<p>to answer the first part;</p>

<p>generally speaking people will want to backup their whole wallet, not specific PKs.
so using a HD wallet and making a backup of the seed (either the seed or a BIP39 mnemonic doesn't matter) matches what people using 'normal' wallets do, you backup your whole wallet in 1 place (most wallets have a backup/export file for the whole wallet).</p>

<p>BIP32 - HD Wallets - (and BIP39) isn't supposed to replace being able to split your backups into multiple private keys being scattered around, it replaces a single wallet being backed up in a 'traditional' way, 1 file (or print) for the whole wallet.</p>

<p>also a BIP39 paper backup has the same issues as normal private key backups that you mention, if you loose the passphrase or mispel it ... it's gone ...</p>

<p>But if you want to spread the risk by splitting your bitcoins across multiple backups then you should just have multiple wallets to split them.</p>

<p>BIP39 is also only the process of converting a seed to mnemonic and back, your (above discussed) concerns are actually with HD wallets in general, which is BIP32 ;-)</p>

<p>now your only real concern regarding BIP39 is about the words containing enough entropy!
and they do, because the words are generated from a 128 or 256 bit entropy to begin with, the hex entropy is split into chunks of 11, which means you have a list of 0-2047 integers as a result.
that list of integers is translated to the words (and back to the hex and to the binary entropy when you use it).</p>

<p>Let me demonstrate that by showing you how one of the official test vectors is converted:</p>

<p>hex of entropy: 7f7f7f7f7f7f7f7f7f7f7f7f7f7f7f7f</p>

<p>bits of entropy: 011111110111111101111111011111110111111101111111011111110111111101111111011111110111111101111111011111110111111101111111011111111000</p>

<p>chunked into 11 length parts:
 [0] => 01111111011
 [1] => 11111011111
 [2] => 11011111110
 [3] => 11111110111
 [4] => 11110111111
 [5] => 10111111101
 [6] => 11111101111
 [7] => 11101111111
 [8] => 01111111011
 [9] => 11111011111
[10] => 11011111110
[11] => 11111111000</p>

<p>those parts converted into words using the default word list:
legal winner thank year wave sausage worth useful legal winner thank yellow</p>

<p>the mnemonic together with the password TREZOR converted to a seed hex:
2e8905819b8723fe2c1d161860e5ee1830318dbf49a83bd451cfb8440c28bd6fa457fe1296106559a3c80937a1c1069be3a3a5bd381ee6260e8d9739fce1f607</p>

<p>now the cool part actually is that if you use a different password with the same mnemonic you get a different seed and thus a different wallet, you could have 2 wallets and if you get robbed only hand over the BTC in one of them ;-)</p>

CC BY-SA 4.0
2019-12-14T16:34:49.940Z
"BIP39 is also only the process of converting a seed to mnemonic and back" - BIP39 uses one-way hash to derive the BIP32 seed. There's no way back.
Chris Chen
CC BY-SA 3.0
2014-12-11T14:06:29.493Z
2014-12-11T14:06:29.493Z
Ruben de Vries
<p><strong><em>Bitcoin-explorer passes the BIP-39 test vectors. Look at the bitcoin-explorer examples below to answer questions above.</em></strong></p>

<p><strong>1) echo "0" | bx base16-encode | bx sha256</strong></p>

<p>effcce8fe9c6da7e1b50cccdfc082cdf8d1b135aed519bc27cfd5cacb16269d6</p>

<p><strong>2) echo "effcce8f" | bx mnemonic-new</strong></p>

<p>useful toy phrase</p>

<p><strong>3) echo "e9c6da7e" | bx mnemonic-new</strong></p>

<p>truth cycle panic</p>

<p><strong>4) echo "effcce8fe9c6da7e" | bx mnemonic-new</strong></p>

<p>useful toy physical squeeze horror disease</p>

<p><strong>5) echo "effcce8fe9c6da7e1b50cccdfc082cdf8d1b135aed519bc27cfd5cacb16269d6" | bx mnemonic-new</strong></p>

<p>useful toy physical squeeze horror disease hood book social theory arctic sample spider meadow hill pretty orange become dismiss rich slam raise point soon</p>

<p><strong>6) echo "effcce8fe9c6da7e1b50cccdfc082cdf8d1b135aed519bc27cfd5cacb16269d6" | bx mnemonic-new --language en</strong></p>

<p>useful toy physical squeeze horror disease hood book social theory arctic sample spider meadow hill pretty orange become dismiss rich slam raise point soon</p>

<p><strong>7) echo "effcce8fe9c6da7e1b50cccdfc082cdf8d1b135aed519bc27cfd5cacb16269d6" | bx mnemonic-new --language es</strong></p>

