How does a 12-word seed phrase work, and why does it matter more than a password?

From random bits to words

Many wallets follow a standard called BIP-39 to make a recovery phrase, also called a seed phrase.^1,5 It works in four steps.¹

1. Random bits. The wallet makes between 128 and 256 random bits, in a multiple of 32. The standard calls this the entropy.¹
2. A checksum. It hashes the entropy with SHA-256 and adds the first few bits of the hash to the end: one checksum bit for every 32 bits of entropy.¹
3. Groups of 11. It cuts all the bits into groups of 11. Each group is a number from 0 to 2,047.¹
4. Words. Each number picks a word from a fixed list of 2,048 words.¹

Why 11 bits? Because 2^11 = 2,048, so every 11-bit number matches exactly one word on the list.¹

The words and the checksum

BIP-39 describes an ideal word list. Typing the first four letters of a word is enough to identify it, and the list avoids having both words of a similar pair, such as "build" and "built".¹

The checksum means not every list of words is a valid phrase. In a 12-word phrase the last 4 bits must match, so only 1 in 2^4 = 16 random lists of 12 words passes.¹ Wallet software must warn you if a phrase's checksum is wrong.¹

BIP-39 itself lists the short checksum as a weakness. It gives only modest odds of catching random errors, and it can't help you correct one.¹

From words to keys

The words are then put through a key-stretching function called PBKDF2, which runs a hash called HMAC-SHA512 2,048 times.¹ Mastering Bitcoin says this makes guessing only slightly harder.² The result is a 512-bit seed, which makes every key in the wallet (Lesson 5).¹

An optional passphrase can be added at this step, and each passphrase gives a different wallet. Module 8 covers it.¹ Because the step is one-way, you can't turn a seed back into words.¹

Why 12 words beat a password

Count the possibilities. Twelve words carry 128 random bits, so there are 2^128 possible phrases: about 3.4 × 10^38, a 39-digit number.¹ Mastering Bitcoin says 128 bits is more than enough to stop an attacker who has to guess the whole phrase.²

NIST, the US standards body, says it is hard to measure in bits how strong a password is when people choose it themselves, so it judges passwords mainly by length.⁶ A password can still be counted the same way as a phrase, but only if every character is picked at random. This is our own worked example, not a NIST figure: a character picked at random from 64 choices adds 6 bits, because 2^6 = 64.

So, on this arithmetic, a random password needs 22 such characters just to match the 128 random bits of a 12-word phrase.¹ And people rarely pick passwords at random. NIST says people often choose passwords that are easy to guess, and respond to rules in very predictable ways, such as turning "password" into "Password1".⁶

A BIP-39 phrase is made by the computer. The standard says it is not meant for sentences people make up themselves.¹ Mastering Bitcoin explains why: humans are very poor sources of randomness.²

Why the stakes are higher

A bank password protects an account that someone else runs. NIST notes that a service can slow down guessing by limiting login attempts.⁶ If you forget it, there is usually a way back in. ethereum.org notes, for example, that crypto exchanges let you recover a username and password in the usual way.⁷

A recovery phrase is different. ethereum.org calls it the master key to your wallet: anyone who has it can reach all your accounts and drain every asset.³ An SEC investor bulletin says a private key can't be changed or replaced, and if you lose it, you can lose access for good.⁴

Never type it into a website

ethereum.org says no real service, support agent or website will ever ask for your recovery phrase.³ It warns that some phishing emails link to fake websites that ask for it.³ The bulletin's advice is the same: never share your private keys or seed phrases.⁴

NIST notes that passwords can be phished too.⁶ The difference is what a phished secret unlocks. A recovery phrase unlocks everything in the wallet, and there is no one to call.^3,7