. Pieter Wuille’s BIP32, dated February 11, 2012, describes deriving a hierarchy of key pairs from one seed. Its motivation contrasts this with wallets that generated independent random keys and needed recurring backups. A common starting point made it possible to reproduce a growing key tree instead of preserving each new key separately.^[2]

Why the words come after the randomness

BIP39, dated September 10, 2013, names Marek Palatinus, Pavol Rusnak, Aaron Voisine and Sean Bowe as authors. It addressed the human side of that starting point: copying words is more manageable than transcribing raw binary or hexadecimal data. The specification explicitly starts with computer-generated randomness. Choosing a favorite quotation or composing a sentence yourself is a different—and unintended—construction.^[1]

For a twelve-word mnemonic, the process begins with 128 random bits and adds a four-bit checksum. The resulting 132 bits divide into twelve groups of eleven. Each group selects one entry from a 2,048-word list. Twenty-four words encode 256 random bits plus eight checksum bits; the standard also allows fifteen, eighteen and twenty-one words. Word order carries information. These are indexed pieces of an encoding, not a sentence whose general meaning is enough.^[1]

The checksum gives software a way to reject some transcription mistakes, but it cannot catch every error or recover missing information for you. Nor can the words simply be translated into another language: BIP39’s seed calculation uses the mnemonic text itself. Changing that text changes the input, even if a human considers the translation equivalent.^[1]

A second secret changes the destination

The mnemonic is not itself the final seed. BIP39 runs the words and an optional passphrase through a specified derivation function, producing a 512-bit seed. With no passphrase, the additional input is an empty string. A method such as BIP32 then uses the seed to derive keys. Keeping those stages separate explains why a word backup is neither one payment address nor a literal list of every private key.^[1][2]

The optional passphrase is especially easy to misunderstand. It is an input to wallet creation, not merely a PIN that unlocks a device. A different passphrase produces a different valid seed. Trezor’s documentation makes the practical consequence clear: a mistyped passphrase can lead to another, usually empty wallet instead of a “wrong password” message. Restoring the intended wallet requires the original passphrase as well as the correct word backup.^[3]

What survived the broken box

Rebuilding the same keys also requires compatible derivation rules and the right place in the key tree. BIP32 leaves room for different wallet layouts, so recognizing the words is not a universal promise that any application will find every account. And not every word backup is BIP39: Trezor documents SLIP39 as a separate format with its own recovery rules.^[2][5]

BIP39’s lasting idea is a separation between a replaceable device and a reproducible cryptographic starting point. That makes the backup powerful, not harmless. Trezor treats it as secret information that can give access to the associated wallet. A small sheet can survive the box it came with; its usefulness depends on preserving the exact information, and keeping control of who can read it.^[4]