BA-04 · LESSON 03

BIP39 mnemonics and passphrases

KEY DEFINITIONS

Terms used in this lesson

BIP39: A standard that converts entropy into mnemonic words and derives a seed using an optional passphrase.
PBKDF2: A password-based key-derivation function used by BIP39 to turn mnemonic words and an optional passphrase into a seed.
Vault: A set of Bitcoin outputs and spending rules that holds collateral and represents the current loan state.
HMAC: Hash-based message authentication code: a keyed hash construction used to authenticate data or derive deterministic secret material.
HMAC-SHA512: HMAC using SHA-512; BIP32 uses it to derive a master key and chain code from seed material.

Bitcoin Improvement Proposal 39 defines word-based wallet backups. Its optional passphrase creates a different wallet, so losing either the words or passphrase prevents recovery.

55 min Difficulty 1/5 Not started

VISUAL MODEL

See the whole mechanism before going step by step

Use the diagrams to orient yourself. Then the guided explanation below teaches every part in depth.

4 explanatory views

CONCEPT-SPECIFIC MAP · bip39 backupEntropy becomes words, then a wallet seedSelect any state to inspect its exact role.

RELATIONSHIP MAPCommitment and derivation tree

01
ENTROPY128 bits
Wallet software starts from cryptographically secure random entropy.
02
CHECKSUMFirst 4 SHA-256 bits
For 128-bit entropy, four checksum bits are appended before word indexing.
03
WORDS12 indices of 11 bits
The words are an encoding of entropy, not a human-created password.
04
PASSPHRASEsalt = mnemonic
Every passphrase produces a valid but different seed. There is no wrong-passphrase warning.
05
SEED64-byte seed
The seed initializes HD key derivation; wallet policy and derivation path are also needed for recovery.

Rule shown: The mnemonic encodes entropy plus a checksum; PBKDF2 then combines the sentence and optional passphrase into a 64-byte seed.

STAGE 1 OF 5ENTROPY: 128 bits

Wallet software starts from cryptographically secure random entropy.

Governing relationship: The mnemonic encodes entropy plus a checksum; PBKDF2 then combines the sentence and optional passphrase into a 64-byte seed. Complete path: 1. ENTROPY, 128 bits. Wallet software starts from cryptographically secure random entropy. 2. CHECKSUM, First 4 SHA-256 bits. For 128-bit entropy, four checksum bits are appended before word indexing. 3. WORDS, 12 indices of 11 bits. The words are an encoding of entropy, not a human-created password. 4. PASSPHRASE, salt = mnemonic. Every passphrase produces a valid but different seed. There is no wrong-passphrase warning. 5. SEED, 64-byte seed. The seed initializes HD key derivation; wallet policy and derivation path are also needed for recovery.

1. State transitionWhat exists, what changes, and what results

BEFORE

The same 12 words are opened once with no passphrase and once with ‘orange-vault’.

MECHANISM

The mnemonic and checksum represent the root secret material in a human-transcribable form.

AFTER

A passphrase is not merely a screen lock; it changes the wallet’s cryptographic root.

Text equivalent: Starting from The same 12 words are opened once with no passphrase and once with ‘orange-vault’. The mechanism begins when The mnemonic and checksum represent the root secret material in a human-transcribable form. The resulting lesson is A passphrase is not merely a screen lock; it changes the wallet’s cryptographic root.

2. Mechanism pathSelect a stage to inspect its job

STAGE 1 OF 4

Words encode entropy

The mnemonic and checksum represent the root secret material in a human-transcribable form.

Complete path: 1. Words encode entropy: The mnemonic and checksum represent the root secret material in a human-transcribable form. 2. The passphrase changes derivation: The mnemonic is used as the PBKDF2 password and the string ‘mnemonic’ plus the passphrase is used as the salt. The result is a different seed. 3. There is no wrong-passphrase warning: A typo usually derives another empty wallet rather than failing authentication. Recovery requires the exact words and exact passphrase. 4. Backup both parts deliberately: Separating the mnemonic and passphrase can reduce single-location compromise, but loss of either makes the intended wallet unrecoverable.

3. Rule and failure boundaryWhat accepts the result and where it can stop

ACCEPTED PATH

Recomputation must use the exact normalized words, passphrase, PBKDF2 construction, iteration count, and output length.

CHANGED CONDITION

A one-character typo derives another valid wallet rather than an invalid-password error; without the exact intended passphrase, there is no reset service or external correctness marker.

Important distinction: A BIP39 passphrase can be reset if the mnemonic is still available. There is no reset service or stored verifier. Without the exact passphrase, the intended derived wallet cannot be recovered.

Text equivalent: The accepted path is enforced by Recomputation must use the exact normalized words, passphrase, PBKDF2 construction, iteration count, and output length. If the required condition changes, A one-character typo derives another valid wallet rather than an invalid-password error; without the exact intended passphrase, there is no reset service or external correctness marker.

Loading lesson visuals...

Learn the idea

A BIP39 mnemonic encodes wallet entropy as words. PBKDF2, the Password-Based Key Derivation Function 2, repeatedly applies HMAC-SHA512; HMAC is a keyed hash construction and the suffix names its underlying 512-bit Secure Hash Algorithm. An optional BIP39 passphrase is mixed with those words during key derivation, so every different passphrase produces a different, valid wallet.

GUIDED EXPLANATION1/4 ideas inspected

Words encode entropy

The mnemonic and checksum represent the root secret material in a human-transcribable form.

The worked example follows the explanation

Inspect every idea above to open it.

Important distinction“A BIP39 passphrase can be reset if the mnemonic is still available.”

There is no reset service or stored verifier. Without the exact passphrase, the intended derived wallet cannot be recovered.

FINISH LEARNING FIRST

The questions unlock after every required learning activity

Inspect every guided idea, open the worked example, rebuild its mechanism, and complete the deterministic lesson tool. Your progress is saved automatically.