BIP39

Updated Apr 13, 2026

BIP39 is the technical standard that defines how cryptocurrency wallets generate seed phrases. It specifies the word list those phrases draw from, the number of words used, and the mathematical process that converts a sequence of words into the cryptographic root of a wallet.

BIP39 stands for Bitcoin Improvement Proposal 39. Despite the name, the standard doesn't limit itself to Bitcoin. It is the foundation for seed phrase generation across Ethereum, Solana, Litecoin, and other major blockchains. Any wallet that provides a 12- or 24-word recovery phrase is almost certainly using BIP39.

The standard exists for one practical reason: interoperability. Before BIP39, every wallet generated backups in its own format. A backup from one wallet was useless in another. BIP39 established a universal method so that any compliant wallet can restore any compliant backup, regardless of which app or device created it.

How BIP39 Works

BIP39 turns a random number into a human-readable phrase and then turns that phrase back into a cryptographic seed. The process has three stages.

Stage one: generating entropy. The wallet generates a random number of either 128, 160, 192, 224, or 256 bits. More bits produce a longer phrase. A 128-bit number produces 12 words. A 256-bit number produces 24 words.

Stage two: converting to words. The system appends a checksum to the entropy by hashing it and taking the first few bits of the result. The combined binary string is split into 11-bit segments. Each segment corresponds to a number between 0 and 2047, which maps to a specific word in the BIP39 word list. The result is your seed phrase.

Stage three: deriving the seed. The phrase passes through a key-stretching function called PBKDF2, run 2048 times, with the string "mnemonic" plus any optional passphrase as a salt. The output is a 512-bit seed. That seed becomes the root of an HD wallet's entire key tree, which is handled from this point onward by BIP32.

The checksum built into the final word is why wallets can immediately detect most transcription errors. If you miswrite a word, the checksum fails, and the wallet tells you before you discover the problem during a real recovery attempt.

The BIP39 Word List

The English BIP39 word list contains exactly 2,048 words, chosen with specific properties that reduce errors:

No two words share the same first four letters. Typing "aban" can only match "abandon." This allows wallets to auto-complete entries starting with 4 characters.
No word appears as a substring of another. Neither "Act" nor "action" appears.
All words are between 3 and 8 letters. Short enough to write quickly, long enough to be distinct.
Words were selected to be recognizable across different English dialects and readable without ambiguity.

BIP39 also defines official word lists in Japanese, Spanish, Chinese (simplified and traditional), French, Italian, Czech, Portuguese, and Korean. The English list remains the most widely supported. If a wallet generated a phrase in another language, confirm that the target wallet for restoration supports that specific list before attempting recovery.

BIP39 in Practice

A user sets up a new hardware wallet. The device generates 256 bits of random entropy, appends a checksum, splits the result into 24 eleven-bit segments, and maps each to a word from the BIP39 list. The 24 words are displayed one at a time. The user writes each word on a recovery sheet and completes the verification step.

Two years later, the hardware wallet is damaged beyond use. The user buys a different hardware wallet, selects "restore from seed phrase," and enters the 24-word seed phrase in order. The new device runs the same BIP39 algorithm, derives the same 512-bit seed, passes it to BIP32, and reconstructs the same key tree. Every address and every balance reappear identically.

Different manufacturers made the original device and the new device. The apps were different. The chips were different. The result was identical because both followed the BIP39 standard. That is exactly what the standard was designed to produce.

Risks and Common Misconceptions

"BIP39 phrases are secure because the words look random." The security comes from the entropy behind the words, not the words themselves. A phrase generated by a properly seeded random number generator on a trusted device is secure. A phrase generated by a compromised device, a fake wallet app, or a website that logs inputs is not, regardless of how random it looks.
"Any 12 or 24 English words form a valid BIP39 phrase." No. Only words from the 2,048-word BIP39 list are valid, and the final word must satisfy the checksum. Attempting to restore a wallet with words outside the list or in the wrong order will either fail immediately or, in rare cases, derive a completely different empty wallet.
"My BIP39 phrase works in every wallet." BIP39 standardizes phrase generation and seed derivation. What it does not standardize is the derivation path used to generate addresses from the seed. BIP44 handles that. Two wallets using the same BIP39 phrase may still produce different addresses if they use different derivation paths for the same blockchain. Always verify path compatibility when restoring across different wallet brands.
"A longer BIP39 phrase is always safer." A 12-word phrase has 128 bits of entropy, which is computationally unbreakable with any existing or foreseeable technology. A 24-word phrase doubles the entropy to 256 bits. Both are secure in practice. The physical security of the backup matters far more than the length of the phrase for any realistic threat model.
"I can create my own BIP39 phrase by picking words manually." Human-chosen words are not random in the cryptographic sense. People gravitate toward common words, short phrases, and predictable patterns. Attackers know this and have dictionaries for it. A device must generate a BIP39 phrase using a cryptographically secure random number generator, not you choosing it by hand.

Tangem's Approach to BIP39

Tangem fully supports BIP39 as an optional feature. When a user chooses to enable seed phrase generation during setup, Tangem produces a standard BIP39 phrase using entropy generated inside the card's certified secure element. The phrase follows the same 2,048-word English list and the same derivation process as every other compliant wallet. You can restore any address the card creates in MetaMask, Trezor, or any other BIP39- and BIP44-compatible wallet using that phrase.

Tangem's default setup, however, does not generate a BIP39 phrase. The private key is created and stored inside the secure element and never leaves it. There is no phrase to write down, no paper backup to protect, and no single written document that gives anyone complete access to the wallet.

This is a deliberate response to the most common point of failure in BIP39-based self-custody: the backup. BIP39 is a robust standard. The weak point is not the cryptography. It is the moment a user writes 24 words on a piece of paper, stores it somewhere accessible, photographs it for convenience, or simply loses it. Tangem removes that exposure by default while keeping BIP39 available for users who need cross-wallet portability.

Frequently Asked Questions About BIP39

What is the difference between BIP39 and BIP32?

BIP39 defines how a seed phrase is generated and converted into a 512-bit cryptographic seed. BIP32 defines what happens next: how that seed generates a hierarchical tree of private keys and addresses. BIP39 produces the root. BIP32 builds everything from it.

Can I use a BIP39 phrase from one wallet on a completely different brand?

Yes, as long as both wallets are BIP39- and BIP44-compliant and use the same derivation path for the relevant blockchain. Most major wallets follow the standard paths. If addresses do not appear after restore, the derivation path may differ between the two wallets.

Is it safe to check my BIP39 phrase on a website?

No. Entering your seed phrase into any website, including one that claims to verify or validate BIP39 phrases, exposes it to that server and anyone who has access to it. You should never type your seed phrase into any internet-connected interface.

What happens if I lose one word from my BIP39 phrase?

Recovering a wallet from an incomplete phrase is possible in some cases. If only one word is missing, a wallet or recovery tool can brute-force it by trying all 2,048 possibilities and checking which produces a valid checksum. This gets significantly harder with two or more missing words. An accurate, complete recording of every word during setup is far preferable to any recovery attempt.

Does BIP39 work equally well for hardware and software wallets?

Yes. BIP39 is a generation and derivation standard, not a storage standard. It works the same way regardless of whether the resulting seed is stored in a secure chip, a mobile app, or a browser extension. The security difference between wallet types comes from how and where the key is stored, not from the BIP39 process itself.