Seed phrases, master keys and address keys

BIP 39 defines how a random number becomes a sequence of words. The specification provides a list of 2,048 words, chosen so that each one is distinguishable from the others by its first four letters. The random number is divided into groups of eleven bits, and each group selects one word from the list, which is why the word count is always a multiple of three: twelve words encode 128 bits of entropy, and twenty-four words encode 256.

The specification also defines a checksum. A portion of the hash of the random number is appended before the words are chosen, so that a phrase with a mistyped or transposed word will usually fail validation rather than silently restore a different wallet. This is a genuine safety feature, and it is the reason a wallet can tell a user that a phrase is invalid rather than simply accepting it and showing an empty balance.

BIP 39 also defines an optional passphrase, sometimes called the twenty-fifth word. It is not part of the mnemonic and is not stored with it. It is mixed into the derivation, so the same twelve words with different passphrases produce entirely different wallets. This is a powerful feature and a dangerous one: a passphrase that is forgotten cannot be recovered, and a phrase restored without its passphrase will open a valid but empty wallet, which is a confusing failure mode.

BIP 32 defines the hierarchical deterministic wallet: a scheme in which a single master key generates a tree of child keys, and each child can generate its own children in turn. The derivation is one-way. A parent can produce a child, but a child cannot be used to recover its parent, which is what allows a wallet to hand out addresses without exposing the root.

The tree is navigated by a derivation path, written as a sequence of numbers separated by slashes. A path such as m/84'/0'/0'/0/0 names a specific leaf: the master key, then a purpose level, then a coin type, then an account, then a change indicator, then an address index. The apostrophes mark hardened derivation, which prevents a child key from being used to derive its siblings and is used at the upper levels for that reason.

The path matters because different wallets have historically used different conventions. A wallet that expects one path and is given a seed from a wallet that used another will show an empty balance even though the seed is correct, because it is looking at a different part of the tree. This is the most common cause of a "lost" wallet that is not actually lost, and it is why restoring a seed into unfamiliar software should be done with care and with the original wallet's derivation path known.

The seed phrase is the holding. Anyone who reads it can reconstruct every key in the wallet and move every coin, and they can do so without the owner's knowledge until the coins are gone. There is no password to change and no way to revoke a leaked phrase short of moving the funds to a new wallet with a new seed.

The practical rules follow from that. A phrase should be written on a durable medium and stored offline, in a place the owner controls. It should not be photographed, typed into a website, stored in a cloud note, or entered into any device the owner does not trust. It should not be split across locations in a way that loses a piece, and it should not be shared with anyone who offers to help recover a wallet. Legitimate software never asks for a seed phrase to restore a balance; that request is the defining feature of a phishing attempt.

The hardware and software wallets page covers where the key material lives in each storage model, and the multisig page explains how splitting control across several keys changes the single-point-of-failure problem.