Derivation path

A path is a coordinate, not a secret. Two numbers near the front decide whether your words rebuild addresses that start with 1, 3, bc1q or bc1p, because BIP-44, BIP-49, BIP-84 and BIP-86 each read the same phrase differently. Recording the path beside your backup is the difference between a restore that finds your coins and one that reports zero.

How it works

A path is read left to right, one level per slash, and each level narrows the search. The m at the front is the master key generated from your seed. Everything after it is an index, and an apostrophe or an h marks that index as hardened.

The first level is the purpose, and it is the level that decides what your addresses look like.

The second level is the coin type, taken from the SLIP-0044 registry, where bitcoin is 0 and every testnet is 1. The third is the account number, which is how one seed can hold a personal wallet at 0h and a business wallet at 1h with no shared history. After that the hardening stops: the fourth level is the chain, 0 for addresses you give out and 1 for change, and the fifth is the address index that counts upward as you receive payments.

That split between hardened and normal levels is deliberate. Because the account level is hardened, the extended public key for m/84h/0h/0h can be exported to a phone or an accountant, who can then derive every receiving and change address under it but cannot climb sideways into another account or upward toward the master key.

Multisig uses its own branch. BIP-48 puts cosigner keys at m/48h/0h/0h/2h for native SegWit, with the final hardened level naming the script type, so a device can tell a single-signature account from a multisig one before it signs anything.

Why this matters when you buy bitcoin

The path never touches your security. It changes nothing about how hard your coins are to steal, and everything about whether the software in front of you can find them.

The failure this causes is common and reliably terrifying. You buy on an exchange, withdraw to a device, and the coins land at bc1q addresses under m/84h/0h/0h. A year later you restore the same 24 words into a different app that defaults to legacy, and the balance reads 0.00000000 while a block explorer still shows your money sitting untouched at the old address. Nothing was lost. The app is looking down the wrong branch of a tree with four billion children per level.

Defaults differ between the wallets we review. Trezor Suite and Ledger Live each present accounts by address type and quietly pick a purpose for you. Electrum asks which script type you want at restore time and hides a free-text path field behind an advanced option. Sparrow will scan several standard paths at once and show you which one has history. None of them is wrong, and none of them can guess what the other one did.

Two habits remove the whole problem. Write the account path and the address type on the same note as the wallet name, and keep that note somewhere you can reach without the seed, such as a password manager, since it reveals nothing on its own. Then, before you trust a restore, compare the first receiving address it shows against the one your original device shows. If those two strings match, every address below them will match too.

Restoring 24 words into Electrum and seeing zero

A restore on the wrong path plays out like this. A Trezor Model T was set up with 24 words, an exchange withdrawal went to its first native SegWit address, and the device now sits in a drawer. Months later the phrase is typed into Electrum on a laptop.

Electrum asks for the script type before it scans. Choose legacy p2pkh and it derives m/44h/0h/0h, shows addresses beginning with 1, finds nothing, and reports an empty wallet. The coins are still at the bc1q address, still confirmed, still visible to anyone with the txid.

The fix takes a minute. Restore again, choose native SegWit, or open the advanced derivation field and enter m/84'/0'/0' by hand. Electrum rescans, the balance appears, and the address list starts with the same string the Trezor displays under its receive tab. If it still reads zero and you know payments went further along the branch, raise the gap limit from the default 20 before assuming anything is missing.

Nothing in that sequence involved risk to the coins, because a restore is a read operation. You can try every purpose in turn, one after another, and the only cost is the time each rescan takes.

Derivation path vs output descriptor

A path says where; a descriptor says where, what, and starting from which key. The descriptor wpkh([fingerprint/84h/0h/0h]xpub/0/*) contains the same path, plus the script type as a wrapper function, plus the extended key itself, plus a checksum that catches a mistyped character. Handing someone a path tells them nothing about your wallet. Handing them a descriptor hands over your entire address history and every future address on that branch, which is why one is safe to email and the other is not.