BIP39

Nearly every wallet you can buy implements it, which is why a phrase written down on one brand of device restores on another. The document was submitted on 10 September 2013 and Bitcoin Core has still never implemented it. Its authority over your backup comes from industry adoption rather than from the standards process.

How it works

Marek Palatinus and Pavol Rusnak of SatoshiLabs, with Aaron Voisine and Sean Bowe, wrote BIP-39. The specification defines two conversions and nothing else.

The first turns randomness into words. A wallet takes entropy of 128, 160, 192, 224, or 256 bits, hashes it with SHA-256, and appends the first entropy-length-divided-by-32 bits of that hash as a checksum. The total is then read 11 bits at a time, each chunk selecting one word from a list of exactly 2,048. The five entropy sizes yield 12, 15, 18, 21, and 24 words respectively, and the two you will actually meet are the ends of that range.

The checksum is small on purpose. A 12-word phrase carries four checksum bits, so a randomly assembled list of twelve valid words passes validation about one time in sixteen. That is enough to catch nearly every hand-copying mistake and nowhere near enough to make an invented phrase safe.

The second conversion turns words into a seed. The phrase is normalized to Unicode NFKD, then run through PBKDF2 using HMAC-SHA512 over 2,048 iterations, with the salt formed by the literal string "mnemonic" followed by an optional user passphrase. The output is always 512 bits, whether the phrase was 12 words or 24.

Wordlists are part of the standard, not decoration. The English list is built so that no two words share their first four letters and visually confusable pairs are excluded. Official lists also exist for Japanese, Korean, Spanish, Chinese in both scripts, French, Italian, Czech, and Portuguese. A phrase is only meaningful against the list it was drawn from, which is why a Spanish phrase entered into an English-only wallet fails immediately.

Where you see it

Every hardware wallet setup screen, every "restore from 12 or 24 words" dialog, and every recovery flow in mainstream software is BIP-39 underneath. The compatibility that produces is real and worth protecting: it is the reason a failed device is an inconvenience rather than a loss.

The standard's weak point is what it leaves out. A phrase says nothing about which derivation path, script type, or wallet software produced it, and it carries no version field to grow one later. Two wallets can read the same words correctly and still show you different addresses and different balances. Recording the path alongside the words is the standard workaround, and it is entirely a convention rather than something the specification helps with.

The 2,048 PBKDF2 iterations are the other criticism. That count was cheap in 2013 and is trivial now, so the stretching offers almost no protection to anyone who chooses a weak optional passphrase. It protects nothing at all about the words themselves, which rely on their 128 or 256 bits of machine entropy.

BIP39 vs HD wallet

BIP-39 turns words into a seed; BIP-32 turns a seed into a tree of keys. They are separate documents by different authors, and a wallet can implement either without the other. Bitcoin Core is fully hierarchical deterministic and has no mnemonic support whatsoever. Electrum is equally hierarchical deterministic and uses its own phrase format with a version marker built in. Treat "BIP-39 compatible" as a promise about reading your words, not a promise about which addresses appear afterward.