BIP39 mnemonic → BIP32 child key

What this page computes

It turns a BIP39 mnemonic sentence plus an optional passphrase into a 512-bit seed, then walks a BIP32 derivation path one level at a time until it lands on a private key that has a WIF, a public key, a hash160 and an address. Nothing is cached: every number on this page is recomputed from the text you type.

1. BIP39: how 128–256 bits of entropy become words

A BIP39 mnemonic is a human-transcribable encoding of a random number. The encoder is:

1. Draw ENT bits of entropy from a cryptographically secure random source, where ENT ∈ {128, 160, 192, 224, 256}.
2. Compute CS = ENT / 32 and take the first CS bits of SHA-256(entropy). These bits are the checksum.
3. Concatenate: ENT ‖ CS bits in total.
4. Cut that bit string into groups of 11 bits. Each group is an integer in [0, 2047], i.e. an index into the 2048-word list (2¹¹ = 2048, which is exactly why the groups are 11 bits wide).
5. Write the words down in order and join them with single spaces.

Two design details are worth admiring. First, the checksum is not a separate word: it is glued to the tail of the entropy, so it can only be validated by someone who owns the wordlist. Four checksum bits catch all single-word errors and (per the BIP) essentially all two-word errors; a wallet that rejects your phrase is usually rejecting the checksum. Second, the wordlist is chosen so that no two words share their first four letters — abandon, ability, able, about … are distinct after four characters. That makes the phrase robust to handwriting mistakes, allows wallets to accept four-letter abbreviations, and makes the last three letters of every word redundant for disambiguation.

The last column explains why a 24-word phrase is not "24 free words": the final word must carry the 8 checksum bits, leaving only 3 bits of real choice, so for any given first 23 words only 8 candidates for the last word are valid. A checksum failure is therefore a strong signal — and it is precisely the signal this server cannot produce.

2. The BIP39 seed: PBKDF2, and why the words are never hashed directly

The mnemonic is not a key. It is stretched into the seed with PBKDF2-HMAC-SHA512, the passphrase acting as a salt. Every parameter below is fixed by the specification, which is why two wallets given the same words and the same passphrase always agree:

What the seed is not: it is not a private key, it is not a BIP32 key, and it is not a wallet backup by itself. It is the input to the next step. And note the direction of the dependency: the mnemonic determines the seed, the seed determines every key below, and nothing determines the mnemonic from the seed (HMAC-SHA512 is one-way).

3. BIP32: master key, chain code, and the CKD function

BIP32 turns the 64-byte seed into a tree of keys with one HMAC-SHA512 call for the root and one per level:

The chain code c is 32 bytes of extra secret-ish entropy that is carried alongside every key in the tree and is mixed into every HMAC. It is not a key you can spend with, but it is not public: anyone holding a chain code plus a parent public key can derive every non-hardened child public key. Each step of CKDpriv is:

Here ser256 is the 32-byte big-endian private key, serP is the 33-byte compressed public key, and i + 2³¹ is what the apostrophe in a path means. Child keys are obtained by adding scalars modulo n, which is safe because of the identity (a+b)·G = a·G + b·G on the curve.

4. Derivation paths: BIP44, BIP49, BIP84, BIP86

A BIP32 path is read left to right, and each level has an agreed meaning. For single-key wallets the convention is m / purpose' / coin_type' / account' / change / address_index:

The two unhardened levels exist so that a watch-only wallet can hold an xpub and enumerate every receiving address without ever seeing a private key. The price of that convenience is exactly the leak described above.

5. The passphrase: the "25th word"

The BIP39 passphrase is not part of the wordlist and not part of the mnemonic — it is the salt of the PBKDF2 call. For a 24-word mnemonic people call it the 25th word because it behaves like one extra word that you must supply from memory. Three consequences follow, and all three destroy funds every year:

• A different passphrase is a different wallet. Same 12 words, one character of difference in the passphrase, and the seed, every key and every address change completely. There is no error message and nothing to compare against — the new wallet is simply empty.
• Forgetting it loses everything. The passphrase is stored nowhere; the wordlist backup does not contain it. Recovery means brute-forcing your own memory, and no support channel exists.
• It is not a strong password KDF. 2048 PBKDF2-HMAC-SHA512 iterations is a small barrier; a short or dictionary passphrase can be attacked offline.

Used well, it is genuinely useful: it makes a stolen piece of paper useless. Used casually, it is the most common way people lock themselves out of their own coins.

6. Official test vector for the demo mnemonic

The sample phrase in the input box is the first official BIP39 English test vector — the encoding of 128 bits of zero entropy. The published vector pairs it with the passphrase TREZOR, and that is the one independent check that proves the PBKDF2 step here is correct:

Type the phrase and TREZOR into the form to reproduce it live. Note that this test vector says nothing about checksum validation: the PBKDF2 step succeeds for any string at all, which is exactly the limitation described at the top of this page.

7. Worked example: the demo mnemonic through m/44'/0'/0'/0/0

With an empty passphrase, the demo phrase produces these real values (all of them are recomputed live by the form above):

Finally, the whole point of the passphrase, demonstrated with the same twelve words and the same path:

8. Common mistakes

• Typing a real seed phrase into a website. Including this one. A page can do anything with it. Use a hardware wallet's own screen, or an offline machine you control.
• Trusting a wallet that does not check the checksum. If a recovery tool silently accepts a phrase with a typo — as this page must, for lack of the wordlist — you may end up staring at an empty wallet and concluding your coins are gone.
• Assuming the passphrase is backed up with the words. It is not, by design. Write it down separately, or not at all — but decide deliberately.
• Reusing one account index for different purposes. The account, change and address-index levels are a directory structure; reusing indices across standards mixes keys in ways wallets cannot see.
• Confusing the layers. BIP39 is words; BIP32 is the key tree; BIP44/49/84/86 are path conventions; each address standard hashes its own public-key serialisation. None of them is "the wallet".
• Believing 2048 iterations protects a weak passphrase. It does not; the words carry the security, the passphrase only adds a salt.

9. Quick reference