<blockquote>
  <p>Is it possible to convert back and forth between say, for instance, a 24-word phrase to a 12-word phrase, and what tools can I use to make the conversion?</p>
</blockquote>

<p>No, that is not possible. The mnemonic words represent an entropy, for example the 24 word mnemonic phrase represents 256 bits of entropy while a 12 word mnemonic represents 128 bits of entropy. These mnemonic words are passed to a PBKDF2 function to generate a seed that will then be used to generate master keys for different tokens. It's also important to note that if you use a passphrase to your wallet, that passphrase will be used as a 'salt' in the PBKDF2 function and will generate a completely different seed, had you not used a passphrase. </p>

<blockquote>
  <p>To my understanding, I could use the same mnemonic phrase in all wallets, even if some assets are not listed, if that's true I wouldn't have to store a different list of words for each wallet</p>
</blockquote>

<p>Care has to be while doing that as many wallets use different paths of master key generation. If you use multiple wallets interchangeably, try to note the derivation path. For example, say hardware wallet A uses m/49'/0'/0' as the path, it will generate completely different addresses as compared to a wallet that will use a m/44'/0'/0' derivation. </p>

CC BY-SA 4.0
2019-07-31T10:24:44.137Z
2019-07-31T10:35:02.760Z
2019-07-31T10:35:02.760Z
Ugam Kamat
<p>I've asked myself similar questions which lead to learning more about mnemonics
with Bitcoin, and like many other (not all) cryptocurrencies, which use <a href="https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki" rel="nofollow noreferrer">BIP39</a> which is a specification based on a unique wordlist of 2048 words (zero-indexed from 0-2047) available in various languages (although I should note that you cannot translate words across supported languages as they don't hold the same index values across languages for a given mnemonic, in terms of one &quot;conversion&quot; method you might be implying).</p>
<ul>
<li>The purpose of BIP39 is to create a mnemonic that is human-readable
(easy to write, recite, read, etc..) compared to the underlying
binary data that the mnemonic represents which is machine-readable
(zeroes and ones, which can be represented in hex format or other
notation/base numbers) but is not easy to write/recite and thus BIP39
solves that problem, however, understanding what is happening
underneath the surface is key for dealing with mnemonics and taking
control of your crypto security.</li>
</ul>
<p><strong>About mnemonics:</strong> Underlying every mnemonic is a very large random number and a checksum that gets added to the end, which is why you cannot just choose your own 12 or 24 words, as a portion of the last word is computed based on this checksum (more on that below).</p>
<p>For example, in BIP39 the wordlist corresponds to the range of 2^11 power (i.e. 2048) and the reason why the mnemonic ends up being 12 or 24 words depends on the desired security in terms of bits, depending on whether it is 128 bits or 256 bits.</p>
<p>So when you click to create a BIP39-compliant wallet there should be a cryptographically-secure pseudo-random number generator (CSPRNG) such as the WorldWideWide Consortium (W3C) Cryptography API for web-based wallets (note: I am a contributor to that spec on Github) running locally that gathers various bits of randomness from your local device in a way that would make it difficult for an attacker to replicate or predict, and then those bits are used as the initial entropy (to create the mnemonic).</p>
<ul>
<li><p>In other words, for a 24-word mnemonic, the device would produce 256
bits and would convert that string to a byte array and hash it using
SHA256, which results in another 256-bit output of which the leading
8 bits are taken and appended to the end of the initial entropy
making it 264-bits long.</p>
<p>If you divide 264 bits by 11-bits per word, the resulting 24 groups
of 11-bits each correspond to the same 11-bit index value of where
each word is on the list (where 0 = 00000000000 and 2047 =
11111111111). So with each word corresponding to an 11-bit number in
the resulting mnemonic. The words are just an easy way to find the
11-bit number, to recreate the initial entropy+checksum to derive the
wallet.</p>
</li>
</ul>
<p><strong>In terms of converting:</strong>
It is not recommended to choose your own words, firstly because that selection process could have some bias that would reduce the resulting security of the mnemonic compared to a randomly generated one, and secondly because the checksum must be computed deterministically (so if you cut your 24-words in half and used the first 12 in another wallet, there is a very low chance it would be checksum-compliant (1/16 chance), whereas choosing your own 24-words would be even more unlikely to be checksum complaint (1/256 chance).</p>
<ul>
<li>Therefore, it is best not to choose your own words or slice your
mnemonic, but rather use trusted software in a cold-storage
environment (offline) for maximum security.</li>
</ul>
<p><strong>Entropy:</strong> The same applies for choosing your own entropy, in terms of it being best to leave it to trusted software. Although, others in the industry have given some examples of flipping a coin 128 times and writing a 1 for every heads and 0 for every tails, which is a way to manually create 128-bits of entropy for a wallet (where the wallet would compute the 4-bit checksum) provided the coin flip process is random (i.e. no one-side weighted coin).</p>
