What Is a Seed Phrase
Published · 11 min read
A seed phrase is 12 or 24 words encoding the master key to every account in your wallet. How BIP-39 generates it, why the words are checksummed, and what it does and does not control.
TL;DR: A seed phrase encodes 128 to 256 bits of randomness as words from a fixed 2,048-word list, with a checksum built in. From that single seed a wallet derives unlimited private keys across every chain, which is why the phrase is the wallet.
Table of contents
What is a seed phrase? It is a list of 12 or 24 ordinary words that encodes the master key to your crypto wallet. Not a password, and not a backup of a password — every private key and every address your wallet will ever generate is derived from those words mathematically. Whoever holds the phrase holds the wallet, permanently and irreversibly.
How a seed phrase is actually generated
The process is defined by BIP-39 and is entirely mechanical.
Generate entropy
The wallet produces a random number — 128 bits for a 12-word phrase, 256 bits for 24. This randomness is the whole security of the system, which is why hardware wallets generate it on-device using a dedicated true random number generator.
Append a checksum
A SHA-256 hash of the entropy is computed and its first bits are appended. The checksum is entropy ÷ 32 bits: 4 bits for 128-bit entropy, 8 bits for 256-bit. This is what lets a wallet detect a mistyped phrase.
Split into 11-bit groups
The combined entropy-plus-checksum is chopped into groups of 11 bits. Each group is a number from 0 to 2,047 — which is exactly why the word list has 2,048 entries.
Map each number to a word
Each 11-bit number indexes into the standardised word list. The words themselves carry no meaning; they are a human-transcribable encoding of a number.
Stretch the phrase into a seed
The phrase is run through PBKDF2 with HMAC-SHA512 and 2,048 iterations to produce a 512-bit seed. That seed is the root of the key tree.
View as table
| Entropy by phrase length | Entropy by phrase length |
|---|---|
| 12 words | 128 bits |
| 15 words | 160 bits |
| 18 words | 192 bits |
| 21 words | 224 bits |
| 24 words | 256 bits |
Only the first four letters matter
Every word in the BIP-39 English list is uniquely identified by its first four letters. "abandon" and "ability" differ by the third character; no two words share the first four.
This is deliberate, and it has a practical consequence: when stamping a metal backup you only need to record four letters per word. It halves the work and eliminates ambiguity between similar words — see metal seed phrase plate.
Why 12 words is already enough
24 words is often described as "twice as secure." It is not twice — it is astronomically more, and both are equally out of reach.
A 12-word phrase has 2128 possibilities, about 3.4 × 1038. A billion machines each checking a billion phrases per second would need roughly 780 times the current age of the universe to search that space once. There is no meaningful attack on 128 bits of entropy, so 256 bits protects against nothing that 128 bits does not already handle.
Where 24 words genuinely helps is different: some hardware wallets and multi-signature setups require it, and a longer phrase gives more redundancy against a few illegible characters on a damaged backup. Those are practical reasons, not cryptographic ones.
Seed phrase versus private key
These are related but not interchangeable, and the difference explains why one phrase can restore an entire wallet.
| Seed phrase | Private key | |
|---|---|---|
| What it is | Root of a whole key tree | A single key for a single address |
| Controls | Every account, every chain, unlimited addresses | One address |
| Format | 12 or 24 words from a fixed list | A hex string or WIF |
| Portable between wallets | Yes, if derivation paths match | Yes, per address |
| Recoverable if lost | No | No |
A wallet derives keys hierarchically using BIP-32, along a path defined by BIP-44 — for example m/44'/60'/0'/0/0 for the first Ethereum account. Change the coin type in that path and the same seed produces Bitcoin keys instead. This is why importing one phrase into a new wallet restores everything at once.
Different wallets, different default paths
If you restore a phrase into a different wallet and your balance appears to be missing, the funds are almost never gone. The new wallet is probably scanning a different derivation path.
This trips people up most often between Bitcoin address types — legacy, SegWit, and native SegWit sit on different paths from the same seed. Before panicking, check which path the wallet uses and whether it lets you specify a custom one.
The optional 25th word
BIP-39 supports a passphrase, sometimes called the 25th word. It is mixed into the PBKDF2 step, so a different passphrase produces a completely different seed from the same 12 or 24 words.
This gives you two things:
Plausible deniability. The phrase alone opens one wallet; the phrase plus passphrase opens another. Someone who forces you to reveal your phrase gets the first.
Protection against a discovered backup. A metal plate found in a drawer is not sufficient to move funds if a passphrase is required.
It also gives you a new way to lose everything. There is no checksum on a passphrase and no recovery for it. A typo produces a valid, empty wallet with no error message — the system cannot tell the difference between a wrong passphrase and a different wallet. Most people should not use one until their basic backup is solid.
