BIP39 seed phrases: how 12 or 24 words become a key

Every hardware wallet — Ledger, Trezor, MetaMask — hands you a list of words. Those words are not the key; they are a human-readable encoding of the entropy behind it.

How BIP39 works, step by step

1. Entropy. The wallet generates 128 bits of randomness (for 12 words) or 256 bits (for 24 words).
2. Checksum + words. A few bits of SHA-256 checksum are appended, and the result is sliced into 11-bit chunks. Each chunk indexes into a fixed list of 2,048 words. That is why a valid phrase must come from that exact list, and why a wrong word is usually detected.
3. Seed. The words are stretched through 2,048 rounds of PBKDF2-HMAC-SHA512 (with an optional passphrase) into a 512-bit seed. This is BIP39.
4. Derivation. BIP32 turns the seed into a hierarchical tree of keys, and BIP44 selects the standard Ethereum path m/44'/60'/0'/0/0.

Same odds as "Random"

A 12-word phrase encodes exactly 128 bits of entropy; a 24-word phrase encodes 256. Guessing a valid, funded phrase is therefore mathematically identical to guessing a random key — 1 in 2¹²⁸ or 2²⁵⁶. The words make the secret memorable, not weaker.

Where BIP39 actually breaks

The danger is never the standard — it is the entropy fed into step 1. If a wallet's random number generator is broken, a beautiful 24-word phrase can carry far less than 256 bits of real randomness. That is exactly what happened with Randstorm and Milk Sad, where seemingly-strong mnemonics were brute-forced because the underlying entropy had collapsed to 32 bits.

Other real risks: writing a phrase into a networked device, using a weak custom passphrase, or trusting a wallet with an unaudited RNG.

← Back to all attack vectors