# How is it that HD wallets can be restored from seed words without the chain code entropy being known?

BIP-32 defines the chain code as entropy additional to the private key:

In what follows, we will define a function that derives a number of child keys from a parent key. In order to prevent these from depending solely on the key itself, we extend both private and public keys first with an extra 256 bits of entropy. This extension, called the chain code, is identical for corresponding private and public keys, and consists of 32 bytes.

If the chain code is additional entropy, how is it that HD wallets can be restored from seed words without the chain code entropy being explicitly provided?

From the section From mnemonic to seed in BIP39:

To create a binary seed from the mnemonic, we use the PBKDF2 function with a mnemonic sentence (in UTF-8 NFKD) used as the password and the string "mnemonic" + passphrase (again in UTF-8 NFKD) used as the salt. The iteration count is set to 2048 and HMAC-SHA512 is used as the pseudo-random function. The length of the derived key is 512 bits (= 64 bytes)

and from Master key generation in BIP32

The total number of possible extended keypairs is almost 2512, but the produced keys are only 256 bits long, and offer about half of that in terms of security. Therefore, master keys are not generated directly, but instead from a potentially short seed value.

• Generate a seed byte sequence S of a chosen length (between 128 and 512 bits; 256 bits is advised) from a (P)RNG.
• Calculate I = HMAC-SHA512(Key = "Bitcoin seed", Data = S)
• Split I into two 32-byte sequences, IL and IR.
• Use parse256(IL) as master secret key, and IR as master chain code.

This means that from the mnemonic (word list) you generate a 512 bit number, half of the bits you'll use as the master private key and the other half you'll take as the chain code.