<ul>
<li>However, many wallets don't allow you to paste entropy, and only
allow a mnemonic to be imported or to be generated on the fly.</li>
</ul>
<p>There is a <a href="https://iancoleman.io/bip39/" rel="nofollow noreferrer">mnemonic converter tool</a> (<strong>note</strong>: I am a contributor to it on Github) with advanced features that can accept entropy to create a mnemonic of various lengths but I wouldn't suggest this for someone that just started or even for those with years of experience unless you are fluent with the BIP39 specification, as well as BIP44 and BIP32, and all the countless ways that one tiny mistake can lead to an irreversible loss of funds.</p>
<p><strong>Regarding the question of converting</strong>: While I am not sure exactly what you meant by &quot;converting&quot; assuming that you meant slicing a 24 mnemonic in half to use just the first 12 words, I have explained above why that isn't a viable option, unless the 12 words end up being checksum-compliant. (some software can scan through valid 24-word mnemonics to find one that is also checksum-complaint when using only the first 12-words, but the last 12 words would likely not be checksum-compliant as there would be a 1/256 chance for both the first 12 AND last 12 to be).</p>
<ul>
<li>Such mnemonics exist but are hard to find/create while maintaining
the desired level of security in terms of bits (reducing a mnemonic
by one word reduces its security by half, thus a 12-word mnemonic
doesn't have half the security of a 24-word mnemonic but instead has
security equal to just the square root of a 24-word mnemonic, where
2^128*2^128 == 2^256. <strong>Note:</strong> I have written a similar program that
finds <a href="https://bcaventures.com/reversible-mnemonic.html" rel="nofollow noreferrer">valid reversible palindromic mnemonic</a>s that are checksum
compliant in terms of BIP39, but only for education purposes.</li>
</ul>
<p><strong>Regarding using same mnemonic in all wallets:</strong> If a wallet is compatible with BIP39, there is a good chance it is also compatible with BIP44 to support multiple-account/coins which means that so long as the correct derivation path has been added to support by the developers of that wallet, that cryptocurrency will be supported and can be used with your existing mnemonic (but not if they use a different wordlist, like Monero, for example, which is not BIP39 compatible). This is why I like to think of mnemonics as crypto vaults, not wallets (as one mnemonic can contain multiple cryptocurrencies accounts that each contains multiple wallets, see HD wallets to learn more about that based on BIP32).</p>
<ul>
<li>While having all your crypto assets consolidated on one mnemonic
could be convenient, it also concentrates the risk in terms of the
custody responsible to manage that mnemonic, whereas, having multiple
mnemonics with multiple cryptocurrencies across each adds the burden
of more crypto vaults to manage but reduces the risk in case one is
compromised (I would argue most savvy crypto investors have multiple,
as one or more could be used for hot-wallets that are on
internet-connected devices, whereas, other mnemonics used for
cold-storage are on hardware wallets or devices that never connect
online.</li>
</ul>
<p><strong>Takeaway:</strong> it is best to use the software provided by the underlying token/cryptocurrency project as some projects use a different wordlist, and/or other differences that could render the mnemonic incompatible and lead to a permanent loss of funds, or other inconveniences such as if the same mnemonic could derive different addresses that don't match across software even with the same derivation path chosen if the root seed or other steps diverge for unknown reasons (and such troubleshooting is very technical to find a potential bug).</p>
<p><strong>Example technical data for a randomly-generated mnemonic (don't use this with real funds):</strong></p>
<p>Initial entropy of 128 bits in hex format:</p>
<p><code>659b8a03bfbb80cdcdc3c383d4b0d505</code></p>
<p>Entropy as bytes:</p>
<p><code>bytearray(b'e\x9b\x8a\x03\xbf\xbb\x80\xcd\xcd\xc3\xc3\x83\xd4\xb0\xd5\x05')</code></p>
<p>SHA-256 hash digest of entropy bytes, in hex format:</p>
<p><code>c993b627272ef0cbc683ce275cf47ff82f73403ece8155bdd92c2dca2d86e3b1</code></p>
<p>Partial fragment of initial &quot;byte&quot; of hash representing first 4 bits:</p>
<p><code>c</code></p>
<p>First n bits of hash to convert to hex:
<code>c</code></p>
<p>Checksum (hex to bits):</p>
<p><code>1100</code></p>
<p>Initial entropy + checksum = total bits:</p>
<p><code>011001011001101110001010000000111011111110111011100000001100110111001101110000111100001110000011110101001011000011010101000001011100</code></p>
<p>Length of total bits:</p>
<p><code>132</code></p>
<p>Divided into 12 groups of 11 bits:</p>
<p><code>['01100101100', '11011100010', '10000000111', '01111111011', '10111000000', '01100110111', '00110111000', '01111000011', '10000011110', '10100101100', '00110101010', '00001011100']</code></p>
<p>Corresponding index values for each group (in base 10):</p>
<p><code>[812, 1762, 1031, 1019, 1472, 823, 440, 963, 1054, 1324, 426, 92]</code></p>
<p>Corresponding mnemonic:</p>
<p><code>grain sword liberty legal retreat group damage journey long pitch crystal argue</code></p>
<hr />

