crypto
How BIP-39 phrases produce wallet keys
Explains how BIP-39 mnemonic phrases, checksums, and optional passphrases derive the seed, private keys, public keys, and addresses of HD wallets.
Most users interact with a blockchain through wallet software. Many wallets use a mnemonic phrase for backup, but imported private keys, hardware devices, multisignature accounts, and smart accounts can use other recovery models.
Mnemonic phrases are one common backup method for hierarchical deterministic (HD) wallets. They are inputs to a derivation process, not private keys or addresses themselves. Recovery may also require an optional passphrase, the correct derivation path, or other signing material used by the account.
From BIP-32 to BIP-39
The concept of mnemonic phrases was introduced and standardized through Bitcoin Improvement Proposals (BIPs), specifically BIP-39.
These proposals have had a lasting impact across blockchain ecosystems, with many other networks, including Ethereum and Solana, adopting similar standards.
How mnemonic phrases work
| Process | Description |
|---|---|
| Generation | A wallet generates entropy, adds a checksum, and maps the bits to words from a predefined list. |
| Conversion | The phrase is converted into a binary seed through key stretching. |
| Key Derivation | The seed generates the master private key. |
| Address Creation | Child keypairs are derived from the master key; addresses come from the public halves. |
| Versatility | A single phrase can derive multiple accounts on compatible networks and paths. |
| Security | A phrase can recover every derived key, so its secrecy and recoverability are both critical. |
Entropy, checksums, and passphrases
- Mnemonic phrase: encodes entropy and a checksum; treat it as secret
- Seed: the binary value derived from the mnemonic and optional passphrase
- Private keys: derived through the HD wallet tree; treat them as secret
- Public keys: mathematically derived from private keys; public by design, though sharing them can reduce privacy
- Addresses: account identifiers derived according to a network's rules; sharing them can reveal balances and transaction history
Mnemonic phrases
A BIP-39 mnemonic phrase commonly contains 12, 15, 18, 21, or 24 words from which a wallet derives its keys.
It has been a common backup method across many wallets, though wallet recovery and account-abstraction designs continue to diversify.
Private keys
A private key is secret signing material that can authorize actions for the corresponding blockchain account.
It resembles a signing key more than an email password: there may be no provider that can reset it.
Access may be recovered through mnemonic phrases, keystore files, hardware signers, social recovery, or provider-assisted systems. A cloud or social login changes the trust and recovery model rather than making the underlying private key resettable.
Public keys
Public keys are derived from private keys using one-way elliptic-curve operations, so deriving the private key from its public key is computationally infeasible with current methods. Addresses are in turn derived from public keys and are what you see as the account label for each wallet; the public key itself is rarely used directly other than to generate the address.
Addresses
You use these account details to move assets around on the chain. Vanity addresses exist, where a machine brute-forces candidate keys until the derived address contains specific characters in a specific sequence.
Some addresses also have human-readable proxies, so users can transfer to zachtos.apt (powered by Aptos Name Service) instead of to the raw address that was derived from the private key (and then the public key) above.
From mnemonic phrase to seed
The BIP-39 process
Entropy, or randomness, is generated in multiples of 32 bits, from 128 up to 256 bits. A checksum is appended: the first few bits of the entropy's SHA-256 hash (one checksum bit per 32 bits of entropy, so 4 bits for a 12-word phrase).
The combined string is split into 11-bit groups, and each group encodes a number from 0 to 2047, an index into the standardized 2,048-word list. That is why BIP-39 phrases use specific lengths. The checksum catches some, but not all, substitutions with other valid words.
The normalized mnemonic and optional passphrase are inputs to PBKDF2-HMAC-SHA512 with 2,048 iterations, producing a 512-bit seed. That iteration count adds some cost to guessing but is weak by modern password-hashing standards, so an attacker who obtains the mnemonic can test passphrases offline.
BIP-39 also allows an optional passphrase, sometimes called a "25th word," mixed in at this step. It's a double-edged tool: it creates an entirely different wallet per passphrase, which adds protection if the phrase is found, but funds behind a passphrase cannot be recovered from the phrase alone. If you use one, it needs the same care as the phrase itself. Wallet support also varies; restoring a phrase in a different wallet app can surface empty accounts until the matching passphrase and derivation path are used.
BIP-32 and BIP-44
BIP-32 defines a hierarchical deterministic framework in which a master key derives a large tree of child keypairs. Each child private key has a corresponding public key. BIP-44 organizes derivation paths so compatible multi-asset wallets know where to find accounts.
Each private key still unlocks exactly one public key; the abundance comes from the tree, not from any single key.
Accessing derivation paths beyond a wallet's default settings is unnecessary for most users.
Wallet interfaces typically handle path specifications automatically or offer optional customization.
Managing multiple assets would be cumbersome if each token required manual derivation path input.
What the standards changed
Before BIP-32 and 44, managing wallets could require backing up separate keypairs, a burdensome and error-prone process.
Once BIP-32, 39, and 44 were widely implemented, users could derive accounts for many compatible networks from one mnemonic backup. That convenience also concentrates risk: exposure or loss of one phrase can affect every derived account.