What is the BIP39 word list?

The BIP39 word list is a set of 2,048 English words that crypto wallets use to write down a wallet's master secret as a seed phrase. BIP39, short for Bitcoin Improvement Proposal 39, sets out the rules. It was written by Marek Palatinus, Pavol Rusnak, Aaron Voisine and Sean Bowe, and the bitcoin/bips repository lists it as deployed.

What are the BIP39 words?

According to the BIP-39 text, the list was designed to be hard to get wrong:

• It has exactly 2,048 words, so each word encodes 11 bits of data.
• The first four letters of every word are enough to identify it, so no two words share the same first four letters.
• Pairs of very similar words, such as "build" and "built," were left out.
• The words are sorted in order, which lets software look them up quickly.

Lists exist in some other languages, but the standard says non-English lists are strongly discouraged because most wallets support only English. The same words written in a different language's list would produce a completely different wallet.

How does a BIP39 seed phrase get made?

The wallet starts with random data called entropy, between 128 and 256 bits. It adds a short checksum taken from a hash of that data, then splits the result into 11-bit chunks. Each chunk points to one word on the list.

Entropy	Checksum	Words
128 bits	4 bits	12
160 bits	5 bits	15
192 bits	6 bits	18
224 bits	7 bits	21
256 bits	8 bits	24

Trezor says a 12-word phrase gives 128-bit security and a 24-word phrase gives 256-bit security, both assuming the words were picked at random by the device. The odds of guessing one are covered in can someone guess your seed phrase.

The checksum is small. BIP-39 notes that for a 24-word phrase about one random error in 256 slips through, and it cannot fix errors, only flag some of them. BIP-39 also says it is not meant for phrases people make up themselves.

The words are then stretched into a 512-bit seed using a function called PBKDF2, run 2,048 times. That seed feeds BIP32, which Trezor explains derives every key in the wallet from one root.

What is a BIP39 passphrase?

BIP39 lets users add an optional passphrase during that stretching step. Every passphrase produces a valid but different wallet, and an empty one gives the standard wallet. Our guide to the seed phrase passphrase covers how that works and its risks.

BIP39 vs SLIP39, what is the difference?

SLIP39, created in December 2017, is a newer format from SatoshiLabs that splits a secret into several shares. Its list has 1,024 words, and each share is 20 or 33 words long. The SLIP-0039 text says the two are largely incompatible, and SLIP39 shares cannot be turned back into a BIP39 phrase. See what is a Shamir backup for details.

The word list itself is public and not secret. The secret is which words you have and in what order. Trezor's advice is to never type your words into any app or website to check them.