Your 12 or 24 Words: What a Recovery Phrase Really Is
The 12 or 24 words you write down when you set up a wallet look like a poem from a robot. They are not random fun. They are a human-friendly way to write one very large number. This article explains where they come from, using the public specification.
The 10-second version
- The words come from a public standard called BIP-39, titled "Mnemonic code for generating deterministic keys." Its status is "Deployed."
- It turns a big random number into words. The spec says it describes "a mnemonic code or mnemonic sentence -- a group of easy to remember words -- for the generation of deterministic wallets."
- One backup restores everything. Bitcoin.org says a single backup of the recovery phrase is enough to restore all past and future addresses.
Sources: BIP-39 on GitHub and Bitcoin.org, Secure your wallet, both checked on October 18, 2026.
Why 12 or 24?
The spec says the mnemonic "must encode entropy in a multiple of 32 bits," and that "the allowed size of ENT is 128-256 bits." Entropy is the random number. The spec's table shows 128 bits of entropy plus a 4-bit checksum makes a 12-word sentence, and 256 bits plus an 8-bit checksum makes 24 words. In between are other sizes. The spec also says more entropy improves security but makes the sentence longer.
So "12 words or 24 words" is a choice of how large the random number is, not a difference in the kind of wallet. Many wallets do it this way. Not every wallet uses this standard, so check yours.
From words back to money
The spec says a binary seed is made from the words with a function called PBKDF2, using 2048 iterations and HMAC-SHA512. The seed can then be used to generate a deterministic wallet. "Deterministic" means the same words always give back the same keys. That is why writing them down is enough to restore the wallet on a new device.
The optional passphrase
The spec says "a user may decide to protect their mnemonic with a passphrase." If none is set, an empty string is used. Plain words: the passphrase works like a thirteenth word that is not written on the paper. It adds protection if someone finds your words, and it adds risk if you forget it, because the spec uses the passphrase as part of the salt, so a different passphrase produces a different seed and you would not see your funds. We did not test how specific wallets present this option.
What we did not check
We read the BIP-39 text and its table. We did not test any wallet app or hardware device, and we did not check how many people lose money from lost words. We found no primary source for that number.
Sources
- BIP-39: Mnemonic code for generating deterministic keys (checked October 18, 2026)
- Bitcoin.org, Secure your wallet (checked October 18, 2026)