<p>trozo tez opinar sauna honra dar hombre azafrán rubí talón amapola puré salvar mármol héroe pánico norma ascenso dátil posible ritmo perla otro ruptura</p>

<p><strong>8) echo "useful toy physical squeeze horror disease" | bx mnemonic-to-seed</strong></p>

<p>ab226a6e34d87c6a469cfca5d034d7c053ee6f5478bccb1589bc3b216759cb263cab74503471c2f44cbe3d5c06e1e1a774a3feb51a8dfdcc4dd4aece392802e2</p>

<p><strong>9) echo "useful toy physical squeeze horror disease" | bx mnemonic-to-seed -p TREZOR</strong></p>

<p>a1e90b6de07f62e8e09268a138761e9a93296afa221fbefc7b4bcaefef71aac6d4a385af7a0ca34d96b275953d4bbd12d442d9738f1559c855f292e7a4a75daa</p>

<p><strong>10) echo "useful toy physical squeeze horror disease hood book social theory arctic sample spider meadow hill pretty orange become dismiss rich slam raise point soon" | bx mnemonic-to-seed</strong></p>

<p>4703dc4343298d2ea7ddfa5f60b8a359f87c73f356b7eb684596f15390e1d8f67e42c5b224765bf10a4ed3437d3fd6b6110edb2c235ec997b1d969693bc12d18</p>

CC BY-SA 3.0
2017-11-15T10:51:05.703Z
Question: which `bx` library are you using - that one: https://github.com/libbitcoin/libbitcoin-explorer potentially?
Mars Robertson
CC BY-SA 3.0
2017-11-17T19:00:57.237Z
Yep that is the source code. Binaries are available at https://github.com/libbitcoin/libbitcoin-explorer/wiki/Download-BX.
skaht
CC BY-SA 3.0
2017-11-17T23:44:41.450Z
Can you please have a look at the discrepancy? https://imgur.com/a/HDssr
Mars Robertson
CC BY-SA 3.0
2017-11-21T02:19:37.170Z
Looks like the executable being used was using the **boost** without **icu**.  Examine [**install.sh**](https://raw.githubusercontent.com/libbitcoin/libbitcoin-explorer/version3/install.sh) for building with icu.
skaht
CC BY-SA 3.0
2017-11-22T19:12:15.090Z
Too busy, too many other projects, unlikely to dive into the core issue.
Mars Robertson
CC BY-SA 4.0
2021-04-02T08:06:58.197Z
It's the output of `echo "0"`. These produce four different results: "0", "00" 0 and 00. bx base-16 encode converts *any data* to base16..."The binary data to encode as Base16. This can be text or any other data."
evoskuil
CC BY-SA 4.0
2021-04-02T08:08:23.577Z
Any limitation resulting from a non-ICU build would be reflected as an error output.
evoskuil
CC BY-SA 3.0
2015-07-07T03:02:01.847Z
2015-07-07T03:02:01.847Z
skaht
<p>I believe that the best way to regard BIP39 is as a way to create portability for your keys.  You can then move them from one wallet to the next, and/or back the mnemonic up in a variety of ways.  You're not tied to one wallet or system of backup.  Previously, backing up or moving your keys to another wallet was an arduous affair, done one key at a time.  Most people didn't bother, and when their hard drive failed, or they forgot their wallet password, all was basically lost.</p>
<p>Does this really address theft risks?  No.  In an ideal world, you would have a reliable way to regenerate your seed on the fly, and only use a mnemonic to move from one wallet to another.</p>
<p>Theft risks are handled by other systems: airgapping, adding a password to your  mnemonic, imprinting mnemonics on metal and storing them in a bank vault or other reliable physically secure storage system, using a hardware wallet, etc.</p>

CC BY-SA 4.0
2022-09-16T07:49:08.407Z
2022-09-16T07:49:08.407Z
John C.
<p>BIP39 mnemonic phrases replace considerations about how to store one private key, with considerations about how to store the seed to a series of private keys.</p>

<p>The idea is that the private keys are hard to remember, worse to write down, and prone to discovery when stored digitally, so the solution is that you can have a phrase of words that act as a seed to a hierarchical deterministic series of addresses.</p>

<p>It seems like this idea has been lost in translation as the phrase length of mnemonic phrases has increased from 12 words, to 24 words, with the "more secure than thou" using even longer words and phrases, and security minded companies alike promote writing down the mnemonic phrase, in multiple places.</p>

<p>or splitting the phrase, or putting an additional passphrase on top of the HD sequence, or using Shamir's secret key.....</p>

