BIP 39
Mnemonic code for generating deterministic keys
Original title: Mnemonic code for generating deterministic keys
- Status
- Deployed
- Type / Layer
- Specification / Applications
- Author
- Marek Palatinus, Pavol Rusnak, Aaron Voisine, Sean Bowe
- Assigned
- Status verified
- Source
- github.com/bitcoin/bips/blob/master/bip-0039.mediawiki
Summary
Specifies how a wallet seed is expressed as a mnemonic sentence — a group of easy-to-remember words. The process has two stages. First, 128–256 bits of entropy are generated and a checksum equal to the first ENT/32 bits of its SHA-256 hash is appended; the result is split into 11-bit groups, each indexing a 2048-word list, yielding a sentence of 12 to 24 words (12 words for 128 bits, 24 for 256). Second, that sentence is stretched through PBKDF2-HMAC-SHA512 with 2048 iterations, salted with "mnemonic" plus an optional passphrase, to produce a 512-bit seed that becomes the master key material for BIP32. The BIP is explicit about its scope: it is a way to transport computer-generated randomness in a human-readable transcription, not a way to turn user-invented sentences (brainwallets) into seeds. The wordlist is chosen so the first four letters identify each word unambiguously.
Why it matters
By making a backup something you can write on paper or read over the phone, it turned key backup into something ordinary users can actually do. It also means those 12–24 words are the asset: self-custody, inheritance planning, and scam resistance are all designed around this specification.
Related BIPs
Related articles
This page carries a summary, not a translation. The original document is authoritative, and the metadata above — including Status — was transcribed from the bips repository on the verification date shown. Always consult the original when implementing or verifying.