When you create a self-custody wallet, it shows you a list of 12 or 24 ordinary English words. They look like something a person could have chosen, but they were not chosen at all. They are a readable encoding of a very large random number. Understanding where that number comes from explains why the phrase is safe to rely on, why you should never make your own, and why a typo in one word is usually caught immediately.
Step one: the wallet collects randomness
Everything starts with entropy, which is simply a measure of unpredictability. The BIP-39 standard, which most wallets follow, defines the common sizes:
- 128 bits of entropy produces a 12 word phrase.
- 256 bits of entropy produces a 24 word phrase.
A "bit" here is a single 0 or 1 drawn unpredictably. 128 bits means there are 2 to the power of 128 possible starting values, a number with 39 digits. Guessing one specific value by trial and error is not realistic with any known computing approach, which is why a properly generated 12 word phrase is considered strong. A 24 word phrase raises the margin further, though for most people the 12 word version is already beyond practical guessing. The far more common way to lose funds is by leaking the phrase, not by someone guessing it. For storage advice, see your recovery phrase: the only backup that matters.
Where the randomness comes from matters enormously. A wallet on a phone or computer asks the operating system for cryptographically secure random bytes, which are gathered from hardware and system events. A hardware wallet typically uses a dedicated random number generator inside the device. What is not acceptable is a general purpose random function meant for games or simulations, because its output can be reproduced by anyone who knows how it was seeded.
Step two: adding a checksum
The wallet does not turn the raw random bits straight into words. First it runs the entropy through the SHA-256 hash function and takes the first few bits of the result as a checksum. For 128 bits of entropy it appends 4 checksum bits, giving 132 bits. For 256 bits it appends 8, giving 264 bits.
Step three: turning bits into words
The combined bits are cut into groups of 11 bits. Eleven bits can represent 2,048 different values, and the BIP-39 word list contains exactly 2,048 words, so each group selects one word. Do the arithmetic and you get the familiar lengths:
- 132 bits divided by 11 gives 12 words.
- 264 bits divided by 11 gives 24 words.
The word list was designed to be practical. The first four letters of each word are enough to identify it, which makes handwriting and later recovery less error prone, and similar looking words were avoided where possible. Lists also exist in several other languages, though English is by far the most widely supported by wallets.
Why the checksum is useful
Because part of the final word is a checksum of everything before it, most random combinations of valid words are not a valid phrase. In practice:
- If you mistype or misremember one word while restoring a wallet, the checksum will usually fail and the wallet will tell you the phrase is invalid, rather than quietly opening an empty wallet.
- If two words are swapped, the checksum will usually catch that too.
This is a safety net against accidental mistakes only. The checksum is public information derived from the entropy. It adds no secrecy, and it does not protect you from someone who has read your words.
Why you should never invent your own phrase
It is tempting to think a phrase made of words you picked, such as a favorite quote or a lyric, would be easier to remember. It would also be dramatically weaker. Humans are bad at randomness, and attackers know the patterns. An invented phrase drawn from a few thousand likely candidates can be searched quickly, and this has been exploited in the past against so called "brain wallets" built from memorable text.
The same warning applies to any tool that generates a phrase for you but does not use a proper source of randomness. A real example is the "Milk Sad" vulnerability, tracked as CVE-2023-39910, disclosed in 2023. Versions 3.0.0 to 3.6.0 of the Libbitcoin Explorer command line tool generated seeds from a pseudorandom generator that was effectively seeded with only 32 bits of information. That is a tiny search space compared with the 128 bits a phrase should have, and wallets created that way could be recovered by attackers. The name comes from the first two words of one of the affected phrases. The lesson is not that phrases are fragile, but that the generator has to be trustworthy.
Practical habits that follow from this
- Generate the phrase inside the wallet or hardware device itself. Use software you installed from the official source. See how to spot a malicious wallet download.
- Never accept a phrase that someone else hands you. A wallet that arrives with words already written on a card, or a "support agent" who supplies a phrase, may be one the sender can also access.
- Avoid websites that generate phrases for you unless you are an expert working offline on a device you fully control. For everyone else, the wallet app or hardware device is the right place.
- Do not screenshot, photograph or store the words in cloud notes. Those copies can be read by anyone who gets into that account or device.
- Test your backup before you rely on it. Our guide on testing your wallet recovery walks through a safe way to do it.
- Know the optional extras. An additional passphrase changes the wallet derived from the same words. It is covered in the BIP-39 passphrase explained.
What the phrase does not include
The words are not tied to Base or to any single blockchain. They are a seed from which a wallet derives keys, and the same phrase can produce addresses on many networks. How those addresses are derived is explained in same recovery phrase, different address, and the relationship between keys, addresses and signatures is covered in public and private keys explained.
The short version
A recovery phrase is a random number written in words. The randomness must be real, the last word carries a checksum that catches most typos, and the whole thing is only as safe as your ability to keep it private. Let your wallet generate it, write it down offline, and never type it into anything you did not install and verify yourself. This article is educational and not financial advice.