CC BY-SA 4.0
2019-07-31T14:12:16.117Z
I wanted to have a converter that I could use to have access to the same assets in two different wallets with different mnemonic phrase word count so that I cold just store either the 12-word phrase or the 24-word phrase and use it to restore either wallet with the same HD account. But it seems it's not posible from what you said.
rraallvv
CC BY-SA 4.0
2019-07-31T16:01:11.053Z
Right, it is not possible as there are no collission, as there are only 2048^12 possible 12 word mnemonics of which only 2^128 are valid due to the checksum requirement (and 2048^24 possible 24-word ones with only 2^256 that have valid checksum), and every single one of these theoretically-possible mnemonics including the invalid ones each have a distinct underlying entropy and there is no direct relation from one mnemonic to another, as changing just one bit will have a waterfall effect and change all the words.
Steven Hatzakis
CC BY-SA 4.0
2019-07-31T13:11:55.390Z
2022-10-28T18:15:09.860Z
2022-10-28T18:15:09.860Z
Steven Hatzakis
<p>I'm relatively new to cryptocurrencies in general and I've tried using Bitcoin and a few altcoins, but it always bothers me that some digital assets are not available in all wallets. To my understanding, I could use the same mnemonic phrase in all wallets, even if some assets are not listed, if that's true I wouldn't have to store a different list of words for each wallet. The only problem is that most popular wallets support a different numbers of words in the mnemonic phrase. Is it possible to convert back and forth between say, for instance, a 24-word phrase to a 12-word phrase, and what tools can I use to make the conversion?</p>

CC BY-SA 4.0
2019-07-31T10:42:00.143Z
You'll find the technical details how those words map to a key in the [BIP39](https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki) spec. It's in theory possible that there are two sentences that generate the same key but being able to find such a (HMAC-SHA512) collision would be a huge issue for cryptography in general (https://crypto.stackexchange.com/questions/3049/are-there-any-known-collisions-for-the-sha-1-2-family-of-hash-functions) Though you might earn something similar to a nobel price if you find a way :)
zapl
<wallet><altcoin><mnemonic-seed>
How convert a mnemonic phrase back and forth between different number of words?
rraallvv
# How convert a mnemonic phrase back and forth between different number of words?

(Asked by: username_0 on 2019-07-31)

I'm relatively new to cryptocurrencies in general and I've tried using Bitcoin and a few altcoins, but it always bothers me that some digital assets are not available in all wallets. To my understanding, I could use the same mnemonic phrase in all wallets, even if some assets are not listed, if that's true I wouldn't have to store a different list of words for each wallet. The only problem is that most popular wallets support a different numbers of words in the mnemonic phrase. Is it possible to convert back and forth between say, for instance, a 24-word phrase to a 12-word phrase, and what tools can I use to make the conversion?

**Tags:** wallet, altcoin, mnemonic-seed

> **Comments:**
> **username_1**: You'll find the technical details how those words map to a key in the [BIP39](https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki) spec. It's in theory possible that there are two sentences that generate the same key but being able to find such a (HMAC-SHA512) collision would be a huge issue for cryptography in general (https://crypto.stackexchange.com/questions/3049/are-there-any-known-collisions-for-the-sha-1-2-family-of-hash-functions) Though you might earn something similar to a nobel price if you find a way :)  

---

## 2 answers

### Answer by username_2 on 2019-07-31. Score: 4

> Is it possible to convert back and forth between say, for instance, a 24-word phrase to a 12-word phrase, and what tools can I use to make the conversion?

