Im referencing https://iancoleman.io/bip39/

I understand how the words are generated ("bip39 mnemonic" at the link). But Im not quite clear on how the words give rise to "bip39 seed" two sections later.

Ive followed a variety of youtubers who demonstrate the calculation in python, but my computations are not coming out the same. Im not sure why. Clearly Im missing something about how certain strings/values are being constructed prior to the sha512.

3 Answers 3


These pictures are from Mastering bitcoin and were so insightful for me.

How the mnemonic words are generated: enter image description here How they are used to generates master seed of your wallet: enter image description here


From BIP39:

To create a binary seed from the mnemonic, we use the PBKDF2 function with a mnemonic sentence (in UTF-8 NFKD) used as the password and the string "mnemonic" + passphrase (again in UTF-8 NFKD) used as the salt. The iteration count is set to 2048 and HMAC-SHA512 is used as the pseudo-random function. The length of the derived key is 512 bits (= 64 bytes).

If a passphrase is not present, an empty string "" is used instead.

When I try to generate a random mnemonic on https://iancoleman.io/bip39/, the derived BIP39 seed is the same as when I manually calculate it with https://stuff.birkenstab.de/pbkdf2/ using the steps above.


To complement Vojtěch's answer James Chiang explained how the seed is derived from the mnemonic during his TeachBitcoin class in 2019:

When I generate the seed for my HD wallet I do not go back to the secret entropy. I don’t decode my mnemonic word phrase to obtain the entropy. Instead I join all my words into a sentence, I concatenate a string mnemonic, there is an optional passphrase that you can introduce. Then through the password-based key derivation function 2. What is that? That is basically many (2048) rounds of HMAC-SHA512. That takes as an argument the sentence and as a salt, the mnemonic and the passphrase concatenated. The many rounds are equivalent to a length extension. It makes it more expensive to brute force. Adding more rounds is the equivalent to adding key length if you will. Then we finally end up with a 512 bit seed. This is the seed that we use to derive the rest of our wallet.

james chiang image

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.