Seed phrase

The standard is BIP-39, "Mnemonic code for generating deterministic keys". It uses a dictionary of exactly 2048 words (2 to the power of 11), so each word represents 11 bits, and each word is uniquely identified by its first four letters to reduce transcription errors. Generation starts from 128 to 256 bits of entropy, adds a checksum (the first N/32 bits of the SHA-256 of the entropy), concatenates both and splits the result into groups of 11 bits that index each word. This produces the valid lengths of 12, 15, 18, 21 or 24 words. The phrase then derives a seed via PBKDF2 (2048 iterations of HMAC-SHA512), which feeds the BIP-32 hierarchical tree and the BIP-44 derivation paths.

A seed phrase lets you back up and recover an entire wallet with a single list of words, instead of managing dozens of private keys separately. That is both its greatest strength and its single point of critical failure: whoever obtains the phrase obtains all derived funds, and whoever loses it loses access irreversibly. Good practice is therefore to store it offline and in duplicate. BIP-39 also supports an optional passphrase (the so-called "13th or 25th word") that creates separate hidden wallets from the same word list.

Ledger, Trezor, MetaMask, Trust Wallet and Phantom all generate and restore from BIP-39 phrases of 12 or 24 words. The standard was proposed in 2013 by Marek Palatinus, Pavol Rusnak, Aaron Voisine and Sean Bowe, and is now the industry de facto. Social-recovery wallets such as Argent avoid exposing the user to the 24 words by relying on account abstraction and guardians, an alternative that reduces the fragility of a single backup.