BIP-39 describes both constructing a mnemonic from entropy and deriving a binary seed from a mnemonic. A checksum is appended to the entropy before the resulting bits are mapped to word-list indices. The later seed derivation uses the mnemonic and an optional passphrase with defined normalization and key-derivation rules. Keeping these stages separate prevents a common misconception: the displayed words are not simply a list of independently selected secret passwords, and the optional passphrase is not one more checksum word.

The specification permits entropy lengths from 128 to 256 bits in steps of 32, producing twelve, fifteen, eighteen, twenty-one, or twenty-four words. At the 256-bit setting, eight checksum bits make 264 total bits, which divide into twenty-four eleven-bit indices. This arithmetic describes the format without generating a usable recovery phrase. Published test vectors are valuable for checking an implementation, but they are known to everyone and must never be treated as secret material for a funded wallet.

A compatible mnemonic does not identify which accounts and address types an application used. The derived seed still feeds a key hierarchy and discovery process. An additional passphrase changes the resulting seed, so a typo can lead to a different valid wallet rather than a helpful error message. A local wallet password may have another role entirely, such as encrypting files. Recovery documentation should distinguish the mnemonic, any derivation passphrase, account paths, and local credentials.

BIP-39 compatibility alone does not promise that two wallets will display the same accounts automatically.