What is BIP39?

BIP39 is a design implementation that lays out how cryptocurrency wallets create the set of words (or "mnemonic codes") that make up a mnemonic sentence, and how the wallet turns them into a binary "seed" that is used to create encryption keys, which are then are used to execute cryptocurrency transactions.

In setting guidelines for how wallets do this, BIP39 simplifies cryptocurrency for us. (Can you imagine how complicated it would be if every wallet had its own way of doing things?)

It isn't necessary to know all the details of BIP39 in order to use cryptocurrency - but you would certainly benefit from knowing a little about it.

Why is BIP39 important?

BIP39 is a great icebreaker at cocktail parties! Well ... maybe not, but if you want to purchase some cryptocurrency, and have decided to set up your own cryptocurrency wallet, it becomes relevant whether your choice of wallet supports BIP39. If you use a wallet that implements BIP39, and in the future you decide to migrate your keys to a different wallet, you can re-create your crypto holdings in your new wallet just by feeding it your original BIP39 mnemonic sentence. This works because BIP39 is supported by so many wallet manufacturers. As a result, not only does BIP39 simplify wallet and key management, it also opens the door to much simpler wallet migration. Although it is a "Bitcoin Improvement Proposal," in practice, BIP39 is a de facto standard that has greatly evolved the cryptocurrency industry.

Why is it called "BIP39?"

BIP39 is just one of a set of multiple technical design documents introduced by the cryptocurrency community since Bitcoin's inception. Its name comes from the fact that it was the 39th Bitcoin Improvement Proposal (BIP). It actually has a longer formal title: "Mnemonic code for generating deterministic keys" -- a bit of a mouthful -- so you can think of "BIP39" as its nickname. BIP39 has turned out to be one of the most widely-used BIPs, and it's now implemented by many wallet manufacturers, and used for many more cryptocurrencies than just Bitcoin.

What Is a BIP39 mnemonic sentence / seed phrase?

A BIP39 mnemonic sentence is a set of words (most commonly 12 or 24) that we can interact with more successfully than other characters that aren't words (bits and numbers and the like). BIP39's purpose in introducing the use of mnemonic words is to reduce the errors that often occur when we try to communicate long strings of unfamiliar characters. The wallet handles the heavy lifting of converting the mnemonic words through a process of complex hashing, salting, and checksum operations into a binary "seed," which is then used to generate the all-important private and public encryption keys.

It's very important that the mnemonic sentences are generated from randomly selected numbers! These numbers can be generated in a variety of different ways, which are described in other articles here, like "What is an RNG" and Seed Phrase Generation.

What is a passphrase for a BIP39 Seed phrase?

The BIP39 standard also defines an option for users to add a long "password" of sorts to a seed phrase. Understand that these are two separate things:

• A BIP39 Seed Phrase is a set of 12 or 24 words from the BIP39-defined dictionary. It is the core secret for a digital wallet (and often the only secret).

• A Passphrase is an option, that could be used or not, that allows you to add an additional random secret to a wallet's seed phrase.

Passphrases are a bit of a tricky concept. By default, some cryptocurrency wallets disable the use of the optional passphrase. Although it can add some security, it also adds complexity. If you set a passphrase, your backup strategy has just gotten more complicated: you now have two important pieces of information (your mnemonic sentence and your passphrase) which are critical to store securely. This additional complexity increases the risk of misplacing the passphrase, and thus losing your cryptocurrency.

How much security does a passphrase add?

Because the BIP39 seed phrase itself offers an incredibly high level of protection against being guessed, the addition of a passphrase actually doesn't significantly reduce the risk of a brute-force guessing attack. Instead, the primary purpose of a passphrase is to add an extra layer of security to protect against the possibility that your seed phrase may be accidentally revealed to someone.

