BIP-39 (mnemonic phrase)

BIP-39, Bitcoin Improvement Proposal 39, defines how to turn random entropy into a word phrase that backs up a hierarchical deterministic wallet. The process starts from 128 to 256 bits of entropy: 128 bits give 12 words and 256 bits give 24. A checksum taken from the first bits of the entropy's SHA-256 hash is appended, which is why the last word carries error checking. The wordlist holds 2048 words and each encodes exactly 11 bits. The phrase runs through PBKDF2 with HMAC-SHA512 and 2048 iterations, plus an optional passphrase, to produce a 512-bit seed.

It is the backup and recovery mechanism for the vast majority of non-custodial wallets. A single phrase restores the entire wallet and all its addresses, turning binary keys into something a person can transcribe with built-in error detection. The security point is blunt: whoever holds the phrase holds the funds, so the good practice is to keep it offline and never enter it into websites.

MetaMask, Ledger, Trezor and Trust Wallet use BIP-39, as do nearly all hierarchical wallets. Although it is a Bitcoin standard, its adoption is universal, including on Ethereum. The 512-bit seed it produces feeds the BIP-32 key tree and the BIP-44 derivation path structure. It should not be confused with EIP-191 signing keys, which are the derived keys that later sign messages.