How can one seed phrase hold many accounts, and what is a derivation path?

A tree of keys

Mastering Ethereum describes two kinds of wallet. In the old kind, every key is a separate random number. In the newer kind, every key is worked out from one seed, so the seed can make all of them again.⁴

A 2012 standard, BIP-32, made this into a tree. It describes how to grow a tree of key pairs from a single seed.¹ These are called hierarchical deterministic, or HD, wallets.¹ "Deterministic" means the same seed always gives the same keys.^1,4

The tree has a useful property. Whoever knows a private key high up in the tree, in its "extended" form, can work out every key below it.¹ So the recovery phrase from Lesson 4, which makes the seed at the top, can rebuild every key in the wallet.^5,4

Reading a derivation path

Each key in the tree has a path, like a street address. A 2014 standard, BIP-44, gives the path five levels:²

m / purpose' / coin_type' / account' / change / address_index²

The apostrophe marks hardened derivation, a way of making keys that BIP-32 adds for security.^2,1 BIP-32 explains why it is used for accounts: a leaked key at account level or below can never expose the master key or other accounts.¹

Ethereum uses only the receiving chain, so the change level is 0.⁴ Bitcoin uses both, because a Bitcoin payment often sends "change" back to the payer.^2,4

Accounts are like bank accounts

BIP-44 suggests using accounts the way people use bank accounts: one for donations, one for savings, one for common expenses.² A wallet should not create a new account while the previous one has never been used.²

When you restore a phrase, BIP-44 has the wallet search for accounts one by one. It stops looking along a chain after 20 unused addresses in a row, a number it calls the gap limit.²

One phrase, many coins

The coin-type level gives each cryptocurrency its own branch of the tree.² The SLIP-44 registry lists the numbers: 0 for Bitcoin, 1 for testnets of all coins, 60 for Ether.^6,4

So one phrase can hold both Bitcoin and Ethereum keys, on separate branches.^2,4 Bitcoin also has other standard paths for its newer address types.³

Why another wallet may show different accounts

Mastering Bitcoin points out that a phrase alone is not always enough to recover everything. You also need to know which paths your wallet used to make its keys.³ A tree has far too many branches for a wallet to check them all.³

So if you restore a phrase in a different app and see different or empty accounts, the phrase may still be right. Common reasons:^3,5

• A different path. The new app looks on other branches. Mastering Bitcoin notes older software won't find newer paths where funds may have been received.³
• A different passphrase. Each BIP-39 passphrase gives a different wallet (Module 8).⁵
• A different standard. Not every wallet uses BIP-39.^4,5

Watch-only: public keys without spending power

BIP-32 lets someone work out public keys without the private keys.¹ That means part of a wallet can be shared without the power to spend.¹

BIP-32's own example is an audit. Sharing the extended public keys lets an auditor see every transaction in and out, but not a single secret key.¹ Mastering Ethereum says this lets a wallet work in a watch-only way, without the private keys that can spend.⁴

BIP-32 adds a warning. An extended public key plus any one ordinary (non-hardened) private key below it can reveal the parent private key. So extended public keys need more care than ordinary ones.¹