§ บทความ · พื้นฐาน

BIP-39 recovery phrase — the security bible

What 12/24 BIP-39 words encode, where they live, the storage threat-model ladder, and why the passphrase kills more wallets than it saves.

โดย dont-trust-verify · เผยแพร่ 4 พฤษภาคม 2569

🇺🇸 EN content เปิดหน้าภาษาอังกฤษ →

The 12 or 24 words on the back of your hardware wallet are the wallet. The plastic device on your desk is just a calculator that knows how to use them. If you understand only one thing about self-custody, understand that — and then understand what that means for how you store, verify, and protect those words.

This is the article I wish someone had handed me in 2017 when I bought my first hardware wallet, glanced at the seed card, and put it in a drawer. Six years and a thousand near-misses later, this is what I actually know.

TL;DR. The 12 / 24 words are entropy + a checksum byte, deterministically mapped through a list of 2,048 dictionary words. They generate every Bitcoin address and private key your wallet will ever use. They live nowhere except wherever you wrote them down. Storing them well means defending against four threat classes: fire / water / loss (physical), theft (someone in your house), coercion (someone holding a wrench), and stupidity (you, in five years, having forgotten what the metal plate in the drawer is). Each of those threats has a different mitigation, and the optimal solution for one is usually wrong for another.

What the words actually are

BIP-39 is a Bitcoin Improvement Proposal from 2013 that defines how to convert a wallet’s underlying entropy into a memorable list of English (or other-language) words.

The mechanics, briefly:

  1. The wallet’s hardware random-number generator produces 128 bits (for a 12-word phrase) or 256 bits (for 24 words) of entropy. This step is the only step where physical randomness has to be good — the rest is deterministic.
  2. A SHA-256 hash of those bits is taken. The first 4 bits (12-word) or 8 bits (24-word) of the hash are appended as a checksum. So a 12-word phrase encodes 128 bits of entropy + 4 bits of checksum = 132 bits total.
  3. The 132 / 264 bits are split into 11-bit groups. Each 11-bit value (0-2047) maps to a word in the BIP-39 wordlist of exactly 2,048 words.
  4. Done. The string of words IS the entropy + checksum, in a more memorable form.

To turn the words back into actual Bitcoin keys, the BIP-39 phrase is fed through PBKDF2 with HMAC-SHA512, 2,048 iterations, with the optional passphrase as salt. The output is the master seed — 512 bits of cryptographically derived material that the BIP-32 hierarchical deterministic (HD) wallet algorithm then uses to generate every address you’ll ever see.

Three corollaries to remember:

Where the words actually live

This is the question Ledger / Trezor / Coinkite are constantly being phished for: “send us your seed for verification.” Every legitimate vendor has the same answer:

The seed exists nowhere except where you wrote it down. The vendor doesn’t have it. The vendor doesn’t want it. The vendor cannot recover it for you. Nobody can.

Inside the device, the seed never leaves the secure element after generation. When you sign a transaction, the device uses the seed to derive the relevant private key, signs the transaction, and returns the signature. The seed itself never crosses the USB cable, never crosses Bluetooth, never crosses the air gap. (This is what makes a hardware wallet a hardware wallet.)

When you wipe the device, the seed is gone from the device. If you didn’t write it down, and the device is wiped, the wallet is gone forever. There is no recovery. There is no “I lost my password” link. There is no support number to call.

This is the asymmetry of self-custody: you have all the power, and you have all the responsibility. Both at once.

The four threat classes

I’ve watched friends lose Bitcoin to all four of these. Different storage strategies map to different threats — the optimal answer depends on which you’re optimising against.

Threat 1 — fire / water / loss (physical degradation)

The ink on a paper seed card runs in a flooded basement. The card itself burns in a house fire. You move three times in a decade and one of the moves loses a box. Statistically, this is the most common way self-custodians lose their coins.

Mitigation ladder:

The cost of a steel plate is $20-100. The expected value of not having one if you have any meaningful holding is staggeringly negative. This is the single highest-ROI security upgrade in self-custody. Buy it the same week you set up the wallet.

Threat 2 — theft (someone in your house)

A house guest finds your seed card in a drawer. A burglar finds it during a break-in. A roommate’s friend’s friend hears about your Bitcoin and goes looking. A family member rifling through the safe.

Mitigation ladder:

Multisig is the right answer for any holding above ~1 BTC, in my opinion. Below that, the operational complexity tax outweighs the security benefit for most people.

Threat 3 — coercion (the $5 wrench attack)

xkcd 538 is the best diagram in cryptography. If someone holds a wrench, the threat model isn’t your seed storage — it’s you. The attacker doesn’t need to break encryption. They need to break you.

Mitigation ladder:

For most people, the rational answer is the first one: keep your mouth shut. Public bragging about Bitcoin holdings is the leading indicator for “person who got robbed”.

Threat 4 — stupidity / future-you

This is the threat people prepare for least and lose to most.

It’s 8 years from now. Your steel plate is in a fireproof safe in a closet. You’ve moved twice. You’re cleaning out a box of old electronics and you find what looks like a metal plate with random words on it. You don’t remember which wallet it goes to. You don’t remember if it’s the live wallet or a testnet practice wallet you made years ago. Your spouse asks what the plate is and you don’t have a confident answer.

Mitigation ladder:

The BIP-39 passphrase — when it helps, when it kills you

The “25th word” is the most powerful and most dangerous feature in BIP-39.

What it actually does: changes the master seed entirely. Your 24 words + passphrase “trezor” generate one wallet. Your 24 words + passphrase “treezor” generate a completely different wallet, with completely different addresses, that has no on-chain link to the first.

When it helps:

When it kills you:

The passphrase is appropriate if:

  1. You can memorise it AND record it in a separate location your heirs can find AND test recovery with it AND understand what it does.
  2. Your holdings are large enough to justify the operational complexity.
  3. You’re sober about the failure modes.

If you’re not sure you can do all four, don’t use it. A standard 24-word seed in a steel plate is fine for most people. The number of self-custodians who have lost more to forgotten passphrases than to attackers is non-trivial.

How to verify a backup actually works

Writing down 24 words and putting them in a safe is necessary but not sufficient. You don’t know the backup works until you’ve tested it.

Test recovery procedure (do this annually):

  1. Wipe a different hardware wallet (not your primary). Or use a software wallet on an air-gapped, freshly-installed laptop.
  2. Type your 24 words into it. If you have a passphrase, enter that too.
  3. Verify the first 5 receiving addresses match your primary wallet’s addresses exactly. If they don’t match, you have the wrong seed, the wrong derivation path, the wrong passphrase, or all three.
  4. Don’t move funds. This is a verification, not a migration. Wipe the test device when done.

You can also use the BIP-39 validator on this site to confirm your written-down phrase has a valid checksum byte. That tells you the phrase is mathematically self-consistent — i.e. you didn’t accidentally swap a letter or word. It doesn’t tell you it generates the right wallet (only step 3 above does that).

I cannot tell you how many people I’ve talked to who’d never tested their backup, only to find out years later when they actually needed it that they had a typo in word 9.

What “good” looks like

For a self-custodian with $5K-$500K in Bitcoin (the most common range):

For $500K+: add multisig (Sparrow + 3 hardware wallets at 3 locations, 2-of-3 quorum), and consider an inheritance lawyer to formalise the plan.

For under $1K: a steel plate is overkill. Paper in a fireproof box is fine. Don’t let the perfect be the enemy of the good.

What “bad” looks like

The real-world stories I hear most often:

Every single one of these is preventable for less than the cost of a hardware wallet and an afternoon of careful work.

Tools

Further reading