Seed phrases: the 12 words that are the wallet
The short version. The 12 or 24 words a crypto wallet shows you on day one are not a password. They are the wallet: every private key and every address is computed from them, nobody can reset them, and anyone who reads them can spend the funds. The tools below let you generate a phrase in your browser, from a random source or from your own dice rolls, check one, or work out the last word of one you built by hand. For money you cannot afford to lose, let a hardware wallet do the generating offline. For understanding how it all works, read on.
Read this before you fund a wallet with a phrase from this page. The words are drawn by your own browser from the operating system's cryptographic random source, and nothing is sent to our server. The page does load the same analytics script as the rest of the site, and like any web page it runs on a computer that is online, with extensions, other tabs and whatever else is installed. That is a fine environment for learning, for testing a wallet app or for a small spending wallet. It is not where a serious amount of money should be born. A hardware wallet generates its phrase on an isolated chip and never shows it to a computer at all.
Three things that look alike and are not
Createpass already makes passwords and passphrases, and the passphrase list we use happens to have 2048 words, exactly like the BIP39 list a wallet draws from. The resemblance stops there, and the differences are the whole point of this page.
| Random password | Passphrase | Seed phrase | |
|---|---|---|---|
| What it protects | An account someone else runs | A secret you type from memory | The wallet itself, which nobody else holds |
| Who can reset it | The service, through account recovery | You, by choosing a new one | Nobody, ever |
| Can you choose the words | Yes, but you should not | No, they are drawn at random | No, and the last word is forced by a checksum |
| Word list | Not applicable | Any list, ours has 2048 words | One fixed list of 2048 words per language, defined by BIP39 |
| Separator | Not applicable | Dash, dot, space, your choice | A single space, nothing else |
| If someone reads it | Change it and check your sessions | Change it | Move the funds immediately, the phrase is burnt |
| If you lose it | Use the reset link | Use your backup or reset | The funds are gone |
A Createpass passphrase such as Harbor-Lantern-Copper-Meadow-Trellis-Quartz is a fine master password. It is not a seed phrase and no wallet will accept it, because the words are not on the BIP39 list and there is no checksum. The reverse is also true: a seed phrase makes a poor password, since every cracking tool knows the 2048 word list.
How the twelve words are made
BIP39, a Bitcoin standard from 2013 later adopted by Ethereum and almost every other wallet, defines the recipe. The wallet draws 128 random bits for a 12 word phrase, or 256 for 24 words. It hashes those bits with SHA-256 and takes the first few bits of the hash as a checksum: one checksum bit for every 32 bits of entropy, so 4 bits for 12 words and 8 for 24. Entropy plus checksum is then cut into 11 bit slices, and each slice is a number between 0 and 2047 that points at a word. 2048 is 211, which is why the list has exactly that many words, and why our own passphrase list copied the idea.
| Words | Entropy | Checksum | Total bits | Valid last words |
|---|---|---|---|---|
| 12 | 128 bits | 4 bits | 132 = 12 × 11 | 128 of 2048 |
| 15 | 160 bits | 5 bits | 165 = 15 × 11 | 64 of 2048 |
| 18 | 192 bits | 6 bits | 198 = 18 × 11 | 32 of 2048 |
| 21 | 224 bits | 7 bits | 231 = 21 × 11 | 16 of 2048 |
| 24 | 256 bits | 8 bits | 264 = 24 × 11 | 8 of 2048 |
The English list was built so that the first four letters of every word are unique, which is why steel backup plates only stamp four letters per word, and so that no two words are a single letter apart. Official lists exist in other languages, but nearly every wallet only restores the English one, so a phrase in another language is a phrase you may not be able to use when it matters.
Once the words are accepted, the wallet runs them through PBKDF2, a deliberately slow function, to get a 512 bit seed, and from that seed derives a whole tree of keys and addresses following the BIP32 and BIP44 standards. One phrase therefore covers every coin, every account and every address the wallet will ever make, and can be restored on any compatible app.
Twelve or twenty four?
Both are safe against guessing. 128 bits is already more than the elliptic curve behind Bitcoin itself provides, so the extra 128 bits of a 24 word phrase add nothing an attacker could feel. Hardware wallets default to 24 anyway, partly out of caution and partly because 256 bits survive a poor random source better. The practical cost is real: twice as much to engrave, to read back and to get wrong. Keep whatever your wallet gave you, do not try to convert one into the other, and spend the effort on the backup rather than on the word count.
Why the last word is not yours to choose
Because the checksum lives inside it. For 12 words, the last word carries 7 bits of entropy and 4 bits of checksum, so only 128 of the 2048 words can legally sit in twelfth position once the first eleven are fixed. Pick the wrong one and a wallet refuses the phrase, which is a feature: it catches most transcription errors, and it stops people choosing twelve words they like and believing they have 128 bits of randomness.
