<p>These pictures are from <a href="https://rads.stackoverflow.com/amzn/click/com/1491954388" rel="noreferrer" rel="nofollow noreferrer">Mastering bitcoin</a> and were so insightful for me.</p>
<p>How the mnemonic words are generated:
<a href="https://i.sstatic.net/pII4g.png" rel="noreferrer"><img src="https://i.sstatic.net/pII4g.png" alt="enter image description here" /></a>
How they are used to generates master seed of your wallet:
<a href="https://i.sstatic.net/oyZP4.png" rel="noreferrer"><img src="https://i.sstatic.net/oyZP4.png" alt="enter image description here" /></a></p>

CC BY-SA 4.0
2022-07-05T07:29:04.957Z
2022-07-05T07:29:04.957Z
Amir reza Riahi
<p>From <a href="https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki" rel="nofollow noreferrer">BIP39</a>:</p>
<blockquote>
<p>To create a binary seed from the mnemonic, we use the PBKDF2 function
with a mnemonic sentence (in UTF-8 NFKD) used as the password and the
string &quot;mnemonic&quot; + passphrase (again in UTF-8 NFKD) used as the salt.
The iteration count is set to 2048 and HMAC-SHA512 is used as the
pseudo-random function. The length of the derived key is 512 bits (=
64 bytes).</p>
<p>If a passphrase is not present, an empty string &quot;&quot; is used instead.</p>
</blockquote>
<p>When I try to generate a random mnemonic on <a href="https://iancoleman.io/bip39/" rel="nofollow noreferrer">https://iancoleman.io/bip39/</a>, the derived BIP39 seed is the same as when I manually calculate it with <a href="https://stuff.birkenstab.de/pbkdf2/" rel="nofollow noreferrer">https://stuff.birkenstab.de/pbkdf2/</a> using the steps above.</p>

CC BY-SA 4.0
2022-06-30T06:01:27.827Z
2022-06-30T06:01:27.827Z
Vojtěch Strnad
<p>To complement Vojtěch's answer James Chiang explained how the seed is derived from the mnemonic during his TeachBitcoin <a href="https://github.com/teachbitcoin/code-demos" rel="nofollow noreferrer">class</a> in 2019:</p>
<blockquote>
<p>When I generate the seed for my HD wallet I do not go back to the secret entropy. I don’t decode my mnemonic word phrase to obtain the entropy. Instead I join all my words into a sentence, I concatenate a string mnemonic, there is an optional passphrase that you can introduce. Then through the password-based key derivation function 2. What is that? That is basically many (2048) rounds of HMAC-SHA512. That takes as an argument the sentence and as a salt, the mnemonic and the passphrase concatenated. The many rounds are equivalent to a length extension. It makes it more expensive to brute force. Adding more rounds is the equivalent to adding key length if you will. Then we finally end up with a 512 bit seed. This is the seed that we use to derive the rest of our wallet.</p>
</blockquote>
<p><a href="https://i.sstatic.net/bVTOw.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/bVTOw.png" alt="james chiang image" /></a></p>

CC BY-SA 4.0
2022-06-30T08:53:41.183Z
2022-06-30T08:53:41.183Z
Michael Folkson
<p>I made this video to show exactly how it works. Not to teach, but so I could learn myself.</p>
<p><a href="https://youtu.be/lc9ys9PzO0k" rel="nofollow noreferrer">https://youtu.be/lc9ys9PzO0k</a></p>
<p>Basically the bip39 passphrase is a standardized way of submitting a big string of lower case characters and spaces for hashing through a PBKDF2 512 algorithm 2048 times. Your passphrase (25th word)is nothing more than customized salt for this otherwise standard input.  The resulting 512 bit hash will become your bip39 seed which is used to derive all the private and public keys for your wallet.  Watch the video though, a picture is worth 1000 words.</p>

CC BY-SA 4.0
2023-01-13T10:56:54.840Z
While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference.  Link-only answers can become invalid if the linked page changes. - [From Review](/review/late-answers/87737)
RedGrittyBrick
CC BY-SA 4.0
2023-01-17T14:28:06.063Z
Understood. Thank you.
George
CC BY-SA 4.0
2023-01-08T19:54:08.557Z
2023-01-17T14:35:53.843Z
2023-01-17T14:35:53.843Z
George
<p>Im referencing <a href="https://iancoleman.io/bip39/" rel="nofollow noreferrer">https://iancoleman.io/bip39/</a></p>
<p>I understand how the words are generated (&quot;bip39 mnemonic&quot; at the link).  But Im not quite clear on how the words give rise to &quot;bip39 seed&quot; two sections later.</p>
<p>Ive followed a variety of youtubers who demonstrate the calculation in python, but my computations are not coming out the same.  Im not sure why.  Clearly Im missing something about how certain strings/values are being constructed prior to the sha512.</p>

