I've been using a pretty old version of Multibit classic and recently decided to upgrade. I tried out Multibit HD and Electrum and noticed that both have me set up a wallet with a "word seed". It's just a string of random words that is apparently used in an algorithm. The question is, what does it do exactly? Someone told me that it generates private keys for you, and all you need is that word seed and you will be able to restore/generate all your private keys. How does this work exactly? What algorithm is being use on the seed to generate the keys?

These words are apparently very important, as Multibit warns on their site:

To restore your wallet and recover your bitcoin, you must have your wallet words.

With your wallet words, you can recover your bitcoin. You must keep your wallet words safe, because anyone who knows your wallet words can steal your bitcoin.

The seed words seem to be a replacement for the private keys, based on what Multibit says about them. I'm personally quite attached to the idea of having my private keys, so why should I be content with this word seed instead? Some apparently think it's safe enough: Is 12-word seed phrase safe enough?, but is it usable enough?

These questions: Does a wallet containing multiple addresses have a single private key? and Why can the same 12 words produce different seeds in an Electrum wallet file? hint on what is happening here, but is lacking details. It seems the phrase is "hierarchical deterministic" wallets, hence the "HD" in "Multibit HD".

This question exactly articulates my concerns: Is it important to have an unencrypted backup of the private key?


With HD wallets, a single key can be used to generate an entire tree of key pairs. This single key serves as the "root" of the tree. The word seed is simply a more human-readable way of expressing the key used as the root, as it can be algorithmically converted into the root private key. Those words, in that order, will always generate the exact same key.

That single key is not replacing all other private keys, but rather is being used to generate them. All your addresses still have different private keys...but they can all be restored by a single key.

Compare this to non-deterministic wallets. In a non-deterministic wallet, each key is randomly generated on its own accord, and they are not seeded from a common key. Therefore, any backups of the wallet must store each and every single private key used as an address...as well as a buffer of 100 or so future keys that may have already been given out as addresses but not recieved payments yet.

A hierarchical deterministic wallet doesn't need to back up so much data. The private keys to every address it has ever given out can be recalculated given the root key. That root key, in turn, can be recalculated by feeding in the word seed.

Relevant BIPS:

https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki

  • Great work so far. Thank you. Of specific concern, I want to know exactly how the word seed is turned into a private key tree. Let's say we start with the seed this is the word seed. How is that used and with what algorithms to make the private key tree. Then, can I confidently say that I can generate that tree without the wallet that first generated it? – fredsbend Jun 17 '16 at 16:49
  • 1
    I believe that is defined in BIP 39: github.com/bitcoin/bips/blob/master/… – Jestin Jun 17 '16 at 17:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.