However, being shorter and less random than the seed phrase itself, the passphrase likely could be guessed eventually with a brute-force attack. If someone did gain access to your seed phrase, the level of protection that a passphrase offer is short-lived. You might have a chance of saving your cryptocurrency from theft only if you noticed that someone had gained access to your seed phrase before they were able to brute-force guess your passphrase. In practice, this could be days or weeks, depending on how hard to guess it was. But is that limited increase in security worth the increased risk of loss of the passphrase? Based on your individual situation, you can decide that for yourself, but you can see why many experts recommend against setting a passphrase.

How likely is your BIP39 seed phrase to be guessed?

A mnemonic sentence constructed from random inputs is much more unique than most people can possibly imagine. For example, in a 24-word BIP39 sentence, there are 2048 to the 24th power possible combinations of words (or stated another way, around 3 x 10 to the 79th power). To try to comprehend how enormous this number is, it's often compared to an estimate of the total number of atoms in the known universe. In practice, it is effectively unguessable with today's technology.

Why are BIP39 words chosen from a limited dictionary?

BIP39 wordlists may seem arbitrary, but they are not - they are carefully chosen to reduce the chance of mis-specification. Words in a BIP39 wordlist are selected with the parameters in such a way that they don't have synonyms, don't have alternative spellings, don't have only 1 character variation with other words in the list, and aren't profane. These rules apply for every language. In addition, the first four characters of each word are unique to each wordlist, which is convenient when typing them into hardware wallets with limited input mechanisms, stamping them onto steel cards, or backing them up in any other form.

BIP39 wordlists can be seen here: https://github.com/bitcoin/bips/blob/master/bip-0039/bip-0039-wordlists.md).

Also, you don't necessarily have to remember this, but BIP39 wordlists have 2048 words in them. The reason for this is because it aligns with how BIP39 uses 32-bit blocks of entropy (random inputs) plus a checksum bit sequenced into a long binary string that is divisible into 11-bit numbers. Each of those numbers can hold up to 2048 bits. In short, 2048 words are all that are needed to achieve extremely high levels of entropy.

Do you need to understand BIP39 mathematics?

As a user of a cryptocurrency wallet, you don't necessarily need to understand the precise details of BIP39 calculations. However, you might want to understand that they include the generation of a checksum of random numbers, and this is used as an integrity check. A checksum is a small piece of data that allows you to check if another piece of data is the same as expected. This checksum is included in the last mnemonic code word of a sequence, and it helps wallets to verify the validity of every mnemonic sentence. So if a user types in a set of words and it fails validation because the checksum isn't as expected, there is likely a typo in what the user entered.

BIP39's other mathematical functions transform its inputs (the random numbers plus the optional passphrase) through one-way functions that guarantee that they can not be reverse-engineered from the public key.

If you'd like to do a deep dive, and understand the exact mechanisms of how BIP39 wallets convert mnemonic codes into a binary seed, there is a description in the design document at https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki.

Vault12 also has a more detailed description in "How to Generate a Seed Phrase."

What are BIP32 and BIP44?

As described in this article, the BIP39 standard describes how a seed phrase is constructed.

Related to BIP39, the most prominent wallet standards include BIP32 and BIP44:

BIP32 ("Hierarchical deterministic wallets") lays out a framework for Hierarchical Deterministic wallets (HD Wallets) for Bitcoin so that the wallet software can control multiple separate Bitcoin accounts using a single seed phrase.

Furthermore, BIP44 ("Multi-account hierarchy for deterministic wallets") defines the same organizational hierarchy for managing multiple accounts in deterministic wallets for all other than Bitcoin cryptocurrencies, like Ethereum, Dogecoin, etc.

BIP32 and BIP44 work together to add flexibility, privacy, and interoperability to HD Wallets. HD Wallets extend the capabilities of deterministic wallets, allowing for the management of a huge number of keys, all of which are derived from the original BIP39 mnemonic sentence (seed phrase).

For the purposes of the guides on our website, we focus on how to manage BIP39 seed phrases, since they are supported by every modern crypto wallet, and it is the core thing to understand and be able to properly backup almost any crypto assets. You may also come across wallets like Coinomi which also use BIP44 and default to 24-word seed phrases.

Feel free to learn more about all of the BIP cryptocurrency standards that may be relevant to you!