A BIP39 seed phrase generator transforms cryptographic randomness into recovery words which compatible wallets can use, with an optional passphrase, to regenerate the initial seed for a wallet. This page includes a generator and an explanation of word counts, checksums, compatibility, and backup security.
Use the generator for education, software testing, and temporary examples. For real funds, generate recovery words within a trusted wallet, preferably using its secure device workflow. Never input an existing wallet backup into a website, chatbot, or support conversation.
What is a BIP39 seed phrase?
BIP39 stands for Bitcoin Improvement Proposal 39. Its published specification defines a mnemonic format to represent random data in terms of words and a separate procedure to transform the mnemonic into a binary seed. Users commonly refer to the mnemonic as a “seed phrase,” “recovery phrase” or “wallet backup.”
The words themselves do not contain coins. Cryptocurrency remains recorded on its blockchain. A compatible wallet utilizes the backup to reproduce the necessary information required to control associated accounts. A replacement device can restore access if you retain the backup; losing both the device and its backup can make recovery impossible.
A recovery phrase is different than a receiving address. Sharing an address allows someone to send funds; sharing recovery words may give them control over associated accounts. Therefore, treat the full phrase as extremely sensitive information regardless of whether a website describes itself as a “checker” or “recovery” service.
How to use this BIP39 seed phrase generator
- Select a phrase length. The generator offers support for 12, 15, 18, 21 and 24 words.
- Check that nobody can see your screen before revealing the generated words.
- Select Generate phrase. Random bytes are created within your browser, then converted into numbered English words.
- Select Reveal words when you are ready to view the result privately.
- Select Clear phrase when finished. Generating another phrase also replaces the previous result.
Alongside the chosen word count, the interface displays entropy and checksum lengths. These numbers describe the format; they do not verify that your computer is secure. Copying places the test phrase on your clipboard, where other applications or clipboard history may retain it.
The generator never requests an existing phrase. It does not derive private keys, display balances or connect to a wallet. You can explore mnemonic generation without revealing an operational backup.
12 vs 24 words: how the lengths compare
BIP39 allows for five unique combinations of entropy and checksum length. Entropy refers to the original random data; the checksum includes additional error-detecting data. Both contribute to determining the number of words.
| Words | Entropy bits | Checksum bits | Combined bits |
|---|---|---|---|
| 12 | 128 | 4 | 132 |
| 15 | 160 | 5 | 165 |
| 18 | 192 | 6 | 198 |
| 21 | 224 | 7 | 231 |
| 24 | 256 | 8 | 264 |
A properly generated 12-word phrase has 2128 possible entropy values. A 24-word phrase encodes more randomness, but extra words cannot compensate for malware, predictable generation or stolen backups. Storage and recovery deserve as much consideration as the number of words.
Use a format supported by the wallet you plan to use. Avoid appending words to an existing (shorter) backup, removing words from an existing (longer) backup, or assuming that each recovery mechanism employs BIP39.
How BIP39 generation works
For a 12-word mnemonic, the generator needs 16 bytes of randomness, representing 128 bits. It hashes those bytes using SHA-256 and selects the first four hash bits as a checksum. Adding that checksum creates 132 bits.
Divide the combined data into segments of 11 bits next. Each segment corresponds to an entry in the official 2,048-word English list, using an index ranging from zero through 2,047. Twelve segments correspond to twelve words. The same methodology applies for each of the remaining supported lengths.
Therefore, selecting twelve words does not mean choosing a valid mnemonic. The last word is comprised of both checksum data and entropy bits; therefore it relies upon prior data. The order matters: changing it changes the represented data.
Checksums detect some errors; yet it will not protect against each possible transcription error. An incorrect phrase may validate via checksum verification and yet remain an incorrect backup. All elements of correct words, correct order, and proper configuration within a wallet affect successful recovery.
Where the randomness comes from
The source of randomness for this implementation is the browser’s crypto.getRandomValues() method. According to MDN, this method provides cryptographically strong random values. It uses the browser’s cryptographic capabilities, rather than timestamps, mouse movements, memorable sentences, or JavaScript’s general-purpose Math.random().
Web Crypto is utilized to perform SHA-256. The application will refuse to provide phrases unless the necessary cryptographic functions are accessible. Before generation, a self-check compares mnemonic conversion with a known, publicly disclosed example. These choices address particular programming risks. They do not imply trustworthiness in the browser, operating system, downloaded file or hosting environment. See the Web Cryptography specification for application security considerations.
Does the generator work offline?
The standalone HTML includes its own word list, styles, and generator code. No other libraries or word list requests are needed for the creation of a phrase. Provided that the browser has Web Crypto enabled for locally accessed files, the downloaded webpage can operate without connecting to the internet.
The code does not send phrases to a server or save them in cookies, local storage or a database. Generated words remain in page memory until cleared, replaced, or closed. Hiding the words only obscures their display; it does not erase them from memory.
Disabling a network connection does not eliminate potential malware present on a machine. Browser extensions, screen shot utilities and software compromised by malware can continue to compromise sensitive information. Erasing the interface does not ensure all memory copies have been deleted. Consider these limitations when deciding where to create a wallet.
