BIP39 Mnemonic Generator

Generate cryptographically secure BIP39 seed phrases for educational and development use.

For educational purposes only. Never use an internet-connected tool to generate mnemonics for real funds. Use a hardware wallet (Trezor, Ledger) or an air-gapped device for actual cryptocurrency recovery phrases.
Generated Phrase
Click "Generate Phrase" to create a mnemonic
Plain text (space-separated)
Select a word count and click Generate Phrase.

How to Use the BIP39 Mnemonic Generator

  1. Choose word count — select 12, 15, 18, 21, or 24 words. More words means more entropy bits and a higher security margin.
  2. Click Generate Phrase — the tool generates cryptographically secure random entropy using crypto.getRandomValues(), computes the SHA-256 checksum, maps 11-bit groups to the BIP39 wordlist, and displays the resulting phrase as numbered word cards.
  3. Review entropy details — the entropy bar shows how many bits of randomness were used, how many checksum bits were appended, and the effective security level.
  4. Copy or download — copy the space-separated phrase to your clipboard or download as a text file for offline storage.
  5. Verify mode — paste any BIP39 mnemonic to validate every word against the wordlist and confirm the checksum is correct. Words highlighted green are valid; red indicates an unrecognized word.

What Is BIP39?

BIP39 (Bitcoin Improvement Proposal 39) defines a standard for generating human-readable mnemonic sentences that encode the seed for a hierarchical deterministic (HD) wallet. Introduced in 2013, BIP39 has become the universal standard for crypto wallet backup phrases — used by Bitcoin, Ethereum, and virtually every major blockchain wallet including Trezor, Ledger, MetaMask, and Coinbase Wallet.

The BIP39 Algorithm Step by Step

The generation process follows a precise algorithm:

  1. Generate entropy — produce N bits of cryptographically secure random data, where N is 128, 160, 192, 224, or 256 bits depending on the desired word count.
  2. Compute checksum — take the SHA-256 hash of the entropy bytes, then take the first (N/32) bits of the hash as the checksum.
  3. Append checksum — concatenate the entropy bits and checksum bits into a single bit string of length N + N/32.
  4. Split into 11-bit groups — divide the combined bit string into groups of 11 bits each. The total length is always divisible by 11, yielding exactly the desired word count.
  5. Map to wordlist — each 11-bit group represents an integer from 0 to 2047. Look up the corresponding word in the BIP39 English wordlist to produce the mnemonic phrase.

Word Count and Security Levels

  • 12 words — 128-bit entropy + 4-bit checksum. 2^128 ≈ 3.4 × 10^38 possible phrases. Sufficient for most uses.
  • 15 words — 160-bit entropy + 5-bit checksum. 2^160 ≈ 1.5 × 10^48 possible phrases.
  • 18 words — 192-bit entropy + 6-bit checksum. 2^192 ≈ 6.3 × 10^57 possible phrases.
  • 21 words — 224-bit entropy + 7-bit checksum. 2^224 ≈ 2.7 × 10^67 possible phrases.
  • 24 words — 256-bit entropy + 8-bit checksum. 2^256 ≈ 1.2 × 10^77 possible phrases. Maximum security.

The BIP39 Wordlist

The BIP39 English wordlist contains exactly 2048 words carefully chosen to be: at least 4 characters long (except three 3-letter words), uniquely identifiable by the first 4 characters (no two words share the same 4-letter prefix), common enough to be memorable, and unlikely to be confused with each other when handwritten. Each word maps to an 11-bit index (0–2047). The full wordlist is embedded directly in this tool — no external requests needed.

Wallet Derivation (Beyond BIP39)

The mnemonic phrase itself is just the first step. BIP39 specifies a PBKDF2 function (with HMAC-SHA512, 2048 iterations) to derive a 512-bit binary seed from the mnemonic and an optional passphrase. This 512-bit seed is then used by BIP32 (Hierarchical Deterministic Wallets) to derive an unlimited number of private/public key pairs organized in a tree structure. BIP44 then specifies standard derivation paths (e.g., m/44'/0'/0'/0/0 for the first Bitcoin address). This tool generates only the mnemonic phrase, not the derived keys.

Security Best Practices

  • Never store digitally — write your phrase on paper (not a photo, screenshot, or cloud document) and store in a safe location
  • Never share — anyone with your mnemonic has full access to all wallet funds — there are no recovery options
  • Use hardware wallets for real funds — Trezor and Ledger generate mnemonics in isolated secure chips, never exposed to a network
  • Verify offline — for real wallets, use an air-gapped computer or hardware wallet to generate and verify phrases
  • Test restores — after securing your phrase, test restoring a wallet on a different device to confirm accuracy before depositing funds

For related cryptographic tools, see our Hash Generator, Password Generator, and UUID Generator.

Frequently Asked Questions

A BIP39 mnemonic phrase (also called a seed phrase or recovery phrase) is a human-readable sequence of 12 to 24 common English words that encodes a cryptographic seed for a hierarchical deterministic (HD) wallet. The phrase is derived from a random entropy value combined with a SHA-256 checksum, then mapped to a standardized 2048-word English wordlist. Knowing the phrase is equivalent to knowing the private keys for all addresses in the wallet.
BIP39 generates entropy of 128–256 bits using a cryptographically secure random number generator. A SHA-256 hash is computed over the entropy, and the first (entropy_bits / 32) bits of the hash are appended as a checksum. The combined bit string is split into 11-bit groups, each mapping to one of 2048 BIP39 words. A 12-word phrase uses 128-bit entropy + 4-bit checksum = 132 bits total / 11 = 12 words.
For educational or testing purposes, this tool is safe — it runs entirely in your browser using the Web Crypto API and no data leaves your device. However, for real cryptocurrency wallets holding actual funds, you should generate mnemonics on an air-gapped, offline computer or use a hardware wallet. Any mnemonic generated on an internet-connected device could theoretically be compromised if the device has malware.
A 12-word mnemonic encodes 128 bits of entropy, while a 24-word mnemonic encodes 256 bits. Both are computationally infeasible to brute-force — the 12-word version has 2^128 possible values. Most hardware wallets default to 24 words for the maximum security margin. MetaMask defaults to 12 words; Trezor and Ledger use 24 words.
Yes. Switch to Verify mode and enter your mnemonic. The tool checks every word against the BIP39 English wordlist and confirms the embedded checksum matches the entropy bits. A valid checksum means the phrase is structurally correct. Note that a valid checksum does not mean the phrase controls any funds — it only confirms proper BIP39 formatting.