The card on the table has been with us since Chapter 1. Twelve words, written by hand, guarding everything. You have counted it, priced it, and watched its imitators die in the case files. Now, at last, the machinery: what the twelve words are, where they come from, and why their design is one of the quiet masterpieces of Bitcoin's usability engineering.
The standard is called BIP 39, and its trick is this: a seed phrase is not a password made of words. It is a 128-bit (or 256-bit) random number, wearing words as a costume — a number you can hold in your head's hands, write on paper, read aloud, and type without ever touching a hex digit. This chapter opens the costume, and then prices the one shortcut people take with it that quietly burns most of its value.
Back to Chapter 1's counts, now with names attached. The list of 2,048 words is the BIP 39 English wordlist — public, fixed, identical in every wallet on Earth. Twelve words from it, order mattering: \(2{,}048^{12} = 2^{132}\) phrases, as Chapter 1 counted. But the machinery below makes a sharper statement: the phrase carries exactly 128 bits of fresh randomness plus 4 bits of something else — and \(128 + 4 = 132\) is no coincidence. Watch where the 4 comes from.
The generation recipe, step by step:
Run it on the standard's own test vector — 128 zero bits, used here purely because its every step is reproducible (and because no one would be mad enough to use all-zeros as real entropy):
Indices 0 through 3 on the wordlist are abandon, ability, able, about — so the phrase is eleven abandons and an about. Check any BIP 39 reference: the all-zeros test vector maps to exactly that phrase.
Read the pipeline once more, slowly, because it is the whole chapter: the randomness comes first, the words are just a printout. The words hold no magic; the 128 bits under them are the key, and every wallet on Earth can reconstruct them from the phrase.
The 4 appended bits earn their keep the day you mis-copy a word. Because the last four bits are a function of all the rest, a phrase with a typo almost never passes the checksum: with 4 checksum bits, a random error validates about 1 time in \(2^4 = 16\) — your wallet can say "this phrase is wrong" instead of silently opening an empty wallet at the wrong address. (24-word phrases carry 8 checksum bits: 1 in 256 bad phrases slip through.)
The wordlist helps too, by design: every English BIP 39 word is uniquely determined by its first four letters, so smudged handwriting and half-legible words remain recoverable — aban can only be abandon. Small mercies, engineered on purpose.
Now the shortcut that burns the value. Some people, told to back up their twelve words, get clever: "I'll write them in alphabetical order — easier to remember, and I'll know the rule." Count what the rule costs, with Chapter 1's tools.
An attacker who suspects alphabetizing no longer faces the ordered arrangements. He faces only the unordered sets — and Chapter 1 counted both:
\[ \text{ordered: } \; 2{,}048 \times 2{,}047 \times \cdots \times 2{,}037 \qquad\qquad \text{sorted: } \; \binom{2{,}048}{12} \]The sorted space is smaller by a factor of exactly \(12! = 479{,}001{,}600\) against the distinct-word count in the display — because every set of twelve distinct words had \(12!\) orderings, and alphabetizing throws the ordering away. (Against §11.1's full repeat-allowing space the factor is about \(4.95 \times 10^8\) — a ~3% corner of phrases have repeats, and it doesn't change the price.) In bits: \(\log_2(12!) \approx 28.8\) bits of entropy, burned by a filing habit. Your "132-bit" phrase now offers about \(132 - 28.8 \approx 103\) bits (against §11.1's 128 fresh bits, the burn is about 24.9 — same story, same moral) — and a publicly discussed one, too: this exact shortcut and its price were debated on Bitcoin Stack Exchange in 2022, where the half-billion-fold speedup for 12 words was worked out in the open. (The same question for 24 words divides by \(24! \approx 6.2 \times 10^{23}\), about 79 bits — which is why that discussion judged 24 words safe from the trick for now and 12 words getting close to practical reach.)
Alphabetizing, birthday substitutions, every-other-word, your own spelling system — each "personal rule" is public knowledge the moment it's written anywhere, and each one collapses the search space by a Chapter-1 count. The phrase's defense is that there is no rule: words from fair dice, in the order they fell.
BIP 39 allows an optional extra secret — the passphrase — that combines with the phrase to produce a different wallet entirely. What it buys: a second factor that lives in your head, so a photographed card alone is not enough; and plausible deniability — different passphrases open different wallets, so a decoy can hold a small balance while the real one stays invisible. What it costs: the passphrase is a human-borne secret, and Chapter 5's law applies without mercy — a passphrase you invented is a low-entropy secret strapped to a high-entropy one. If you use one, make it generated (dice words, not invention), and understand exactly what is at stake: lose the passphrase and the phrase alone opens an empty wallet. No recovery, no appeal.
Here is an oddity. The twelve words are the most widely used backup format in Bitcoin, and the reference software does not speak them: §7.4 showed Bitcoin Core drawing its own 256-bit seed and backing up descriptors, and as of version 31.0 its source contains no BIP 39 code at all. That is not an oversight. Core's developers have argued about it for years in the project's issue tracker (issues #16393, #17748, #19151) and its chat channel, and the objections come down to two — the standard's own text now concedes the first.
The words do not say what they unlock. The phrase carries 128 fair bits and a 4-bit seal, and nothing else. Which address types? Which derivation paths? Nothing in the twelve words says. BIP 39 itself now lists "No versioning scheme" among its known problems — "there was no way to distinguish the address format that should be used" — and adds that this "is now largely mitigated by use of descriptor wallets." Pieter Wuille, who designed the BIP 32 key tree, put the same gap another way: "there isn't really a watch-only version of them." A phrase alone is a key without a label, and Core's backup is the label, written out.
