<p>I am assuming that you are talking about BIP 39 here.</p>

<p>A BIP 39 mnemonic can have any number of words with the most common being 12, 18, and 24 words. There is a checksum encoded into this mnemonic. This checksum is actually just a "part of" the last word, i.e. the last word encodes some of the actual initial entropy, and some of the checksum, depending on the size of the entropy in bits.</p>

<p>The way that BIP 39 makes the mnemonic is by generating some initial entropy that is <code>n</code> bits in length. The checksum is then the first <code>n / 32</code> bits of the SHA256 hash of the entropy. This is just concatenated to the end of the entropy. The mnemonic is then encoded by dividing the entropy into groups of 11 bits and using the resulting 11 bit number as an index into a list of 2048 words.</p>

<p>With a 12 word seed, there are 128 bits of entropy, which gives <code>128 / 32 = 4</code> bits of checksum. This gives 132 total bits to be encoded, and <code>132 / 11 = 12</code> words. You may have noticed that the checksum is only 4 bits in length, which is shorter than the 11 bits allocated for the last word. So the last word's index is actually composed of both the last 7 bits of the entropy and the entire 4 bit checksum.</p>

<p>With a 24 word seed, there are 256 bits of entropy, which gives <code>256 / 32 = 8</code> bits of checksum. This is also shorter than the 11 bits for the index of the last word, so this means that the 24th word of a 24 word seed "contains" the last 3 bits of the entropy and all 8 bits of the checksum.</p>

<p>BIP 39 itself <a href="https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki#generating-the-mnemonic" rel="noreferrer">has a table</a> showing the number of entropy bits, the number of checksum bits, the total bit length, and the total word length for various entropy bit lengths.</p>

CC BY-SA 4.0
2019-06-28T04:28:48.767Z
2019-06-28T04:28:48.767Z
Ava Chow
<p>say i have 24 words. Out of those 24 words, is the 24th one the checksum.</p>

<p>say i have:</p>

<pre><code>a1 b2 c3 d4 e5 f6 g7 h8 i9 j10 k11 l12 m13 n14 o15 p16 q17 r18 s19 t20 u21 v22 w23 x24
</code></pre>

<p>is x24 the checksum? or is there a 25th word which is checksum?</p>

<p>I'd also want to know about how checksums work.</p>

<wallet><wallet-recovery><mnemonic-seed><bip><checksum>
are checksums included in mnemonic seed phrases?
ParmuTownley
# are checksums included in mnemonic seed phrases?

(Asked by: username_0 on 2019-06-28)

say i have 24 words. Out of those 24 words, is the 24th one the checksum.

say i have:

```
a1 b2 c3 d4 e5 f6 g7 h8 i9 j10 k11 l12 m13 n14 o15 p16 q17 r18 s19 t20 u21 v22 w23 x24

```

is x24 the checksum? or is there a 25th word which is checksum?

I'd also want to know about how checksums work.

**Tags:** wallet, wallet-recovery, mnemonic-seed, bip, checksum


---

## 1 answers

### Answer by username_1 on 2019-06-28. Score: 5 | Accepted answer

I am assuming that you are talking about BIP 39 here.

A BIP 39 mnemonic can have any number of words with the most common being 12, 18, and 24 words. There is a checksum encoded into this mnemonic. This checksum is actually just a "part of" the last word, i.e. the last word encodes some of the actual initial entropy, and some of the checksum, depending on the size of the entropy in bits.

The way that BIP 39 makes the mnemonic is by generating some initial entropy that is `n` bits in length. The checksum is then the first `n / 32` bits of the SHA256 hash of the entropy. This is just concatenated to the end of the entropy. The mnemonic is then encoded by dividing the entropy into groups of 11 bits and using the resulting 11 bit number as an index into a list of 2048 words.

With a 12 word seed, there are 128 bits of entropy, which gives `128 / 32 = 4` bits of checksum. This gives 132 total bits to be encoded, and `132 / 11 = 12` words. You may have noticed that the checksum is only 4 bits in length, which is shorter than the 11 bits allocated for the last word. So the last word's index is actually composed of both the last 7 bits of the entropy and the entire 4 bit checksum.

With a 24 word seed, there are 256 bits of entropy, which gives `256 / 32 = 8` bits of checksum. This is also shorter than the 11 bits for the index of the last word, so this means that the 24th word of a 24 word seed "contains" the last 3 bits of the entropy and all 8 bits of the checksum.

BIP 39 itself [has a table](https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki#generating-the-mnemonic) showing the number of entropy bits, the number of checksum bits, the total bit length, and the total word length for various entropy bit lengths.


---