<p>all of which simply create more points of failure.</p>

<p>Ultimately: instead of one paper wallet compromising one private key, your paper phrase will compromise ALL of your private keys. OOPS. or you forget the secret key, or you lose a piece of the phrase, or you misspell it</p>

<p>At least we can be confident that the words themselves contain enough entropy to prevent guessing, RIGHT GUYS? RIGHT?</p>

<p>What are the pros, cons, limitations of BIP39, or at least my concerns. I have read the wiki and the github markdown on BIP39, and these do nothing to alleviate these concerns because these BIPs are a centralized process</p>

<bip32-hd-wallets><mnemonic-seed>
Pros/Cons/Limitations of Mnemonic Phrases - BIP39
CQM
# Pros/Cons/Limitations of Mnemonic Phrases - BIP39

(Asked by: username_0 on 2014-10-08)

BIP39 mnemonic phrases replace considerations about how to store one private key, with considerations about how to store the seed to a series of private keys.

The idea is that the private keys are hard to remember, worse to write down, and prone to discovery when stored digitally, so the solution is that you can have a phrase of words that act as a seed to a hierarchical deterministic series of addresses.

It seems like this idea has been lost in translation as the phrase length of mnemonic phrases has increased from 12 words, to 24 words, with the "more secure than thou" using even longer words and phrases, and security minded companies alike promote writing down the mnemonic phrase, in multiple places.

or splitting the phrase, or putting an additional passphrase on top of the HD sequence, or using Shamir's secret key.....

all of which simply create more points of failure.

Ultimately: instead of one paper wallet compromising one private key, your paper phrase will compromise ALL of your private keys. OOPS. or you forget the secret key, or you lose a piece of the phrase, or you misspell it

At least we can be confident that the words themselves contain enough entropy to prevent guessing, RIGHT GUYS? RIGHT?

What are the pros, cons, limitations of BIP39, or at least my concerns. I have read the wiki and the github markdown on BIP39, and these do nothing to alleviate these concerns because these BIPs are a centralized process

**Tags:** bip32-hd-wallets, mnemonic-seed


---

## 3 answers

### Answer by username_1 on 2014-12-11. Score: 10

to answer the first part;

generally speaking people will want to backup their whole wallet, not specific PKs.
so using a HD wallet and making a backup of the seed (either the seed or a BIP39 mnemonic doesn't matter) matches what people using 'normal' wallets do, you backup your whole wallet in 1 place (most wallets have a backup/export file for the whole wallet).

BIP32 - HD Wallets - (and BIP39) isn't supposed to replace being able to split your backups into multiple private keys being scattered around, it replaces a single wallet being backed up in a 'traditional' way, 1 file (or print) for the whole wallet.

also a BIP39 paper backup has the same issues as normal private key backups that you mention, if you loose the passphrase or mispel it ... it's gone ...

But if you want to spread the risk by splitting your bitcoins across multiple backups then you should just have multiple wallets to split them.

BIP39 is also only the process of converting a seed to mnemonic and back, your (above discussed) concerns are actually with HD wallets in general, which is BIP32 ;-)

now your only real concern regarding BIP39 is about the words containing enough entropy!
and they do, because the words are generated from a 128 or 256 bit entropy to begin with, the hex entropy is split into chunks of 11, which means you have a list of 0-2047 integers as a result.
that list of integers is translated to the words (and back to the hex and to the binary entropy when you use it).

Let me demonstrate that by showing you how one of the official test vectors is converted:

hex of entropy: 7f7f7f7f7f7f7f7f7f7f7f7f7f7f7f7f

bits of entropy: 011111110111111101111111011111110111111101111111011111110111111101111111011111110111111101111111011111110111111101111111011111111000

chunked into 11 length parts:
[0] => 01111111011
[1] => 11111011111
[2] => 11011111110
[3] => 11111110111
[4] => 11110111111
[5] => 10111111101
[6] => 11111101111
[7] => 11101111111
[8] => 01111111011
[9] => 11111011111
[10] => 11011111110
[11] => 11111111000

those parts converted into words using the default word list:
legal winner thank year wave sausage worth useful legal winner thank yellow

the mnemonic together with the password TREZOR converted to a seed hex:
2e8905819b8723fe2c1d161860e5ee1830318dbf49a83bd451cfb8440c28bd6fa457fe1296106559a3c80937a1c1069be3a3a5bd381ee6260e8d9739fce1f607

now the cool part actually is that if you use a different password with the same mnemonic you get a different seed and thus a different wallet, you could have 2 wallets and if you get robbed only hand over the BTC in one of them ;-)

> **Comments:**
> **username_2**: "BIP39 is also only the process of converting a seed to mnemonic and back" - BIP39 uses one-way hash to derive the BIP32 seed. There's no way back.  

