# BIP39 seed and secret key

My understanding is that the 12-word seed is used to recover wallets' private keys. However, if each private key is 256-bits long, and the dictionary for the seed only contains 2048 words, then that's not nearly enough to cover them all: 2048^12 = 2^132 << 2^256.

Where is my misunderstanding?

• Note: a 12-word seed phrase encodes 128 bits of entropy. 24 word seed = 256. See BIP-39 for more details. – Jonathan Cross Apr 23 '20 at 20:47

2048^12 = 2^132 << 2^256

It doesn't need to be able to describe every private key. You always start with the mnemonic, never calculating a mnemonic from a private key.

• But at some point (agreeably, a long time in the future; possibly after the heat death of the universe), the mnemonics will be exhausted but the private keys won't. Also, what stops clashes with private keys generated without the mnemonic? – Xophmeister Sep 8 '17 at 16:42
• Firstly 2^132 is a huge number. Roughly equal to the number of atoms in the universe. And that also answers your second question, where pure chance basically is the answer. – weston Sep 8 '17 at 16:45
• Actually, maybe not atoms in the universe, google failure there, but extremely huge. – weston Sep 8 '17 at 16:46
• I invite you to experiment with iancoleman.github.io/bip39 a great resource for seeing how it works. – weston Sep 8 '17 at 16:48
• Also take a look at this bitcoin.stackexchange.com/questions/8804/… which should answer your question on why there won't be clashes better than I can. – weston Sep 8 '17 at 16:50

The seed is actually a 512 bit number, but you can generate one from a 128-256 bit number. This 128-256 bit number can be represented by a BIP39 mnemonic of 12-24 words. Just as you can hash any integer (even just the number 1) and get a 256 bit number, so too can you generate a 512 bit number from a 128 bit number.

The 512 bit seed provides a starting point for your HD addresses, and you can generate all the addresses you will need from this one seed.