HD wallet seed

Wallets talk about words because people can copy words by hand, but BIP-32 never sees words. It consumes a byte string and produces a master key in a single pass of HMAC-SHA512, keyed with the fixed text "Bitcoin seed". The words are one popular encoding of that byte string, and not the only one in use.

How it works

BIP-32 specifies a seed of between 128 and 512 bits, recommends 256, and says nothing about where those bits come from. The seed enters HMAC-SHA512 as the message, with the ASCII string "Bitcoin seed" as the key. The function returns 64 bytes. The left 32 become the master private key; the right 32 become the master chain code, the extra secret that stops a leaked child key from exposing its siblings. Everything else in a wallet, every account, every address, every change output, descends from that pair by repeating a similar hash with an index number.

The specification includes one edge case that never happens in practice. If those left 32 bytes come out as zero, or as a value at or above the order of the secp256k1 curve, the seed is invalid and the wallet must try again. The probability is around one in 2 to the power of 127, so no implementation has ever reported hitting it.

Where the bits come from is a separate layer, and there are several answers. BIP-39 always emits exactly 512 bits by running the mnemonic through PBKDF2. Electrum runs its own phrase through PBKDF2 with a different salt and gets a seed that no BIP-39 tool will ever reproduce from the same words. A wallet can also take 256 bits straight from a hardware random number generator and never show a phrase at all, which is what Bitcoin Core does.

The direction of travel matters. Words become a seed; a seed does not become words. Once a wallet holds only the raw value, no amount of software will print a mnemonic for it, which is why exporting "the seed" is not a substitute for keeping the phrase that produced it.

Where you see it

Ask Bitcoin Core about a wallet and it reports an hdseedid, a fingerprint of the seed, rather than any phrase, because Core has never implemented BIP-39. The sethdseed RPC, added in version 0.17.0, could install a specific seed into a legacy wallet, and descriptor wallets became the default for newly created wallets in Bitcoin Core 23.0.

Developer documentation is the other place it appears in the open. BIP-32 and BIP-39 both publish test vectors that show the seed as 128 hexadecimal characters next to the mnemonic that produced it, which is the clearest illustration available that the two are different objects.

The practical moment this bites is migration between tools. Some wallets and specifications, including Coldcard's seed backups and various developer utilities, import or export the raw value rather than words. Handing a raw seed to a tool that expects a mnemonic, or the reverse, produces either an error or, worse, a valid but empty wallet. Check which layer a field is asking for before pasting anything into it.

HD wallet seed vs seed phrase

The seed is a number; the phrase is a way of writing that number down. Keeping the two apart explains several things that otherwise look like magic. It is why adding an optional passphrase changes the seed while leaving your words untouched. It is why Electrum's phrase and a BIP-39 phrase can both be twelve English words and still open different wallets. And it is why a wallet advertising "seed import" may mean a mnemonic, a hex string, or an extended private key, three inputs that share a nickname and nothing else.