No, that is not possible. The mnemonic words represent an entropy, for example the 24 word mnemonic phrase represents 256 bits of entropy while a 12 word mnemonic represents 128 bits of entropy. These mnemonic words are passed to a PBKDF2 function to generate a seed that will then be used to generate master keys for different tokens. It's also important to note that if you use a passphrase to your wallet, that passphrase will be used as a 'salt' in the PBKDF2 function and will generate a completely different seed, had you not used a passphrase.

> To my understanding, I could use the same mnemonic phrase in all wallets, even if some assets are not listed, if that's true I wouldn't have to store a different list of words for each wallet

Care has to be while doing that as many wallets use different paths of master key generation. If you use multiple wallets interchangeably, try to note the derivation path. For example, say hardware wallet A uses m/49'/0'/0' as the path, it will generate completely different addresses as compared to a wallet that will use a m/44'/0'/0' derivation.


---

### Answer by username_3 on 2019-07-31. Score: 2

I've asked myself similar questions which lead to learning more about mnemonics
with Bitcoin, and like many other (not all) cryptocurrencies, which use [BIP39](https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki) which is a specification based on a unique wordlist of 2048 words (zero-indexed from 0-2047) available in various languages (although I should note that you cannot translate words across supported languages as they don't hold the same index values across languages for a given mnemonic, in terms of one "conversion" method you might be implying).

* The purpose of BIP39 is to create a mnemonic that is human-readable
  (easy to write, recite, read, etc..) compared to the underlying
  binary data that the mnemonic represents which is machine-readable
  (zeroes and ones, which can be represented in hex format or other
  notation/base numbers) but is not easy to write/recite and thus BIP39
  solves that problem, however, understanding what is happening
  underneath the surface is key for dealing with mnemonics and taking
  control of your crypto security.

**About mnemonics:** Underlying every mnemonic is a very large random number and a checksum that gets added to the end, which is why you cannot just choose your own 12 or 24 words, as a portion of the last word is computed based on this checksum (more on that below).

For example, in BIP39 the wordlist corresponds to the range of 2^11 power (i.e. 2048) and the reason why the mnemonic ends up being 12 or 24 words depends on the desired security in terms of bits, depending on whether it is 128 bits or 256 bits.

So when you click to create a BIP39-compliant wallet there should be a cryptographically-secure pseudo-random number generator (CSPRNG) such as the WorldWideWide Consortium (W3C) Cryptography API for web-based wallets (note: I am a contributor to that spec on Github) running locally that gathers various bits of randomness from your local device in a way that would make it difficult for an attacker to replicate or predict, and then those bits are used as the initial entropy (to create the mnemonic).

* In other words, for a 24-word mnemonic, the device would produce 256
  bits and would convert that string to a byte array and hash it using
  SHA256, which results in another 256-bit output of which the leading
  8 bits are taken and appended to the end of the initial entropy
  making it 264-bits long.

  If you divide 264 bits by 11-bits per word, the resulting 24 groups
  of 11-bits each correspond to the same 11-bit index value of where
  each word is on the list (where 0 = 00000000000 and 2047 =
  11111111111). So with each word corresponding to an 11-bit number in
  the resulting mnemonic. The words are just an easy way to find the
  11-bit number, to recreate the initial entropy+checksum to derive the
  wallet.

**In terms of converting:**
It is not recommended to choose your own words, firstly because that selection process could have some bias that would reduce the resulting security of the mnemonic compared to a randomly generated one, and secondly because the checksum must be computed deterministically (so if you cut your 24-words in half and used the first 12 in another wallet, there is a very low chance it would be checksum-compliant (1/16 chance), whereas choosing your own 24-words would be even more unlikely to be checksum complaint (1/256 chance).

* Therefore, it is best not to choose your own words or slice your
  mnemonic, but rather use trusted software in a cold-storage
  environment (offline) for maximum security.

**Entropy:** The same applies for choosing your own entropy, in terms of it being best to leave it to trusted software. Although, others in the industry have given some examples of flipping a coin 128 times and writing a 1 for every heads and 0 for every tails, which is a way to manually create 128-bits of entropy for a wallet (where the wallet would compute the 4-bit checksum) provided the coin flip process is random (i.e. no one-side weighted coin).

* However, many wallets don't allow you to paste entropy, and only
  allow a mnemonic to be imported or to be generated on the fly.

There is a [mnemonic converter tool](https://iancoleman.io/bip39/) (**note**: I am a contributor to it on Github) with advanced features that can accept entropy to create a mnemonic of various lengths but I wouldn't suggest this for someone that just started or even for those with years of experience unless you are fluent with the BIP39 specification, as well as BIP44 and BIP32, and all the countless ways that one tiny mistake can lead to an irreversible loss of funds.

