Two specified transformations

BIP-39 describes both constructing a mnemonic from entropy and deriving a binary seed from a mnemonic. A checksum is appended to the entropy before the resulting bits are mapped to word-list indices. The later seed derivation uses the mnemonic and an optional passphrase with defined normalization and key-derivation rules. Keeping these stages separate prevents a common misconception: the displayed words are not simply a list of independently selected secret passwords, and the optional passphrase is not one more checksum word.

An exact format example without a live secret

The specification permits entropy lengths from 128 to 256 bits in steps of 32, producing twelve, fifteen, eighteen, twenty-one, or twenty-four words. At the 256-bit setting, eight checksum bits make 264 total bits, which divide into twenty-four eleven-bit indices. This arithmetic describes the format without generating a usable recovery phrase. Published test vectors are valuable for checking an implementation, but they are known to everyone and must never be treated as secret material for a funded wallet.

Compatibility and passphrase consequences

A compatible mnemonic does not identify which accounts and address types an application used. The derived seed still feeds a key hierarchy and discovery process. An additional passphrase changes the resulting seed, so a typo can lead to a different valid wallet rather than a helpful error message. A local wallet password may have another role entirely, such as encrypting files. Recovery documentation should distinguish the mnemonic, any derivation passphrase, account paths, and local credentials.

BIP-39 compatibility alone does not promise that two wallets will display the same accounts automatically.