I'm wondering if there's anyone out there who knows how to retrieve your private key using your 12-word passphrase? Your advice is much appreciated


To derive the private key, you need to have this information before - whether the mnemonic is used purely as BIP39 or is further used to generate HD wallet using BIP32/BIP49/BIP84. The retrieval process differs for each of the above possibilities.

If the mnemonic is used purely as BIP39, that is a Bitcoin address is generated directly from the randomly generated used encoded into mnemonic, you need to follow below steps: a) Do n * 11 (where n is the number of mnemonic words). If it is 12, you will get 12 * 11 = 132. b) Calculate the number of seed bits using, 132 = l + l/32, which will give you 128 bit. c) Convert each of the mnemonic words into their equivalent 11 bit sequences (using a map into the dictionary defined per BIP39). d) Strip the last n - l bits (step a and b)

The remaining bits should be hashed with SHA 256 to get the private key can be encoded into hexadecimal or used in binary form. If you need to generate public key, you'll need to solve for secp256k1 ECC equation.

If the mnemonic was used further to generate the HD wallet using BIP32, you need to know the derivation path to the child element in the tree structure (BIP44 defines the industry standard for that). Once you have a derivation path, follow the below process: a) Pass the mnemonic into the PBKDF2 (using HMAC512) function with mnemonic as the key, and passphrase "mnemonic" b) Pass this root seed through the HMAC defined by BIP32 to generate each child element until you reach the target.

  • "The remaining bits are the private key can be encoded into hexadecimal or used in binary form." It's not. The mnemonic represents entropy, not a private key. BIP 39 clearly specifies that the mnemonic words must be passed to a PBKDF2 key-stretching function with 2048 rounds of hashing to generate a 512 bits seed. This seed is then used to generate master private key and others as specified in other BIPs. Even if a user uses the entropy from mnemonic as private key it will be a 128 bit key, Bitcoin recommends 256 bits. – Ugam Kamat Sep 21 '19 at 3:40
  • You can read more about mnemonics and key generation here – Ugam Kamat Sep 21 '19 at 3:41
  • @Ugam Kamat The process you described only works when someone is using BIP32 to generate HD wallet (that is they need the root seed to actually generate the private for BIP32, using the left half as private key and the right half as chain code). Using the 512 master seed using the process you described directly to generate private key is fatal, because the private key can never be larger than N where N is a little smaller than 256 bits. – rd88 Sep 23 '19 at 8:22
  • 512 bit seed is not directly used as the master private key. "The seed is passed to HMAC-SHA512 with key "Bitcoin seed". The resulting hash is used to create the master private key (m) and master chain code (c)." – Ugam Kamat Sep 23 '19 at 9:45
  • The master private key and master chain code only make sense if the poster is actually working with a HD wallet (BIP32). If that is the case, the second paragraph in my post precisely handles that scenario. If only a single address is ever used, you do not need root seed from which master key (private key and chain code) are generated. – rd88 Sep 27 '19 at 12:31

There is no one private key associated with the 12 word mnemonic that you posses. Consider the seed phrase to be like a keychain, that holds multiple keys. You would need to import the 12 word mnemonic you possess into a wallet software in order to generate the private keys. The wallet software will then scan the Bitcoin blockchain in order to see the funds that those keys control. A use of a hardware wallet is most recommended in order to ensure the privacy of these keys.

Care should however, to use the same derivation path for the keys that was used when you generated the addresses to receive the funds. This can be looked up based on what wallet software you used while generating the 12 word mnemonic. There are multiple derivation paths that wallets use. Some use BIP 44 while others use BIP 49 or even BIP 84.