<mnemonic-seed><seed>
Can someone explain *simply*, but precisely, how the mnemonic seed phrase is used to produce the bip39 seed
SquishyRhode
# Can someone explain *simply*, but precisely, how the mnemonic seed phrase is used to produce the bip39 seed

(Asked by: username_0 on 2022-06-30)

Im referencing <https://iancoleman.io/bip39/>

I understand how the words are generated ("bip39 mnemonic" at the link). But Im not quite clear on how the words give rise to "bip39 seed" two sections later.

Ive followed a variety of youtubers who demonstrate the calculation in python, but my computations are not coming out the same. Im not sure why. Clearly Im missing something about how certain strings/values are being constructed prior to the sha512.

**Tags:** mnemonic-seed, seed


---

## 4 answers

### Answer by username_1 on 2022-07-05. Score: 6

These pictures are from [Mastering bitcoin](https://rads.stackoverflow.com/amzn/click/com/1491954388) and were so insightful for me.

How the mnemonic words are generated:
[![enter image description here](https://i.sstatic.net/pII4g.png)](https://i.sstatic.net/pII4g.png)
How they are used to generates master seed of your wallet:
[![enter image description here](https://i.sstatic.net/oyZP4.png)](https://i.sstatic.net/oyZP4.png)


---

### Answer by username_2 on 2022-06-30. Score: 2

From [BIP39](https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki):

> To create a binary seed from the mnemonic, we use the PBKDF2 function
> with a mnemonic sentence (in UTF-8 NFKD) used as the password and the
> string "mnemonic" + passphrase (again in UTF-8 NFKD) used as the salt.
> The iteration count is set to 2048 and HMAC-SHA512 is used as the
> pseudo-random function. The length of the derived key is 512 bits (=
> 64 bytes).
>
> If a passphrase is not present, an empty string "" is used instead.

When I try to generate a random mnemonic on <https://iancoleman.io/bip39/>, the derived BIP39 seed is the same as when I manually calculate it with <https://stuff.birkenstab.de/pbkdf2/> using the steps above.


---

### Answer by username_3 on 2022-06-30. Score: 1

To complement username_2's answer James Chiang explained how the seed is derived from the mnemonic during his TeachBitcoin [class](https://github.com/teachbitcoin/code-demos) in 2019:

> When I generate the seed for my HD wallet I do not go back to the secret entropy. I don’t decode my mnemonic word phrase to obtain the entropy. Instead I join all my words into a sentence, I concatenate a string mnemonic, there is an optional passphrase that you can introduce. Then through the password-based key derivation function 2. What is that? That is basically many (2048) rounds of HMAC-SHA512. That takes as an argument the sentence and as a salt, the mnemonic and the passphrase concatenated. The many rounds are equivalent to a length extension. It makes it more expensive to brute force. Adding more rounds is the equivalent to adding key length if you will. Then we finally end up with a 512 bit seed. This is the seed that we use to derive the rest of our wallet.

[![james chiang image](https://i.sstatic.net/bVTOw.png)](https://i.sstatic.net/bVTOw.png)


---

### Answer by username_4 on 2023-01-08. Score: 0

I made this video to show exactly how it works. Not to teach, but so I could learn myself.

<https://youtu.be/lc9ys9PzO0k>

Basically the bip39 passphrase is a standardized way of submitting a big string of lower case characters and spaces for hashing through a PBKDF2 512 algorithm 2048 times. Your passphrase (25th word)is nothing more than customized salt for this otherwise standard input. The resulting 512 bit hash will become your bip39 seed which is used to derive all the private and public keys for your wallet. Watch the video though, a picture is worth 1000 words.

> **Comments:**
> **username_5**: While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference.  Link-only answers can become invalid if the linked page changes. - [From Review](/review/late-answers/87737)  
> **username_4**: Understood. Thank you.  

---

