A seed phrase is a list of 12 or 24 ordinary words that backs up an entire crypto wallet. Written down and stored safely, it restores every crypto address and every private key that wallet ever generated. Lose it without another copy, and the funds are gone permanently.
The words are not arbitrary. From a fixed list of exactly 2,048 words defined by BIP-39, they were standardised in September 2013 by Marek Palatinus, Pavol Rusnak, Aaron Voisine, and Sean Bowe.
What the words actually encode
Not a password. Random numbers, in a form a human can copy without errors.
Here is the process a wallet runs at setup.
- Generate entropy. The device draws random bits from a secure random number generator. 128 bits for a 12-word phrase, 256 bits for 24 words.
- Add a checksum. Hashing that entropy with SHA-256, the wallet appends the first few bits. Four bits for 128, eight bits for 256.
- Split into chunks. Into groups of 11 bits the combined bitstring divides. 132 bits gives 12 groups. 264 bits gives 24.
- Map to words. Each 11-bit value indexes one word in the 2,048-word list. Because 2 to the power of 11 equals 2,048, the mapping is exact.
- Derive the seed. The words, plus an optional passphrase, run through PBKDF2-HMAC-SHA512 to produce a 512-bit master seed.
From that master seed, BIP-32 builds a tree of keys. Where wallets look for them is defined by BIP-44, using paths like m/44'/0'/0'/0/0. One phrase, unlimited addresses across multiple chains.
Why the checksum matters
Mistakes get caught before they cost you anything.
Type a wrong word and the checksum almost certainly fails, so the wallet rejects the phrase immediately. Error-detecting rather than error-correcting is the distinction. Something is wrong, it says. Which word, it cannot.
Word order is weaker ground. Swapping two words in a 12-word phrase usually fails the check. Roughly one time in 16, though, a reordered phrase passes and derives a completely different, empty wallet. Order matters as much as spelling.
One more design feature is worth knowing. No two words share their first four letters, so those four characters identify any word unambiguously.
12 words vs 24 words
| 12 words | 24 words | |
|---|---|---|
| Entropy | 128 bits | 256 bits |
| Checksum | 4 bits | 8 bits |
| Possible combinations | Roughly 5.4 × 10^39 | Roughly 3 × 10^79 |
| Common in | Software wallets | Hardware wallets |
Both are secure beyond any practical attack. At an unrealistically fast 10^18 guesses per second, brute-forcing 128 bits would average over five trillion years.
So the choice between them is not really about security. What it comes down to is how much you trust your own backup process, since 24 words is twice as much to transcribe correctly.
How to store one
- Offline, on paper or metal. Metal plates survive fire and water. Paper does not.
- Never digital. No photos, no cloud storage, no password manager, no email to yourself, no text file.
- Never typed into a website. No legitimate service ever needs it. Any request for it is theft.
- Multiple copies, separate locations. One copy is a single point of failure. Three copies in one house is still one location.
- Consider a passphrase. The optional 25th word creates an entirely separate wallet from the same 12 or 24 words. Forget it and that wallet is unreachable.
- Never verbally, never over a phone call. Support staff do not ask. Scammers do.
What a seed phrase does not protect against
- Physical discovery. Finding the words means controlling the funds. No password stands in the way.
- Your own mistakes. A phrase restores your wallet. Reversing a transaction sent to the wrong address is not something it can do.
- Approval exploits. Restoring a wallet leaves malicious token approvals granted earlier fully intact, including any granted on a DEX.
- Phishing. Cryptography is not the common loss route. Someone typing their phrase into a convincing fake site is.
Recovery when part of it is missing
In narrow cases, possible.
One known missing word from 24 can be recovered by testing all 2,048 options against the checksum, which is computationally trivial. With one unknown wrong word among all 24, roughly 49,000 possibilities remain. Two wrong words gives around 1.2 million. Three is millions more.
Do not mix languages. Wordlists exist in several languages, and combining them produces either an invalid phrase or a silently different wallet.
Security you can verify on mb.io
Putting the entire burden of security on you suits some people and not others.
mb.io holds assets in regulated custody instead, so account recovery is a support process rather than a cryptographic dead end.
- Institutional-grade MPC custody powered by Fireblocks, with segregated client funds
- 10/10 security score from Hacken, an independent blockchain security auditor
- Regulated by VARA in the UAE and AUSTRAC in Australia
- Withdrawal controls that let you verify a destination before funds move
- Buy, sell, and swap in three steps, from sign-up to purchase
- 24/7 customer support, on web and on the iOS and Android apps
Open your account and start trading on mb.io.
Frequently asked questions
What happens if I lose my seed phrase?
If you still have access to the wallet, generate a new one and move the funds. Having lost both the phrase and the device, the funds are permanently unrecoverable. Nobody can restore them.
Is a seed phrase the same as a private key?
No. A private key controls one address. A seed phrase is the master secret from which the wallet derives many private keys and addresses across multiple chains.
Are 24 words safer than 12?
Marginally, in theory. Both sit far beyond brute-force range. At 128 bits of entropy, a 12-word phrase would take trillions of years to crack at implausible guessing speeds.
Can someone guess my seed phrase?
No. Roughly 5.4 × 10^39 valid combinations exist for a 12-word phrase. Losses come from phishing, physical discovery, and digital storage, never from guessing.
Why do wallets use words instead of a long number?
Because people copy words accurately and long hexadecimal strings badly. Encoding the same randomness in a form that resists transcription errors, BIP-39 also includes a checksum to catch them.
What is the 25th word or passphrase?
An optional extra secret added to the phrase. Deriving a completely separate wallet, it adds protection if the words are found. Forgetting it makes that wallet permanently inaccessible.
Can I use the same seed phrase in a different wallet app?
Usually yes, since BIP-39 is a shared standard. Because derivation paths differ, a wallet occasionally shows an empty balance until the correct path is selected.
Does storing my seed phrase in a password manager count as offline?
No. Password managers are digital storage that syncs to servers. Breaches and compromised devices both expose the phrase, which is why offline physical storage remains the standard advice.
