BIP39 mnemonic phrases replace considerations about how to store one private key, with considerations about how to store the seed to a series of private keys.

The idea is that the private keys are hard to remember, worse to write down, and prone to discovery when stored digitally, so the solution is that you can have a phrase of words that act as a seed to a hierarchical deterministic series of addresses.

It seems like this idea has been lost in translation as the phrase length of mnemonic phrases has increased from 12 words, to 24 words, with the "more secure than thou" using even longer words and phrases, and security minded companies alike promote writing down the mnemonic phrase, in multiple places.

or splitting the phrase, or putting an additional passphrase on top of the HD sequence, or using Shamir's secret key.....

all of which simply create more points of failure.

Ultimately: instead of one paper wallet compromising one private key, your paper phrase will compromise ALL of your private keys. OOPS. or you forget the secret key, or you lose a piece of the phrase, or you misspell it

At least we can be confident that the words themselves contain enough entropy to prevent guessing, RIGHT GUYS? RIGHT?

What are the pros, cons, limitations of BIP39, or at least my concerns. I have read the wiki and the github markdown on BIP39, and these do nothing to alleviate these concerns because these BIPs are a centralized process

3 Answers 3


to answer the first part;

generally speaking people will want to backup their whole wallet, not specific PKs. so using a HD wallet and making a backup of the seed (either the seed or a BIP39 mnemonic doesn't matter) matches what people using 'normal' wallets do, you backup your whole wallet in 1 place (most wallets have a backup/export file for the whole wallet).

BIP32 - HD Wallets - (and BIP39) isn't supposed to replace being able to split your backups into multiple private keys being scattered around, it replaces a single wallet being backed up in a 'traditional' way, 1 file (or print) for the whole wallet.

also a BIP39 paper backup has the same issues as normal private key backups that you mention, if you loose the passphrase or mispel it ... it's gone ...

But if you want to spread the risk by splitting your bitcoins across multiple backups then you should just have multiple wallets to split them.

BIP39 is also only the process of converting a seed to mnemonic and back, your (above discussed) concerns are actually with HD wallets in general, which is BIP32 ;-)

now your only real concern regarding BIP39 is about the words containing enough entropy! and they do, because the words are generated from a 128 or 256 bit entropy to begin with, the hex entropy is split into chunks of 11, which means you have a list of 0-2047 integers as a result. that list of integers is translated to the words (and back to the hex and to the binary entropy when you use it).

Let me demonstrate that by showing you how one of the official test vectors is converted:

hex of entropy: 7f7f7f7f7f7f7f7f7f7f7f7f7f7f7f7f

bits of entropy: 011111110111111101111111011111110111111101111111011111110111111101111111011111110111111101111111011111110111111101111111011111111000

chunked into 11 length parts: [0] => 01111111011 [1] => 11111011111 [2] => 11011111110 [3] => 11111110111 [4] => 11110111111 [5] => 10111111101 [6] => 11111101111 [7] => 11101111111 [8] => 01111111011 [9] => 11111011111 [10] => 11011111110 [11] => 11111111000

those parts converted into words using the default word list: legal winner thank year wave sausage worth useful legal winner thank yellow

the mnemonic together with the password TREZOR converted to a seed hex: 2e8905819b8723fe2c1d161860e5ee1830318dbf49a83bd451cfb8440c28bd6fa457fe1296106559a3c80937a1c1069be3a3a5bd381ee6260e8d9739fce1f607

now the cool part actually is that if you use a different password with the same mnemonic you get a different seed and thus a different wallet, you could have 2 wallets and if you get robbed only hand over the BTC in one of them ;-)

  • 1
    "BIP39 is also only the process of converting a seed to mnemonic and back" - BIP39 uses one-way hash to derive the BIP32 seed. There's no way back.
    – Chris Chen
    Dec 14, 2019 at 16:34

Bitcoin-explorer passes the BIP-39 test vectors. Look at the bitcoin-explorer examples below to answer questions above.

1) echo "0" | bx base16-encode | bx sha256


2) echo "effcce8f" | bx mnemonic-new

useful toy phrase

3) echo "e9c6da7e" | bx mnemonic-new

truth cycle panic

4) echo "effcce8fe9c6da7e" | bx mnemonic-new

useful toy physical squeeze horror disease

5) echo "effcce8fe9c6da7e1b50cccdfc082cdf8d1b135aed519bc27cfd5cacb16269d6" | bx mnemonic-new

useful toy physical squeeze horror disease hood book social theory arctic sample spider meadow hill pretty orange become dismiss rich slam raise point soon

6) echo "effcce8fe9c6da7e1b50cccdfc082cdf8d1b135aed519bc27cfd5cacb16269d6" | bx mnemonic-new --language en

useful toy physical squeeze horror disease hood book social theory arctic sample spider meadow hill pretty orange become dismiss rich slam raise point soon

7) echo "effcce8fe9c6da7e1b50cccdfc082cdf8d1b135aed519bc27cfd5cacb16269d6" | bx mnemonic-new --language es

trozo tez opinar sauna honra dar hombre azafrán rubí talón amapola puré salvar mármol héroe pánico norma ascenso dátil posible ritmo perla otro ruptura

8) echo "useful toy physical squeeze horror disease" | bx mnemonic-to-seed


9) echo "useful toy physical squeeze horror disease" | bx mnemonic-to-seed -p TREZOR


10) echo "useful toy physical squeeze horror disease hood book social theory arctic sample spider meadow hill pretty orange become dismiss rich slam raise point soon" | bx mnemonic-to-seed



I believe that the best way to regard BIP39 is as a way to create portability for your keys. You can then move them from one wallet to the next, and/or back the mnemonic up in a variety of ways. You're not tied to one wallet or system of backup. Previously, backing up or moving your keys to another wallet was an arduous affair, done one key at a time. Most people didn't bother, and when their hard drive failed, or they forgot their wallet password, all was basically lost.

Does this really address theft risks? No. In an ideal world, you would have a reliable way to regenerate your seed on the fly, and only use a mnemonic to move from one wallet to another.

Theft risks are handled by other systems: airgapping, adding a password to your mnemonic, imprinting mnemonics on metal and storing them in a bank vault or other reliable physically secure storage system, using a hardware wallet, etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.