**Regarding the question of converting**: While I am not sure exactly what you meant by "converting" assuming that you meant slicing a 24 mnemonic in half to use just the first 12 words, I have explained above why that isn't a viable option, unless the 12 words end up being checksum-compliant. (some software can scan through valid 24-word mnemonics to find one that is also checksum-complaint when using only the first 12-words, but the last 12 words would likely not be checksum-compliant as there would be a 1/256 chance for both the first 12 AND last 12 to be).

* Such mnemonics exist but are hard to find/create while maintaining
  the desired level of security in terms of bits (reducing a mnemonic
  by one word reduces its security by half, thus a 12-word mnemonic
  doesn't have half the security of a 24-word mnemonic but instead has
  security equal to just the square root of a 24-word mnemonic, where
  2^128\*2^128 == 2^256. **Note:** I have written a similar program that
  finds [valid reversible palindromic mnemonic](https://bcaventures.com/reversible-mnemonic.html)s that are checksum
  compliant in terms of BIP39, but only for education purposes.

**Regarding using same mnemonic in all wallets:** If a wallet is compatible with BIP39, there is a good chance it is also compatible with BIP44 to support multiple-account/coins which means that so long as the correct derivation path has been added to support by the developers of that wallet, that cryptocurrency will be supported and can be used with your existing mnemonic (but not if they use a different wordlist, like Monero, for example, which is not BIP39 compatible). This is why I like to think of mnemonics as crypto vaults, not wallets (as one mnemonic can contain multiple cryptocurrencies accounts that each contains multiple wallets, see HD wallets to learn more about that based on BIP32).

* While having all your crypto assets consolidated on one mnemonic
  could be convenient, it also concentrates the risk in terms of the
  custody responsible to manage that mnemonic, whereas, having multiple
  mnemonics with multiple cryptocurrencies across each adds the burden
  of more crypto vaults to manage but reduces the risk in case one is
  compromised (I would argue most savvy crypto investors have multiple,
  as one or more could be used for hot-wallets that are on
  internet-connected devices, whereas, other mnemonics used for
  cold-storage are on hardware wallets or devices that never connect
  online.

**Takeaway:** it is best to use the software provided by the underlying token/cryptocurrency project as some projects use a different wordlist, and/or other differences that could render the mnemonic incompatible and lead to a permanent loss of funds, or other inconveniences such as if the same mnemonic could derive different addresses that don't match across software even with the same derivation path chosen if the root seed or other steps diverge for unknown reasons (and such troubleshooting is very technical to find a potential bug).

**Example technical data for a randomly-generated mnemonic (don't use this with real funds):**

Initial entropy of 128 bits in hex format:

`659b8a03bfbb80cdcdc3c383d4b0d505`

Entropy as bytes:

`bytearray(b'e\x9b\x8a\x03\xbf\xbb\x80\xcd\xcd\xc3\xc3\x83\xd4\xb0\xd5\x05')`

SHA-256 hash digest of entropy bytes, in hex format:

`c993b627272ef0cbc683ce275cf47ff82f73403ece8155bdd92c2dca2d86e3b1`

Partial fragment of initial "byte" of hash representing first 4 bits:

`c`

First n bits of hash to convert to hex:
`c`

Checksum (hex to bits):

`1100`

Initial entropy + checksum = total bits:

`011001011001101110001010000000111011111110111011100000001100110111001101110000111100001110000011110101001011000011010101000001011100`

Length of total bits:

`132`

Divided into 12 groups of 11 bits:

`['01100101100', '11011100010', '10000000111', '01111111011', '10111000000', '01100110111', '00110111000', '01111000011', '10000011110', '10100101100', '00110101010', '00001011100']`

Corresponding index values for each group (in base 10):

`[812, 1762, 1031, 1019, 1472, 823, 440, 963, 1054, 1324, 426, 92]`

Corresponding mnemonic:

`grain sword liberty legal retreat group damage journey long pitch crystal argue`

---

> **Comments:**
> **username_0**: I wanted to have a converter that I could use to have access to the same assets in two different wallets with different mnemonic phrase word count so that I cold just store either the 12-word phrase or the 24-word phrase and use it to restore either wallet with the same HD account. But it seems it's not posible from what you said.  
> **username_3**: Right, it is not possible as there are no collission, as there are only 2048^12 possible 12 word mnemonics of which only 2^128 are valid due to the checksum requirement (and 2048^24 possible 24-word ones with only 2^256 that have valid checksum), and every single one of these theoretically-possible mnemonics including the invalid ones each have a distinct underlying entropy and there is no direct relation from one mnemonic to another, as changing just one bit will have a waterfall effect and change all the words.  

---

