I created a random entropy using this code

func randomNumGenerator() []byte {

    n := 16
    randomByte := make([]byte, n)
    _, err := rand.Read(randomByte)
    if err != nil {

    return randomByte

And created a checksum

func checkSum(entropy *string) {

    data := *entropy
    checkSumLength := len(*entropy) / 32

    //Sha256 of entropy
    hash := sha256.Sum256([]byte(data))
    // hexFormat := hex.EncodeToString(hash[:])

    bitHash := byteToBit(hash[:])
    *entropy = *entropy + bitHash[0:checkSumLength]


And added that to the end of the entropy and divided that entropy into 11 bits equal parts and matched it with the 2048 word list and I got words

"sustain resemble shift future stone merge antique denial devote century clay chalk"

But when I use this words in trust wallet it's showing invalid seed phrase

Can anyone explain me why? I followed all BIP39 procedures correctly in my code

  • Perhaps it's an issue with the wallet software you are using, check with them. The words you provided "work" fine and I get the HD Seed: 495fbf2c715222b46553fb8c466c33c59a8775541c1fedfe76ae71013f6431c54e8c8465de2f392b2d449f56efb3784a8195335bdd1017621d84e84c6eb0fa61
    – m1xolyd1an
    Commented Sep 19, 2022 at 4:11

1 Answer 1


I can refer you to this implementation, method mnemonic_from_data() (from wallet-core/trezor): https://github.com/trustwallet/wallet-core/blob/master/trezor-crypto/crypto/bip39.c#L70

I haven't fully analyzed your code snippet, but most likely the checksum byte is incorrect. It is the first byte of the Sha256 hash, appended to the end.

Note that depending on the mnemonic length, some bits at the end of the mnemonic are unused, as follows:

12-words: 12*11=132 bits used, 17*8=136 bits stored, last 4 bits unused
15-words: 15*11=165     /      21*8=168,                  3 unused
18-words: 18*11=198     /      25*8=200,                  2 unused
21-words: 21*11=231     /      29*8=232,                  1 usused
24-words: 24*11=264     /      33*8=264,                  all used

Since the unused bits don't matter, simplest is to just copy the first byte of the hash, without zeroing the unused bits (note that at checking one has to mask the bits).

The correct checksum for the example you provided is:

'sustain resemble shift future stone merge antique denial devote century clay celery'
entropy: 'daf6eb172f4d6516c279d33cc4aca89280'

original (invalid):

'sustain resemble shift future stone merge antique denial devote century clay chalk' 
entropy: 'daf6eb172f4d6516c279d33cc4aca892f0'

(Note: SHA256(daf6eb172f4d6516c279d33cc4aca892) = 8e51c3...71, its first byte is '8e', but only the 4 first (high) bits are needed, hence the '80' in the last byte. '8e' would work as well.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.