The words go to the seed, but never back. BIP 39 does not use the 128 bits directly. It feeds the sentence itself — the words as typed text — into a deliberately slow hash: PBKDF2 with HMAC-SHA512, 2,048 rounds, with "mnemonic" plus any passphrase mixed in, and a 512-bit seed comes out. Two consequences follow. First, the seed depends on the spelling, not just the bits: the standard says plainly that the "generated seed depends on the wordlist that was used," so the same 128 bits printed from a different language's list open a different wallet. Second, the hash runs one way. A wallet holding a seed can never show you twelve words for it, so every existing Core wallet — each born from a 256-bit draw, not from a sentence — has no phrase at all. Greg Maxwell, then a Core developer, said in the project's chat in 2017 what a word scheme should do instead: "words are fine, but should be a scheme that can encode versioning and bidirectionally convert."
The door is not shut. In 2025 Wuille wrote that he did not "see a problem with, or difficulty implementing, support for bip39 in descriptor parsing" — reading a phrase in as one more descriptor key — while another long-time contributor, Sjors Provoost, summed up the history: "Every attempt to do this has been met with concept NACKs or lack of review."
Notice what none of it touches. No one in the dispute says the 128 bits are weak: a fairly drawn phrase holds exactly the entropy this chapter counted. The quarrel is over what is wrapped around the bits — a missing label, and a one-way door.
The phrase is now fully understood: 128 fair bits, a 4-bit integrity seal, eleven-bits-per-word onto a public list. What remains is everything around the phrase — the practice. Where it is written, what never touches it, how it is tested before it is trusted, and how it outlives you. Chapter 12 closes the book with the operational checklist.
abandon×11 + about by hand.Exercise 11.1 ★ The 132, accounted. A 12-word phrase holds 128 entropy bits and 4 checksum bits. Verify the accounting twice: \(128 + 4 = 132\) bits, and \(132 / 11 = 12\) words. How many bits and words for the 24-word phrase? You should get \(256 + 8 = 264\) and \(264 / 11 = 24\).
Exercise 11.2 ★ The test vector, by hand. Run §11.2's code box exactly as printed. Confirm the checksum bits are 0011, the indices are eleven 0s and a 3, and the phrase is abandon eleven times followed by about.
Exercise 11.3 ★★ The alphabetizing price, exact. In Python: math.factorial(12) and math.log2(math.factorial(12)). Confirm \(479{,}001{,}600\) and about \(28.84\) bits. Then compute the same for 24 words and confirm the "about 79 bits" figure.
Exercise 11.4 ★★ The checksum's mercy. A 12-word phrase has 4 checksum bits. If you mistype one word (so the phrase is effectively random with respect to the checksum), about how often does the bad phrase still validate? You should get about 1 time in \(16\). What does the wallet do with the other 15?
Exercise 11.5 ★★★ A friend says: "I'll pick the twelve words myself, from the official list, in an order only I understand — the list is public, so it's all above board." Dismantle this in two paragraphs using every relevant chapter: what Chapter 1 says the space should be, what Chapter 5 says about human favorites, what Chapter 9's bots are already holding, and what §11.4 says personal rules cost.
Exercise 11.6 ★★★ The one-way door. §11.6's seed step is one line of Python. Run it on the all-zeros test phrase with BIP 39's published test passphrase TREZOR: hashlib.pbkdf2_hmac('sha512', phrase.encode(), b'mnemonicTREZOR', 2048).hex(), where phrase is abandon eleven times and about, separated by single spaces. You should get a 128-hex-digit seed beginning c55257c360c07c72 and ending 8e7463b04 — the standard's own test vector. Then explain, in two sentences, why no software can run this step backward to show the words for a seed it already holds.
Sketches, not model answers — enough to check your reasoning against. The computational exercises embed their expected outputs in the exercise text.
Exercise 11.4. A mistyped phrase is essentially a random 132-bit bundle against the 4-bit seal, so it passes about 1 time in \(2^4 = 16\). The other 15 times the checksum fails and the wallet says so — which is the mercy: without the seal, every typo would silently open some other, empty wallet, and you would learn about the error only when the coins were nowhere to be found. The checksum converts silent catastrophe into a loud refusal.
Exercise 11.5. The list being public is not the defense — the fair draw from the list is. Chapter 1 counted the space at \(2^{132}\) for uniformly chosen words; Chapter 5 measured what human favorites do to that figure (the most likely values price the secret); Chapter 9 showed the bots already hold every human pattern's outputs. And the "order only I understand" is §11.4's trap exactly: any rule he can state collapses the space by a Chapter-1 count, and any rule he can't state is a rule he can't reliably reproduce. The phrase's strength is that there is no rule — words as the dice fell. His plan replaces that with a composition, and compositions are what the bots eat.
Exercise 11.6. PBKDF2 is built from a hash, and a hash gives no route from output back to input; the only way to find a sentence for a given seed is to guess sentences and hash each one, which is the full \(2^{132}\)-sized search of §11.1 — and a seed that never came from a sentence has no sentence to find. That is Maxwell's "bidirectionally convert" in reverse: BIP 39 chose a one-way door, so the words must exist first and the seed after, never the other way round.