---

### Answer by username_3 on 2015-07-07. Score: 3

***Bitcoin-explorer passes the BIP-39 test vectors. Look at the bitcoin-explorer examples below to answer questions above.***

**1) echo "0" | bx base16-encode | bx sha256**

effcce8fe9c6da7e1b50cccdfc082cdf8d1b135aed519bc27cfd5cacb16269d6

**2) echo "effcce8f" | bx mnemonic-new**

useful toy phrase

**3) echo "e9c6da7e" | bx mnemonic-new**

truth cycle panic

**4) echo "effcce8fe9c6da7e" | bx mnemonic-new**

useful toy physical squeeze horror disease

**5) echo "effcce8fe9c6da7e1b50cccdfc082cdf8d1b135aed519bc27cfd5cacb16269d6" | bx mnemonic-new**

useful toy physical squeeze horror disease hood book social theory arctic sample spider meadow hill pretty orange become dismiss rich slam raise point soon

**6) echo "effcce8fe9c6da7e1b50cccdfc082cdf8d1b135aed519bc27cfd5cacb16269d6" | bx mnemonic-new --language en**

useful toy physical squeeze horror disease hood book social theory arctic sample spider meadow hill pretty orange become dismiss rich slam raise point soon

**7) echo "effcce8fe9c6da7e1b50cccdfc082cdf8d1b135aed519bc27cfd5cacb16269d6" | bx mnemonic-new --language es**

trozo tez opinar sauna honra dar hombre azafrán rubí talón amapola puré salvar mármol héroe pánico norma ascenso dátil posible ritmo perla otro ruptura

**8) echo "useful toy physical squeeze horror disease" | bx mnemonic-to-seed**

ab226a6e34d87c6a469cfca5d034d7c053ee6f5478bccb1589bc3b216759cb263cab74503471c2f44cbe3d5c06e1e1a774a3feb51a8dfdcc4dd4aece392802e2

**9) echo "useful toy physical squeeze horror disease" | bx mnemonic-to-seed -p TREZOR**

a1e90b6de07f62e8e09268a138761e9a93296afa221fbefc7b4bcaefef71aac6d4a385af7a0ca34d96b275953d4bbd12d442d9738f1559c855f292e7a4a75daa

**10) echo "useful toy physical squeeze horror disease hood book social theory arctic sample spider meadow hill pretty orange become dismiss rich slam raise point soon" | bx mnemonic-to-seed**

4703dc4343298d2ea7ddfa5f60b8a359f87c73f356b7eb684596f15390e1d8f67e42c5b224765bf10a4ed3437d3fd6b6110edb2c235ec997b1d969693bc12d18

> **Comments:**
> **username_4**: Question: which `bx` library are you using - that one: https://github.com/libbitcoin/libbitcoin-explorer potentially?  
> **username_3**: Yep that is the source code. Binaries are available at https://github.com/libbitcoin/libbitcoin-explorer/wiki/Download-BX.  
> **username_4**: Can you please have a look at the discrepancy? https://imgur.com/a/HDssr  
> **username_3**: Looks like the executable being used was using the **boost** without **icu**.  Examine [**install.sh**](https://raw.githubusercontent.com/libbitcoin/libbitcoin-explorer/version3/install.sh) for building with icu.  
> **username_4**: Too busy, too many other projects, unlikely to dive into the core issue.  
> **username_5**: It's the output of `echo "0"`. These produce four different results: "0", "00" 0 and 00. bx base-16 encode converts *any data* to base16..."The binary data to encode as Base16. This can be text or any other data."  
> **username_5**: Any limitation resulting from a non-ICU build would be reflected as an error output.  

---

### Answer by username_6 on 2022-09-16. Score: 0

I believe that the best way to regard BIP39 is as a way to create portability for your keys. You can then move them from one wallet to the next, and/or back the mnemonic up in a variety of ways. You're not tied to one wallet or system of backup. Previously, backing up or moving your keys to another wallet was an arduous affair, done one key at a time. Most people didn't bother, and when their hard drive failed, or they forgot their wallet password, all was basically lost.

Does this really address theft risks? No. In an ideal world, you would have a reliable way to regenerate your seed on the fly, and only use a mnemonic to move from one wallet to another.

Theft risks are handled by other systems: airgapping, adding a password to your mnemonic, imprinting mnemonics on metal and storing them in a bank vault or other reliable physically secure storage system, using a hardware wallet, etc.


---

