<p>The seed derivation works by increasing a "nonce" and deriving an address from that. So, by example, if we pretend that we have 1234 as our seed, then we could increase that seed by 1 for each address derivation. If we use a simple sha256 hash of that as our private key, then we get the following addresses:</p>

<p><kbd><strong><code>Nonce</code></strong></kbd><kbd><strong><code>Final Seed</code></strong></kbd><kbd><strong><code>Address                           </code></strong></kbd><br>
<kbd><code>    0</code></kbd><kbd><code>      1234</code></kbd><kbd><code>1B3PHXB6g5YGLvzTkxrrPEdLbpvfEoC5Qi</code></kbd><br>
<kbd><code>    1</code></kbd><kbd><code>      1235</code></kbd><kbd><code>1NxaF9cYPL53fNTHMN6wtmq1w8bmHEe3gp</code></kbd><br>
<kbd><code>    2</code></kbd><kbd><code>      1236</code></kbd><kbd><code>1DPF9wFiuFowUK4NwJdbd2W9L59bPPnWNM</code></kbd><br>
<kbd><code>    3</code></kbd><kbd><code>      1237</code></kbd><kbd><code>13ehhpMndUoh5E4QcHJ7QSWwuKC7ySpxrL</code></kbd><br>
<kbd><code>    4</code></kbd><kbd><code>      1238</code></kbd><kbd><code>17CF5qesU9KXBHAsa9tEz1126kqSDy56tC</code></kbd><br>
<kbd><code>    5</code></kbd><kbd><code>      1239</code></kbd><kbd><code>1MfTGTiszztzzjzKajvS1Wc3TznqpfyPh7</code></kbd><br>
<kbd><code>    6</code></kbd><kbd><code>      1240</code></kbd><kbd><code>16t3QqxUVssdTAYUibdY8K4aCFYsP6pUWE</code></kbd><br></p>

<p>This is obviously oversimplified, and not the derivation that is used in most BIP32 implementations. As to how they are restored, you simply keep deriving addresses until you hit a bunch in a row that are unused. This is called a lookup gap, and is normally configurable.</p>

CC BY-SA 3.0
2016-05-22T18:15:18.523Z
Unrelated, but that table is amazing, I didn't know you could do that on SE.
fluffyponyza
CC BY-SA 3.0
2018-01-24T04:20:11.743Z
This is a great reply, thank you. But to close the loop, it sounds like the bip44 protocol calls for a lookup on the blockchain of the public key for the deterministically generated key pairs until the configured lookup gap threshold is hit.
Bill
CC BY-SA 3.0
2016-05-22T16:03:48.917Z
2016-05-22T16:03:48.917Z
Riaan Swart
<p>Wallets don't actually have bitcoins, what the store are public and private keys. 
This <a href="https://bitcoin.org/en/how-it-works" rel="nofollow">link</a> explains the basics. </p>

<p>Anyone who knows these pieces of info can use the bitcoins stored at that address. You don't even need a wallet!</p>

<p>Wallets provide a way to generate new addresses for each transaction and remember the associated private keys. They can also provide features so that if you need to recreate the wallet it can recreate for you the same addresses and associated private keys that it did before so that you can spend any bitcoins stored at an address that you created with the wallet.</p>

CC BY-SA 3.0
2016-03-23T06:20:27.437Z
This is only true if you considet a wallet to just represent a single balance. It's not true when you want it to maintain accounting information (transaction time, from/to whom, messages, ...), for example. In some settings, maintaining the accounting information may actually be more important than just keeping the correct balance spendable, because of legal or administrative reasons.
Pieter Wuille
CC BY-SA 3.0
2016-01-23T05:05:16.550Z
2016-01-23T05:05:16.550Z
Kharoof
<p>By no means am I an expert but I'm currently reading <a href="https://rads.stackoverflow.com/amzn/click/1491954388" rel="nofollow noreferrer">Mastering Bitcoin by Andreas M. Antonopoulos</a> and I had this question too. Chapter 5 discusses in depth how HD wallets work and how they can restore addresses from a seed phrase and password/salt. The book mentions there are billions of possible addresses but not how your new wallet works out which of these addresses was actually being used in the past.</p>

<p>This question helped me get it straight in my head: <a href="https://bitcoin.stackexchange.com/questions/65511/how-to-find-the-wallet-balance/65520#65520">How to find the wallet balance?</a></p>

<blockquote>
  <p>Wallet software will have a set number of addresses it generates and
  checks for a balance upon wallet initialization (maybe 50? this will
  vary and is configurable in some software). The wallet will probably
  include some logic like "look 50 addresses past the last used address
  found". You can design this to fit your need, for example if you were
  a merchant accepting payments on a busy website, you might need a
  higher bound, in case 50 customers in a row generate a payment address
  but then don't complete checkout.</p>
</blockquote>

CC BY-SA 3.0
2017-12-21T12:55:14.337Z
2017-12-21T12:55:14.337Z
James Mundy
<p>I was trying to learn working of bitcoin and trying to understand the working of bitcoin wallet.</p>