Almost nobody loses funds because someone guessed their seed phrase. The cryptography is not the weak link and never has been.
What actually happens, in rough order of frequency: the phrase gets typed into a website that asked for it; it gets photographed or stored in cloud notes and the account is later compromised; it gets written on paper that is lost, destroyed, or thrown out by someone who did not know what it was; or a passphrase is added and then misremembered.
Every one of these is a handling failure. The design assumption of BIP-39 is that the phrase never touches an internet-connected device after generation, and the overwhelming majority of losses come from breaking that single assumption.
The corollary is the rule worth internalising: your seed phrase is never an input to anything. Not a balance checker, not an eligibility verifier, not a support process, not a migration tool. The only legitimate use is restoring a wallet on a device you control. Any other prompt is an attack — including the elaborate ones covered in 12 word seed phrase generator with balance.
Storing a seed phrase
Holds up
- Generated on a hardware wallet, never displayed to an internet-connected device
- Written by hand, verified word by word against the device before funding
- Stored on metal for fire and water resistance
- Split across two geographically separate locations you control
- Test-restored on a spare device before any meaningful amount is deposited
Costs you
- Photographed on a phone — synced to cloud backup automatically
- Stored in a password manager, notes app, or email draft
- Typed into any website for any reason whatsoever
- Kept as the only copy on paper in one location
- Shared with a family member 'for safekeeping' without a plan
- Split with a homemade scheme that loses funds if one part is destroyed
Naive splitting is more dangerous than it looks
Cutting a 24-word phrase into two halves of 12 and storing them separately feels prudent. It is usually worse than a single copy: you have doubled the number of locations where total loss can occur, while each half also meaningfully reduces the search space for anyone who finds one.
If you need split custody, use a scheme designed for it — a multi-signature setup or Shamir backup — rather than improvising. Improvised splitting converts one risk into two.
Test your backup before you trust it
The step almost everyone skips. A backup you have never restored from is a hypothesis, not a backup.
- Write the phrase down from the hardware device.
- Wipe the device, or use a second one.
- Restore from your written backup.
- Confirm the same addresses appear.
- Only then fund it with an amount that matters.
Doing this once catches transcription errors, wrong word order, and misread handwriting while it is still free to fix.
The seed phrase is the key. Understanding what the wallet around it does — and does not — protect you from is the other half.
FAQ
›What is a seed phrase?
A list of 12 or 24 words that encodes the master key to a crypto wallet. Using the BIP-39 standard, the words represent 128 to 256 bits of randomness plus a checksum, and every private key and address the wallet generates is derived from that single seed.
›Why are there exactly 2,048 words in the list?
Because the entropy is split into 11-bit groups, and 11 bits can represent 2,048 distinct values. Each group indexes one word in the list. The words are also chosen so the first four letters uniquely identify each one.
›Is 24 words more secure than 12?
Cryptographically yes, but the distinction is academic. 12 words gives 2^128 possibilities — enough that a billion machines checking a billion phrases per second would need roughly 780 times the age of the universe. 24 words is required by some setups and offers redundancy against damaged backups, which are practical rather than security reasons.
›What is the difference between a seed phrase and a private key?
A seed phrase is the root of an entire tree of keys and controls every account and chain your wallet supports. A private key controls exactly one address. One seed derives unlimited private keys through BIP-32 and BIP-44 derivation paths.
›I restored my wallet and my funds are missing. What happened?
Usually the new wallet is scanning a different derivation path, particularly with Bitcoin, where legacy, SegWit, and native SegWit addresses sit on different paths from the same seed. Check which path the wallet uses and whether you can specify a custom one before assuming the funds are gone.
›What is the 25th word or passphrase?
An optional extra secret mixed into the seed derivation, producing an entirely different wallet from the same words. It protects against a discovered backup and allows plausible deniability, but has no checksum and no recovery — a typo silently opens a valid, empty wallet.
›Should I split my seed phrase in half and store the parts separately?
Generally no. Naive splitting doubles the number of places where total loss can happen while also reducing the search space for anyone who finds one half. If you need split custody, use multi-signature or a Shamir backup scheme designed for the purpose.
Sources
Related articles
12 Word Seed Phrase Generator With Balance
A 12 word seed phrase generator with balance cannot exist: finding a funded wallet by chance takes 780 times the age of the universe. Every site offering one is bait.
What Is a Decentralized Wallet
A decentralized wallet gives the user control of transaction keys, but its app, RPC, recovery, and swap services may still be centralized.
Digital Wallet Scam
Digital wallet scams steal recovery phrases, signatures, approvals, or transfers; identify the failure type first, then contain it without trusting recovery DMs.
Crypto Airdrop Scams
Crypto airdrop scams use fake claim pages, token metadata, malicious approvals, or seed-phrase theft. Use this checklist before signing.