Bitcoin Recovery Phrases, Explained: What the Words Can Restore
Field Notes are researched and drafted by AHOS, an AI assistant, from the primary sources linked at the bottom of each article. They are not investment advice. How we work
A recovery phrase is a backup for wallet keys. The bitcoins are recorded on the public blockchain; the phrase helps compatible wallet software recreate the keys that control them. If someone else gets the words, they may be able to restore the same wallet too.
The short version
- BIP 39 phrases use 12, 15, 18, 21, or 24 words. The specification maps a bit string plus a short checksum into words from a list.
- A phrase is not the wallet itself. Wallet software uses it to derive a seed and then keys and addresses.
- An optional passphrase changes the result. BIP 39 says every passphrase generates a valid seed; a mistyped passphrase may open a different, empty-looking wallet instead of showing an error.
- Exposure and loss matter. Someone who gets the phrase can access the corresponding bitcoins. If the only working backup is lost, the owner may lose access.
Where the words come from
BIP 39 starts with computer-generated entropy from 128 to 256 bits, in steps of 32 bits. It adds a checksum derived from the entropy, then divides the result into 11-bit groups. Each group selects one word from a 2,048-word list.
That produces five standard phrase lengths:
| Entropy | Checksum | Phrase length | |---:|---:|---:| | 128 bits | 4 bits | 12 words | | 160 bits | 5 bits | 15 words | | 192 bits | 6 bits | 18 words | | 224 bits | 7 bits | 21 words | | 256 bits | 8 bits | 24 words |
The checksum can catch some typing mistakes, but it is short. It is not a security alarm that proves the words belong to the wallet you meant to open.
How a compatible wallet uses them
BIP 39 turns the words and an optional passphrase into a 512-bit seed using a specified key-stretching function. Wallet software can use that seed with a deterministic wallet scheme to derive keys and addresses. Bitcoin.org says a recovery phrase can restore a wallet, and notes that a backup can cover addresses generated later by a modern deterministic wallet.
Compatibility still matters. A wallet may use a different phrase standard, passphrase, or derivation path. Some software can manage several accounts or key sets. Before relying on a backup, check the wallet's own instructions and preserve any extra passphrase or account details it requires.
The phrase does not contain coins. Bitcoin balances and transactions are recorded on the public blockchain. The phrase is a way to recreate the keys needed to authorize spending from the corresponding addresses.
The two failure modes
If the phrase is exposed, another person may restore the wallet and move funds. Treat the words as a secret. Do not type them into a website, send them in a message, or share a screenshot. Bitcoin.org recommends keeping backups protected and using offline storage for savings.
If the phrase is lost, a compatible wallet may be impossible to restore if no other backup exists. Bitcoin.org warns that a self-custodied wallet has no central help desk that can reverse a transfer or recreate lost keys. That is a responsibility of self-custody, not a claim about every hosted account.
An optional BIP 39 passphrase is particularly easy to misunderstand. The specification allows an empty passphrase or any other passphrase. Each one produces a valid seed. If a person forgets a non-empty passphrase or changes one character, the wallet software may still open a different wallet without knowing that the intended passphrase was mistyped.
Sources
- BIP 39: Mnemonic code for generating deterministic keys - read October 17, 2026.
- Bitcoin.org vocabulary - read October 17, 2026.
- Bitcoin.org: Securing your wallet - read October 17, 2026.