What is a seed phrase, and what does it open?
The 12 or 24 words a wallet shows at setup are a mnemonic defined in BIP-39. They are not a copy of the wallet but the seed itself: anyone entering them in the same order opens the same wallet. We set out what they open and why a wrong passphrase raises no error.
In short
When a wallet is first created it shows 12 or 24 words and asks you to write them down. That sequence is defined in BIP-39, whose stated purpose is:
"the implementation of a mnemonic code or mnemonic sentence -- a group of easy to remember words -- for the generation of deterministic wallets."
The key word is deterministic: the words do not unlock a wallet, they generate one.
The words are the source, not a copy
A common misreading treats the recovery phrase as a password. It is not. The standard runs the words through PBKDF2 to produce a binary seed; the addresses and private keys are derived from that seed.
The practical consequence: entering the same 12 words in the same order into any wallet application opens the same addresses. The brand does not matter, there is no account, there is no record on a server. Whoever has the words has the wallet.
This is why a recovery phrase is never shared. A support agent, a form, or a site asking for it is asking for the whole wallet.
The words are not arbitrary
The sequence comes from a word list, and each word encodes an 11 bit number:
"groups of 11 bits, each encoding a number from 0-2047, serving as an index into a wordlist"
The standard also appends a checksum:
"A checksum is generated by taking the first
ENT / 32bits of its SHA256 hash."
The checksum exists so that a mistyped word can be detected. Twelve words chosen at random do not form a valid phrase.
The passphrase, and why it fails silently
The standard defines an optional passphrase. Its behaviour is the least known and most dangerous part of this piece:
"every passphrase generates a valid seed (and thus a deterministic wallet) but only the correct one will make the desired wallet available."
A wrong passphrase raises no error. It opens a valid but different, empty wallet. The user concludes the words were wrong; the words were right and the passphrase was not.
When no passphrase is used the standard substitutes an empty string.
Risks
Biggest uncertainty How particular wallet applications store the words was not examined here.
- Whoever sees the words takes the wallet. A screenshot, a cloud note, a photo, or typing them into a form all reach the same outcome.
- A wrong passphrase raises no error. A different wallet opens and the funds appear to be gone. The passphrase needs a backup of its own, kept separately from the words.
- The checksum catches typos, not loss. A missing or reordered sequence is an unrecoverable loss; a seed with no backup has no recovery path.
- The wallet application can change, the seed does not. Even if an app shuts down the words open the same addresses elsewhere. That is a guarantee and a risk at once.
What was not examined is listed in the data status above.
Sources
This article rests on the sources below. Whether each has a permanent copy is stated next to it.
- #1
Primary source for the mnemonic definition, the checksum and the passphrase's silent behaviour: the BIP-39 standard itself.
github.com· no permanent copy· no screenshot
Evidence chain: 1 sources
Tweets get deleted, sites go down. Below is whether a durable copy exists for each source.
Sources (1)
- #1
Primary source for the mnemonic definition, the checksum and the passphrase's silent behaviour: the BIP-39 standard itself.
“every passphrase generates a valid seed (and thus a deterministic wallet) but only the correct one will make the desired wallet available”
github.com/bitcoin/bips/blob/master/bip-0039.mediawiki- no durable copy: if the source disappears, this claim loses its basis
- no screenshot captured
Correction history
Articles are never deleted, only corrected. Every change appears here.
- Version 1 ·
Section