Bitcoin Seed Phrases: How 12 Words Secure Your Coins
In January 2021, a programmer named Stefan Thomas told the New York Times he had two guesses left. The password to his encrypted IronKey drive — the one holding the keys to 7,002 BTC he'd earned making an early Bitcoin explainer video in 2011 — was written on a piece of paper he lost years ago. Eight of his ten allowed attempts were spent. The stash was worth roughly $220 million at the time. Nothing was hacked. Nothing was stolen. The coins just sat there, visible on a public ledger, unreachable.
Seed phrases exist so this never happens to you. Twelve ordinary English words, written in order, can restore everything you hold — on any compatible wallet, anywhere on earth. Here's how they actually work, and how to keep yours from becoming a cautionary tale.
What a seed phrase actually is
A seed phrase (or mnemonic) is a human-readable backup of a very large random number. The standard behind it, BIP39, was proposed in 2013 by developers including the founders of Trezor, and nearly every wallet since has adopted it.
The mechanics are simple. Your wallet generates 128 bits of randomness — the entropy that everything else derives from. That number gets split into 11-bit chunks, and each chunk maps to one of exactly 2,048 words on a fixed list. Twelve words encode 128 bits of entropy plus a 4-bit checksum; twenty-four words encode 256 bits. The checksum lives in the final word, which is why a wallet will reject a phrase with a typo instead of silently restoring the wrong one.
The wordlist itself is carefully built: the first four letters of every word are unique, and ambiguous near-pairs were excluded. Your words are not stored on the blockchain and never leave your device. They are simply the recipe for regenerating your keys.
The math that makes 12 words enough
128 bits of entropy means about 340 undecillion possible phrases — 3.4 × 1038. For scale: if you repurposed the entire Bitcoin mining network, hundreds of exahashes per second of specialized hardware, into a seed-guessing machine, working through even a meaningful fraction of that space would take longer than the age of the universe. Many times longer. Nobody is brute-forcing your wallet.
The catch is that the math only holds if the number is truly random. Humans are terrible at random. In 2015, researchers demonstrated automated bots draining "brain wallets" — keys derived from song lyrics, quotes, and clever passphrases — within seconds of funding. Let the wallet generate the phrase. Never compose your own, and never use a phrase a website generated for you.
One backup, every address
Modern wallets are hierarchical deterministic (HD) wallets, defined in BIP32. Your phrase runs through 2,048 rounds of PBKDF2 hashing to produce a 512-bit seed, and from that seed the wallet derives a master key, then an effectively unlimited tree of addresses. Every address you will ever use traces back to those words.
This is why a broken hardware wallet is an inconvenience, not a catastrophe. Your coins don't live on the device — they live on the Bitcoin ledger, and the seed is your claim ticket. Buy a new device, enter the twelve words, and everything reappears. It also cuts the other way: anyone who has your words has your coins, instantly, from anywhere. There is no fraud department to call.
Advanced users can add a passphrase — sometimes called the 25th word — which combines with the seed to produce an entirely different wallet. Powerful, but unforgiving: lose the passphrase and the standard again applies. No passphrase, no coins.
How people actually lose bitcoin
Chainalysis has estimated that between 2.8 and 3.8 million BTC are lost forever — up to nearly a fifth of everything that will ever exist. Almost none of it was cracked. It was misplaced, like James Howells' hard drive holding 7,500 BTC, buried in a Welsh landfill since 2013.
The modern failure modes are mundane. A photo of the phrase in a camera roll that syncs to the cloud. Words pasted into a notes app or password manager that gets breached. A phrase typed into a fake "wallet sync" or "validation" site — no legitimate service will ever ask for your words, full stop. Or the classic: one paper copy, one house fire.
Back yours up like it's the master key — because it is
- Generate the phrase on a real wallet, ideally a hardware wallet with a dedicated random number generator.
- Hand-write two copies. Verify every word, in order, against the screen. No abbreviations.
- Store them in two separate physical locations — different buildings, not different drawers.
- Upgrade to metal. Paper chars; stamped steel survives house-fire temperatures. Jameson Lopp stress-tests metal backup products with fire, crush, and acid — check the results before buying.
- Never digitize it. No photos, no cloud, no email drafts, no typing it into a browser.
- Test the restore. Before moving serious money, wipe the device, recover from your written words, and confirm the addresses match.
Do this once, carefully, and your bitcoin survives dead devices, lost phones, and bankrupt exchanges. Skip it, and you're one accident away from joining the 3.8 million.
Self-custody is the whole point of this thing — money you hold without permission from anyone. If that idea is why you're here, you're already one of us. BitCloset makes heavyweight apparel for people who hold their own keys.