Seed phrase, passphrase and private key
These terms refer to distinct elements of the process. The mnemonic refers to the ordered word list. An optional BIP39 passphrase is additional text that is incorporated into seed derivation. Then the derived seed is used by a wallet to derive keys, via a hierarchical method like BIP32.
Normalization of text is included in the specification. This page generates only the mnemonic phrase; it does not include functionality for entering a passphrase or deriving a binary seed.
Different passphrases generate different seeds. There is no generic “wrong” message that identifies which wallet you meant to restore. A typo may open a different, apparently empty wallet. Plan passphrase recovery deliberately, following your wallet manufacturer’s guidance.
The label “25th word” can be misleading. A passphrase need not come from the BIP39 dictionary; it is not another word appended to the mnemonic.
Will the words work with every wallet?
No. A BIP39 compliant mnemonic phrase meets one format requirement, but recovery is dependent upon the target wallet having implemented this format correctly along with conforming to applicable account conventions. Network type, address types, derivation path and passphrase configurations can influence which accounts are restored following recovery.
Alternative formats for backup are possible. For example, Trezor documents both BIP39 style backups and SLIP39 style backups that include alternative word counts for backups. A 20-word backup is not an incomplete 24-word BIP39 backup.
For tests, consult the receiving software’s documentation before importing disposable words. Prior to relying on a backup for an existing wallet, use only the official recovery procedures provided by your wallet vendor. If an account appears empty post-recovery, research compatibility and settings privately versus posting your back up to online diagnostic sites.
How to protect a real recovery phrase
Keep the backup offline, away from cameras and unauthorized access. Verify it using your wallet manufacturer’s recommended procedure.
Avoid photographs, email drafts, cloud notes and shared documents. Trezors wallet backup guide warns against using digital copies of recovery words. When selecting a physical storage location consider theft, loss due to fire/water damage, etc.
Never use example phrases from articles, videos or software tests to hold funds. Example phrases are public credentials. Do not send a complete backup to somebody offering support or verification. Anyone asking you to send your entire backup may be trying to steal your recovery phrase.
If you believe your backup has been compromised, contact your wallet vendor and follow their instructions for how best to create a new wallet and move your funds securely. Changing your app password or device PIN does not replace the underlying recovery phrase.
For an actual backup plan determine who would be able to restore your backup in the event you become unable to recover it yourself. Explain the storage arrangements without revealing your actual words in an ordinary email or shared document. Review the storage arrangements whenever there are significant changes in devices, locations or family status.
What developers should verify
A generator needs more than plausible-looking output. Compare entropy-to-mnemonic conversion against the reference implementation’s test vectors. Check every supported length, preserve leading zero bits and use the exact word-list order. Include rejection tests for unsupported lengths and unavailable cryptographic APIs.
Reverse conversion should recover the original entropy and reject invalid checksums. These checks establish format correctness, while random-number generation needs separate review. Repeatedly generating different phrases is useful as a smoke test, but it does not prove unpredictability.
Review the surrounding page too. Third-party scripts, analytics, error reporting and clipboard features may create exposure beyond the conversion function. Before integrating this tool into a publishing platform, review the actual deployed page and its dependencies. A publishing plugin can change the security assumptions of an otherwise self-contained file.
A practical testing workflow without funds
Suppose you are building a wallet onboarding tutorial. Generate a disposable phrase here, inspect the numbered order and use it only in an isolated development environment. Label screenshots as demonstrations. Never invite readers to deposit cryptocurrency into an example account, even if the account initially appears empty.
For repeatable automated tests, use published test vectors instead of generating fresh randomness. Fixed inputs make failures easier to reproduce. Random generation belongs in separate tests that exercise the browser integration. Keep the two purposes distinct so a known testing phrase cannot accidentally become a production wallet backup.
Before sharing a tutorial, search its text, screenshots and sample configuration for credentials. A phrase invented for documentation is still sensitive if someone later funds its accounts. Clear labels reduce confusion, but the strongest safeguard is keeping demonstration accounts disconnected from real financial activity.
Frequently asked questions
Can I choose my own recovery words?
Avoid human-selected phrases. Familiar quotations and personally meaningful combinations are predictable. Let a trusted wallet generate its backup using an appropriate cryptographic random source.
Can a BIP39 phrase contain repeated words?
Yes. Repeated words can occur in valid mnemonics. Repetition alone does not indicate an error; validity depends on the full ordered phrase and its checksum.
Can this generator recover a missing wallet?
No. It creates new disposable mnemonics. It cannot reconstruct lost words, identify your wallet, recover a forgotten passphrase or reverse a receiving address into a backup.
Is a valid checksum proof that a phrase is safe?
No. Validation checks the encoding, not secrecy, randomness or ownership. A publicly known phrase can have a valid checksum and still be completely unsafe for holding assets.
Should I translate my recovery words?
No. Word lists are part of the encoding. Translating individual words does not reliably preserve the underlying mnemonic. Record the original words exactly and follow your wallet’s documented language support when restoring a backup.
Why are generated words hidden initially?
Deliberate reveal reduces casual exposure to someone nearby. It does not encrypt the phrase or protect a compromised computer. The tool also hides visible words when the tab loses visibility, and clears its current phrase after five minutes.