If you draw your own words by hand, with dice or any other physical method, this tool gives you the valid closing words. Type the first 11, 14, 17, 20 or 23 words and pick one of the results at random.
Rolling your own entropy
Readers of our passphrase page will recognise the idea: Diceware has used physical dice to pick words since 1995, precisely so that no software has to be trusted. Seed phrases can be made the same way. Each roll of a six sided die is worth log2(6), about 2.58 bits, so 50 rolls cover a 12 word phrase and 99 cover a 24 word one. The rolls are written down as a string of digits, the string is hashed with SHA-256, and the hash supplies the entropy. That is the convention used by the Coldcard hardware wallet, so you can roll once, type the same digits into a Coldcard offline, and check that both produce the same words.
Use a real die, not an app pretending to be one, and keep every roll. Throwing away runs that look suspicious, such as five sixes in a row, makes the result less random rather than more. Casino dice are marginally better balanced than board game dice, but once you are well past the minimum number of rolls the difference does not matter.
Checking a phrase
The checker confirms that a phrase has a valid word count, that every word is on the English list, and that the checksum matches. It runs in your browser only. It is meant for a phrase you have just produced on this page, or for a test phrase, so you can see how a wallet reacts to a swapped word or a typo.
Never type the seed phrase of a funded wallet into this page or any other website. A seed phrase checker is the favourite disguise of phishing sites aimed at crypto holders. If a real wallet rejects your phrase, compare each word's first four letters against the printed list, and attempt the restore on the device itself, offline.
The passphrase on top of the seed
BIP39 allows an optional extra secret, often called the 25th word, which is simply text you add to the seed phrase. Any passphrase, including an empty one, opens a different wallet from the same words, and there is no wrong answer: a typo lands you on an empty wallet without any error message. Used well, it means a thief who finds your steel plate finds a decoy wallet with pocket money on it. Used badly, it means your heirs find the plate and cannot reach anything. If you use one, back it up separately from the words, and test a full restore before moving funds behind it. A six word passphrase from our generator is a far better 25th word than a date or a pet's name.
What the phrase does not cover, and the formats you may meet
- Derivation paths. Two wallets can accept the same phrase and show different addresses because they walk the key tree differently. Note which app and which account type you used alongside the backup, especially for anything other than a plain Bitcoin or Ethereum wallet.
- Electrum. The oldest desktop Bitcoin wallet has its own 12 word format, older than BIP39, with a different checksum. An Electrum phrase will not restore elsewhere, though Electrum can import a BIP39 phrase if asked.
- Monero. Twenty five words from a list of 1626, with the last word as checksum. Same idea, no compatibility.
- SLIP39 shares. Trezor's scheme splits the secret into several 20 or 33 word shares using Shamir's secret sharing, for example five shares of which any three rebuild the wallet. This is the proper way to spread a backup across places, and the reason you should never cut a 24 word phrase in half and store the halves separately: each half found cuts the security to almost nothing.
- Multisignature wallets. Several phrases, each backed up on its own, plus a wallet descriptor saying how the keys combine. Lose the descriptor and even a complete set of phrases is a puzzle.
- Private keys on their own. Before seed phrases, people backed up single keys in WIF format, a string starting with 5, K or L, or as 64 hexadecimal characters. Some wallets still export them. A single key covers a single address, nothing more.
Backing it up like it matters
The backup has to outlive a fire, a burglary, your own memory and eventually you. Write the words by hand, on paper or on one of the steel plates sold for the purpose, and nowhere else: no photo, no screenshot, no text file, no email to yourself, no synced note. Malware exists whose only job is to scan a device for twelve or twenty four English words in a row. An encrypted password manager is an acceptable compromise for a wallet you spend from, not for savings.
Keep two complete copies in two places, such as home and a bank box or a trusted relative. Test a restore on a wiped device before you move anything substantial, because a backup you have never restored from is a hope, not a backup. And leave instructions somewhere your heirs will find them: blockchain analysts estimate that millions of bitcoins already sit at addresses whose keys died with their owners.
The scams, in one paragraph
Every one of them ends with you typing the words somewhere. No support agent, wallet maker, exchange or developer ever needs your seed phrase to help you, so anyone asking for it is the problem, however helpful the conversation felt. The same goes for sites offering to sync, validate, migrate or unlock a wallet, for apps found through adverts rather than the maker's own site, and for free token giveaways that want to verify your wallet first. Clipboard malware that swaps a copied address for the thief's is the quiet cousin of all this: read the first and last characters of any address before you confirm a transfer.