Seed Phrase Explained: Backup, Risk and Recovery

What a seed phrase really is

Your Bitcoin do not sit inside the wallet. They are entries in the Bitcoin blockchain, and the wallet is the tool you use to prove that you are allowed to spend particular entries. That proof runs on private keys. How a wallet handles them is covered in the overview of wallet basics.

Modern wallets do not generate those keys one by one at random. They derive all of them from a single starting value. The method is called a hierarchical deterministic wallet and is described in BIP-32: one seed produces an entire tree of key pairs. Deterministic means the same starting value always produces exactly the same keys, on any device and at any time.

The seed phrase is the human readable form of that starting value. BIP-39 describes it as a mnemonic code, a sequence of words that is far easier to write down or read aloud than a long string of digits. That is the whole reason it is words rather than 64 characters of hexadecimal.

Where the 12 or 24 words come from

It starts with randomness, not with language. The wallet generates a random number, between 128 and 256 bits long under the standard. Only then are the words derived from it, never the other way round. A phrase you invent yourself is therefore not a seed phrase, only a badly chosen password.

Getting from the number to the words takes three steps. A short checksum, taken from the SHA256 hash of the random number, is appended to it. The result is split into blocks of eleven bits. Each block yields a number between 0 and 2047, which points at exactly one word in a fixed list of 2048 entries.

• The English list is sorted and built so that the first four letters already identify a word unambiguously. That is why many wallets autocomplete as you type.
• Similar word pairs were deliberately avoided so that words are less likely to be confused when copied by hand.
• The order is part of the information. The same words in a different order produce a different wallet.

The checksum is also the reason a wallet usually flags a typo immediately instead of quietly opening somebody else’s empty wallet. It is not something to lean on, though: the check is deliberately short and does not catch every mistake.

12 or 24 words: the practical difference

The number of words follows directly from the length of the random number: 128 bits plus a four bit checksum give 12 words, 256 bits plus an eight bit checksum give 24. The standard also knows 15, 18 and 21 words, but in practice you will almost only meet the two ends.

On paper the longer version is the stronger one. In practice it changes little, because even 128 bits produces a space that cannot be worked through with today’s technology. The weak point therefore sits less with computing power than with the note itself: misplaced, unreadable, water damaged, lost in a house move, or seen by the wrong person.

What happens during a recovery

Recovering is not downloading. When you type your words into a new wallet, this chain runs in the background:

• The wallet verifies the checksum and tells you if the phrase cannot be right.
• From the phrase it computes the actual seed, a 512 bit number.
• From that seed it derives the key tree and from the tree your addresses.
• Only then does it ask the network what amounts sit on those addresses.

So your balance does not come out of the backup. It comes out of the blockchain. The backup only supplies the keys that tell the wallet what to look for. That is exactly why a recovery still works when the old device has been destroyed, sold or wiped.

Austria’s financial market authority, the FMA, states the flip side plainly: anyone holding crypto assets themselves keeps full control over their holdings but also carries the entire responsibility for the access credentials. If those are lost or fall into the wrong hands, access as a rule cannot be restored. Anyone unwilling to carry that responsibility can instead leave custody to a regulated provider, which since the EU’s MiCAR regulation has to meet defined requirements on security, organisation and risk management. Self-custody is a deliberate choice, not a default.

For most people the seed phrase matters for the first time on the day their first Bitcoin leave an exchange for a wallet of their own. The buying step before that is covered in how to buy Bitcoin in Austria.

When the right words still show a zero balance

This is a moment that frightens people. The words are accepted, the wallet opens, and the balance reads zero. Often nothing is lost. The wallet is looking in a different part of the key tree. Three causes come up especially often.

The reason is the same each time: the wallet is searching a different key tree from the one your addresses live in. With a derivation path it is the same root at a different position; with a passphrase or a different language list the seed itself changes, so the whole tree is a different one. For the widely used addresses, the ones starting with bc1q, that position is m/84'/0'/0' under BIP-84. The specification names it explicitly as intended behaviour that a wallet using a different path does not discover those accounts at all.

So the calm first step is not to retype the words. It is to remember which wallet created the backup. That single detail usually already answers which of the three cases applies.

What a seed phrase does not do

Three expectations of a backup regularly go too far.

• It does not correct errors. The checksum is short. The specification itself notes that roughly one in 256 random errors goes unnoticed, and that it explicitly offers no help in correcting them. A word copied down wrongly can slip through.
• It does not replace a second backup. One note in one place is a single point of failure, against fire, water and moving house alike.
• It does not stop anyone from reading it. Whoever sees the words can rebuild the wallet on their own device. Nobody needs your seed phrase in order to send you Bitcoin. Anyone who asks for it should be treated as a risk, no matter how legitimate the request looks.

Three things that belong next to the words

Many guides stop at the words. In practice a recovery rarely fails on the phrase itself. It fails on the missing context around it. These three details decide whether a backup turns back into a working wallet when it matters.

On their own these three details reveal nothing about your holdings, so they may be kept separately from the words. They cost five minutes and spare you the question, in an emergency, of whether the money is gone or merely the path is wrong.