HD wallet

One seed produces a master key, the master key produces branches, and the branches produce every address you use. BIP-32 was assigned on February 11, 2012, and effectively every hardware, mobile and desktop wallet shipping today follows it. That is why twelve words on a card can restore a wallet you have been using for a decade.

How it works

An HD wallet turns one number into a hierarchy using a keyed hash, run over and over. The seed goes into HMAC-SHA512 with the fixed key string "Bitcoin seed", producing 64 bytes: the left 32 become the master private key and the right 32 become the master chain code. That pair is the root of everything below it.

Each further step takes a key, its chain code, and an index number, hashes them the same way, and yields a child key with a chain code of its own. Every node has 4,294,967,296 possible children, split into two halves: indices below 2,147,483,648 are normal and can be worked out from the public side alone, while indices at or above that line are hardened and require the private key. Repeating the step builds a tree, and a position in that tree is written as a derivation path.

Determinism is what makes the design worth having. The same seed, given to any correct implementation, produces exactly the same keys in the same order forever. No key is ever stored, only recomputed, which is why the backup is a sentence rather than a file that grows each time you get paid.

The words are a separate layer, and confusing the two layers causes most recovery problems. BIP-39 defines how a phrase drawn from a 2,048-word list becomes the seed, stretching it through PBKDF2 with HMAC-SHA512 over 2,048 iterations, salted with the string "mnemonic" plus an optional passphrase. BIP-32 knows nothing about words and BIP-39 knows nothing about trees. They are joined by convention, which is how two wallets can agree on your phrase and still disagree about your addresses.

Bitcoin Core has created only hierarchical deterministic wallets since version 0.16.0. Before that a wallet held a pool of unrelated random keys, and a backup went stale the moment the pool advanced past it.

Why this matters when you buy bitcoin

The phrase you write down during wallet setup is the only thing standing between you and every coin you will ever buy, and the tree structure is what makes that statement true.

Back up once and the backup stays complete. A hundred exchange withdrawals to a hundred fresh addresses are all descendants of one root, so nothing you do afterward enlarges what you have to protect. That is the largest practical improvement in bitcoin custody since the first client shipped, and it is equally the reason a seed phrase photographed once is compromised permanently: the photograph covers coins you have not bought yet.

Portability is the second payoff, and it comes with a catch. A phrase written down on a Trezor or a Ledger restores into Sparrow, Electrum or BlueWallet because they all implement the same standard. The catch is the route. BIP-44 produces addresses starting with 1, BIP-49 produces 3, BIP-84 produces bc1q, and BIP-86 produces bc1p, all from identical words. Restore into software that defaults to a different purpose and the balance reads zero while the coins sit untouched on another branch. Recording the derivation path beside the backup, and nothing else beside it, prevents that particular panic.

The gap limit is the third thing worth knowing. A restored wallet scans forward through 20 unused addresses under BIP-44 and then stops looking. Clicking a receive button forty times on a wallet you never backed up, then using the last address, is a reliable way to produce a restore that reports an empty balance.

Reading m/84'/0'/0'/0/0 one level at a time

A derivation path works like a postal address, narrowing at each level. Read the standard native SegWit path from left to right.

• m is the master key derived from your seed.
• 84' selects the BIP-84 purpose, which produces native SegWit addresses beginning bc1q. The apostrophe marks the level as hardened.
• 0' is the coin type, and 0 means bitcoin mainnet. Testnet would be 1'.
• 0' is the account, so a separate account for a business would be 1'.
• 0 is the chain: 0 for addresses you give out, 1 for change.
• 0 is the address index, stepping up with each payment received.

The first three levels are hardened and the last two are not, deliberately. That split is what allows an account-level extended public key to be exported to a watch-only wallet, which can then generate receiving and change addresses without ever being able to reach a sibling account or climb back toward the master key.

HD wallet vs seed phrase

An HD wallet is a derivation scheme; a seed phrase is one way of writing down the number it starts from. BIP-32 defines the tree and accepts any seed from 128 to 512 bits, recommending 256. BIP-39 defines the words. Electrum ships its own incompatible phrase format and is still entirely hierarchical deterministic, which shows the two layers are genuinely independent. The distinction matters when software claims to support BIP-39 recovery: that is a promise about reading your words, not about which branch it will look on afterward.

HD wallet vs derivation path

An HD wallet is the tree; a derivation path is one route through it. People describe a wallet as "a BIP-84 wallet" as though that were a product category, but any BIP-32 wallet can walk any path, and most current software will happily show several accounts at different purposes from one seed. Treat the path as a coordinate you record alongside the backup, not as a property of whichever app you happened to install.