What Is BIP39?
BIP39 is the standard that turns wallet entropy into mnemonic words, checks those words with a small checksum, and converts the mnemonic into seed material. It does not check balances or prove wallet ownership.
Direct definition
BIP39 turns random bits into recovery words.
BIP39 is a Bitcoin Improvement Proposal for mnemonic code. It defines two jobs: generate a mnemonic sentence from entropy, then convert that sentence into a binary seed that deterministic wallets can use.
Standard scope
What does BIP39 actually specify?
A lot of wallet behavior gets casually called BIP39. The standard itself is narrower. That distinction matters when you are reading an explainer, testing a validator, or deciding whether a tool is asking for too much.
Mnemonic generation
BIP39 defines how raw entropy becomes a human-readable sentence using checksum bits and a fixed wordlist.
Mnemonic to seed
The mnemonic sentence can be converted into a binary seed with PBKDF2-HMAC-SHA512 and 2048 rounds.
Language wordlists
The standard includes wordlists. YSeed uses the English list because it is the common compatibility target.
Not address derivation
Account paths, xpubs, addresses, and balances belong to wallet software and standards above BIP39.
Mental model
A BIP39 phrase is encoded entropy with a checksum.
The words are not chosen because they are lucky, old, funded, or linked to a blockchain account. They are a readable encoding of randomness plus a small integrity check.
Wallet-grade random bits are created first.
A few hash-derived bits are appended.
Bits are split into 11-bit word indexes.
Wallet balances live on chains, not in BIP39 words.
Encoding path
The phrase is created in a strict order.
This order matters because it explains why a list of real words is not enough. The checksum ties the final words back to the original entropy.
- Generate 128 to 256 bits of entropy in a multiple of 32 bits.
- Take SHA-256 of that entropy and append the first ENT / 32 checksum bits.
- Split the combined entropy-plus-checksum bitstream into 11-bit groups.
- Map each 11-bit value, from 0 to 2047, to one word from the BIP39 list.
- Join the words into a mnemonic sentence that wallet software can convert into a seed.
ENT / CS / MS
How does BIP39 choose the word count?
BIP39 names the original entropy length ENT, the checksum length CS, and the mnemonic sentence length MS. The formulas are CS = ENT / 32 and MS = (ENT + CS) / 11.
| Words | ENT bits | CS bits | Total bits | Use note |
|---|---|---|---|---|
| 12 | 128 | 4 | 132 | Common minimum |
| 15 | 160 | 5 | 165 | Valid, less common |
| 18 | 192 | 6 | 198 | Valid, less common |
| 21 | 224 | 7 | 231 | Valid, less common |
| 24 | 256 | 8 | 264 | Common maximum |
Mnemonic to seed
How does a BIP39 mnemonic become a seed?
BIP39 also describes how the mnemonic becomes seed material. That seed is later used by wallet software, but address derivation and account discovery are separate decisions.
Common confusion
BIP39 is one layer, not the whole wallet stack.
Validation limits
A valid BIP39 phrase is not automatically a safe wallet.
Balance or funds
A BIP39 phrase does not store blockchain history. Funds are discovered later by wallet software deriving addresses and reading chain data.
Safe generation
A phrase can be valid BIP39 and still be unsafe if it was generated on a compromised device, phishing page, or predictable random source.
Wallet ownership
Checksum validation does not prove the user owns a wallet. It only proves the words can form a structurally valid mnemonic.
Correct backup
BIP39 cannot tell whether the phrase was copied, photographed, synced, translated, or stored in a place that later leaks.
Right derivation path
BIP39 creates the seed material. Wallet-specific paths, accounts, and addresses are separate layers above the mnemonic.
Recovery success
Recovery also depends on the wallet type, passphrase use, network, derivation path, and whether the phrase is complete.
Invalid phrase causes
Why can a mnemonic fail BIP39 checks?
A validator should tell you what failed before it asks you to reveal more. The useful checks are boring and local: count the words, match the wordlist, and verify checksum.
Wrong word count
BIP39 English mnemonics use 12, 15, 18, 21, or 24 words. A 13-word phrase is not a standard BIP39 mnemonic.
Unknown word
Every word must be in the selected BIP39 wordlist. A spelling difference can be enough to fail parsing.
Checksum mismatch
The words can all be real and still fail because the final checksum bits do not match the entropy.
Wrong language list
A word can be valid in another BIP39 language list and invalid in the English list used by many wallets.
Safe use boundary
Use public BIP39 pages for learning, not for live secrets.
YSeed is useful because it stays narrow: it teaches and validates BIP39 structure locally, then refuses wallet-recovery features that increase exposure.
Use test phrases online
A browser demo is useful for learning word counts, checksum behavior, and the English wordlist. Real funded phrases need a stricter environment.
Validate structure only
A validator can check count, wordlist membership, and checksum. It should not ask to derive private keys, addresses, xpubs, or balances.
Move to offline workflows for real secrets
If the phrase matters, use wallet-controlled or offline tooling and keep cameras, clipboard history, cloud sync, and extensions out of the ceremony.
Next concept
Checksum explains why valid-looking words can fail.
If you understand BIP39 as entropy plus checksum, the next useful topic is why a phrase can use real words but still be invalid.
Sources and verification
Check the explanation against primary references.
This page separates the standard from wallet claims. The goal is simple: keep the explanation checkable against the specification and keep real phrases out of public tools.
BIP39 FAQ
What is BIP39 in simple terms?
BIP39 is a mnemonic code standard. It defines how wallet entropy plus checksum bits become recovery words, and how those words can be converted into binary seed material.
Is BIP39 the same as a wallet?
No. BIP39 is a phrase standard. Wallet software can use BIP39 to generate or recover wallet seed material, but BIP39 itself is not a wallet, account, custody service, or balance checker.
Does BIP39 validation prove funds exist?
No. BIP39 validation checks phrase structure, not wallet balance, ownership, safe generation, or whether a phrase has ever been used.
Why does BIP39 use 2048 words?
A 2048-word list maps cleanly to 11-bit indexes because 2048 equals 2 to the 11th power. The entropy plus checksum bitstream is split into those 11-bit indexes.
What are the BIP39 formulas?
BIP39 uses CS = ENT / 32 for checksum bits and MS = (ENT + CS) / 11 for mnemonic length in words. ENT is the original entropy length.
How does BIP39 turn a mnemonic into a seed?
The mnemonic sentence and optional passphrase are processed with PBKDF2-HMAC-SHA512 for 2048 iterations. The salt is the word mnemonic plus the optional passphrase.
Can any 12 BIP39 words make a valid phrase?
No. The words must be from the list, but the checksum bits also need to match the entropy. A phrase can use real BIP39 words and still fail checksum validation.
Should I paste a real wallet phrase into a BIP39 explainer?
No. Use public pages for test phrases and education. Real recovery phrases should be handled in trusted wallet software or an offline environment you control.