# BIP39 seed and secret key

My understanding is that the 12-word seed is used to recover wallets' private keys. However, if each private key is 256-bits long, and the dictionary for the seed only contains 2048 words, then that's not nearly enough to cover them all: 2048^12 = 2^132 << 2^256.

Where is my misunderstanding?

• Note: a 12-word seed phrase encodes 128 bits of entropy. 24 word seed = 256. See BIP-39 for more details. Apr 23, 2020 at 20:47

2048^12 = 2^132 << 2^256

It doesn't need to be able to describe every private key. You always start with the mnemonic, never calculating a mnemonic from a private key.

• But at some point (agreeably, a long time in the future; possibly after the heat death of the universe), the mnemonics will be exhausted but the private keys won't. Also, what stops clashes with private keys generated without the mnemonic? Sep 8, 2017 at 16:42
• Firstly 2^132 is a huge number. Roughly equal to the number of atoms in the universe. And that also answers your second question, where pure chance basically is the answer. Sep 8, 2017 at 16:45
• Actually, maybe not atoms in the universe, google failure there, but extremely huge. Sep 8, 2017 at 16:46
• I invite you to experiment with iancoleman.github.io/bip39 a great resource for seeing how it works. Sep 8, 2017 at 16:48
• Also take a look at this bitcoin.stackexchange.com/questions/8804/… which should answer your question on why there won't be clashes better than I can. Sep 8, 2017 at 16:50

The seed is actually a 512 bit number, but you can generate one from a 128-256 bit number. This 128-256 bit number can be represented by a BIP39 mnemonic of 12-24 words. Just as you can hash any integer (even just the number 1) and get a 256 bit number, so too can you generate a 512 bit number from a 128 bit number.

The 512 bit seed provides a starting point for your HD addresses, and you can generate all the addresses you will need from this one seed.