Mnemonic word list

A word list is a dictionary, not a secret: anyone can download it, and your security comes from which words got picked and in what order. Each official list holds exactly 2,048 entries, so every word in your backup carries 11 bits and no more. Copy your backup in English unless you have a reason not to, because the specification itself strongly discourages the other nine.

How it works

Every mnemonic word list holds 2,048 entries because 2,048 is two raised to the eleventh power. That makes the mapping arithmetic rather than lookup magic: slice the wallet's entropy and checksum into 11-bit chunks, read each chunk as a number between 0 and 2,047, and print the entry sitting at that position. In the English file, position 0 is "abandon" and position 2,047 is "zoo".

Position is the only thing the encoder cares about. Each file is stored alphabetically, which lets a wallet find a typed word by binary search or a prefix tree instead of scanning 2,048 rows. Because every language sorts its own vocabulary, index 500 holds "direct" in English and "dauphin" in French.

BIP-39 sets out three goals for a good file: four typed letters should identify a word, near-duplicates like "build" and "built" or "woman" and "women" should be excluded, and the whole thing should be sorted. English delivers the first and the third outright. Entries run from three to eight letters, and no two of the 2,048 share a four-letter prefix.

The second goal is looser than it sounds. The specification's own examples are honoured, since "build", "woman" and "quick" are in the file while "built", "women" and "quickly" are not, but plenty of one-letter neighbours survived: "angle" and "ankle", "action" and "auction", "awake" and "aware" all sit in the same 2,048. Read the whole word when you copy a backup, not the shape of it.

The four-letter promise has a gap worth knowing about. 103 English entries are only three letters long, and 49 of those are the opening of a longer entry in the same file: "act" sits beside "action", "actor", "actress" and "actual", and "art" beside "artefact", "artist" and "artwork". Four keystrokes cannot select "act" at all, so a wallet has to accept a space or a tap on the suggestion. A written abbreviation is still safe, because truncating every entry to four letters leaves 2,048 distinct strings; it is live typing that needs the delimiter.

Nine translations exist alongside English: Japanese, Korean, Spanish, Chinese in simplified and traditional script, French, Italian, Czech and Portuguese. Each was built to its own published rules. French entries are five to eight letters, with no demonyms and nothing carrying a circumflex or a cedilla. Italian rejects doubled vowels and, by its own rule, "words that remind negative/sad/bad things". Czech excludes every letter with a diacritic, which its author calls the hardest task, since a third of Czech letters have one.

Cross-language collisions are the part nobody mentions. Spanish shares no entry with any other language, so one Spanish word identifies the whole phrase. English and French are not so tidy: 100 words appear in both files, among them "abandon", "orange", "piano", "puzzle" and "village", and not one of those 100 sits at the same index in the two. "abandon" is 0 in English and 1 in French.

That gap matters because the seed comes from the letters you typed, not from the indices behind them. BIP-39 stretches the joined sentence itself, so a phrase built only from those 100 shared words gives the same seed under either language setting, while the checksum, which is computed from indices, will usually reject it under the wrong one. Genuinely translating a phrase, swapping each word for the same-index word in another file, changes the sentence and therefore hands you a completely different wallet.

Why this matters when you buy bitcoin

Twenty-four words drawn from a 2,048 entry word list look identical whether they encode 256 bits of randomness or 72. A word list is a transcription format and carries no evidence about the quality of the numbers behind it, which is how the Coldcard defect covered in our review went unnoticed for more than five years: from March 2021 a build error routed seed generation to a software random number generator, leaving an effective search space Coinkite puts at roughly 40 bits on the Mk2 and Mk3 and roughly 72 bits on the Mk4, Mk5 and Q, against a 128 bit target. Fixed firmware landed on July 31, 2026. The printed words never looked any different, and nothing about them could have warned anyone.

The language question lands differently across the 231 country guides here. A reader in Madrid, Prague or Osaka may be offered a localized file by a wallet app, and BIP-39 itself is blunt that the vast majority of wallets support only English and that the alternatives are strongly discouraged. A translated file solves a transcription problem now and creates a restoration problem later, when the wallet that offered the option may be gone and the replacement may read English only. Japanese carries a second trap: its phrases are written with ideographic spaces rather than ASCII ones, so a phrase retyped on the wrong keyboard can look right and split wrong.

Some wallets reviewed here avoid the choice completely. Tangem, rated 3.8, ships in sets of two cards for $59.90 or three for $69.90 and generates keys inside the card with no phrase shown by default, so there is no file to pick and nothing written down to photograph. That is a genuine answer to the problem a word list creates, and it carries its own cost, which the review sets out.

Why a Trezor Safe 5 can hand you twenty words

The Trezor Safe 5 supports 12, 20 and 24 word backups, and 20 is not a BIP-39 length. BIP-39 mints 12, 15, 18, 21 and 24 words and nothing else, so twenty words came from SLIP-39, the Shamir scheme the BIP-39 authors themselves proposed as a successor. SLIP-39 carries its own file of exactly 1,024 words, half the size, because it packs 10 bits into each word instead of 11.

The two files are not disjoint. 553 of the 1,024 SLIP-39 words also appear in the BIP-39 English file, so you cannot tell the schemes apart by reading the vocabulary. Count the words instead. SLIP-39 also closed the three-letter gap by rule: nothing shorter than four letters, nothing longer than eight, unique four-letter prefixes throughout, and a minimum Damerau-Levenshtein distance of 2 between any two entries. It supports no language but English and says so plainly, blaming earlier "arbitrary wordlists" for confusing users and hurting interoperability.

Mnemonic word list vs seed phrase

A mnemonic word list is public and a seed phrase is not. The list is a file in an open repository that every BIP-39 wallet carries a copy of; your phrase is the specific 12 or 24 entries your device drew from it, in the order it drew them. Downloading the English file tells an attacker nothing, much as owning a dictionary does not help anyone guess a sentence. The difference is worth holding onto when a support account, a browser extension or a "wallet validator" page asks you to check your words against the official list: the list needs no checking, and the request is only ever aimed at the phrase.