<p>I can see the behavior of how an HD wallet starts with an address and adds additional addresses later for receiving bitcoin. </p>

<p>I read bip-0032, but still am  confused. If I regenerate a wallet from the seed (in another mobile phone), how the system will populate the wallet with all previous addresses containing a balance? Will it try to download the earlier blockchain and search it, or is there another way?</p>

<p>How do we locate a list of all addresses we created with the HD wallet? How can we verify the balance of those addresses?</p>

<p>I know that this question is going to receive down votes, please give me some ideas. </p>

<p>Also it would be helpful if somebody can share some links where I could get some help on clarifying doubts (not programming, general working).</p>

<wallet><client>
How does restoring an HD wallet work?
Sarath Babu
# How does restoring an HD wallet work?

(Asked by: username_0 on 2016-01-22)

I was trying to learn working of bitcoin and trying to understand the working of bitcoin wallet.

I can see the behavior of how an HD wallet starts with an address and adds additional addresses later for receiving bitcoin.

I read bip-0032, but still am confused. If I regenerate a wallet from the seed (in another mobile phone), how the system will populate the wallet with all previous addresses containing a balance? Will it try to download the earlier blockchain and search it, or is there another way?

How do we locate a list of all addresses we created with the HD wallet? How can we verify the balance of those addresses?

I know that this question is going to receive down votes, please give me some ideas.

Also it would be helpful if somebody can share some links where I could get some help on clarifying doubts (not programming, general working).

**Tags:** wallet, client


---

## 3 answers

### Answer by username_1 on 2016-05-22. Score: 3

The seed derivation works by increasing a "nonce" and deriving an address from that. So, by example, if we pretend that we have 1234 as our seed, then we could increase that seed by 1 for each address derivation. If we use a simple sha256 hash of that as our private key, then we get the following addresses:

`Nonce``Final Seed``Address`   
 `0` `1234``1B3PHXB6g5YGLvzTkxrrPEdLbpvfEoC5Qi`  
 `1` `1235``1NxaF9cYPL53fNTHMN6wtmq1w8bmHEe3gp`  
 `2` `1236``1DPF9wFiuFowUK4NwJdbd2W9L59bPPnWNM`  
 `3` `1237``13ehhpMndUoh5E4QcHJ7QSWwuKC7ySpxrL`  
 `4` `1238``17CF5qesU9KXBHAsa9tEz1126kqSDy56tC`  
 `5` `1239``1MfTGTiszztzzjzKajvS1Wc3TznqpfyPh7`  
 `6` `1240``16t3QqxUVssdTAYUibdY8K4aCFYsP6pUWE`

This is obviously oversimplified, and not the derivation that is used in most BIP32 implementations. As to how they are restored, you simply keep deriving addresses until you hit a bunch in a row that are unused. This is called a lookup gap, and is normally configurable.

> **Comments:**
> **username_2**: Unrelated, but that table is amazing, I didn't know you could do that on SE.  
> **username_3**: This is a great reply, thank you. But to close the loop, it sounds like the bip44 protocol calls for a lookup on the blockchain of the public key for the deterministically generated key pairs until the configured lookup gap threshold is hit.  

---

### Answer by username_4 on 2016-01-23. Score: 2

Wallets don't actually have bitcoins, what the store are public and private keys.
This [link](https://bitcoin.org/en/how-it-works) explains the basics.

Anyone who knows these pieces of info can use the bitcoins stored at that address. You don't even need a wallet!

Wallets provide a way to generate new addresses for each transaction and remember the associated private keys. They can also provide features so that if you need to recreate the wallet it can recreate for you the same addresses and associated private keys that it did before so that you can spend any bitcoins stored at an address that you created with the wallet.

> **Comments:**
> **username_5**: This is only true if you considet a wallet to just represent a single balance. It's not true when you want it to maintain accounting information (transaction time, from/to whom, messages, ...), for example. In some settings, maintaining the accounting information may actually be more important than just keeping the correct balance spendable, because of legal or administrative reasons.  

---

### Answer by username_6 on 2017-12-21. Score: 2

By no means am I an expert but I'm currently reading [Mastering Bitcoin by Andreas M. Antonopoulos](https://rads.stackoverflow.com/amzn/click/1491954388) and I had this question too. Chapter 5 discusses in depth how HD wallets work and how they can restore addresses from a seed phrase and password/salt. The book mentions there are billions of possible addresses but not how your new wallet works out which of these addresses was actually being used in the past.

This question helped me get it straight in my head: [How to find the wallet balance?](https://bitcoin.stackexchange.com/questions/65511/how-to-find-the-wallet-balance/65520#65520)

> Wallet software will have a set number of addresses it generates and
> checks for a balance upon wallet initialization (maybe 50? this will
> vary and is configurable in some software). The wallet will probably
> include some logic like "look 50 addresses past the last used address
> found". You can design this to fit your need, for example if you were
> a merchant accepting payments on a busy website, you might need a
> higher bound, in case 50 customers in a row generate a payment address
> but then don't complete checkout.


---

