The word list encodes entropy plus a checksum (BIP39). The checksum is why a single wrong or misordered word makes the whole phrase invalid rather than silently opening someone else's wallet.
An optional passphrase is mixed in during seed derivation. It creates a completely separate wallet: forgetting it is identical to losing the words, and there is no reset.
Verify recovery before funding: restore the backup into a fresh wallet instance and confirm the first receive address matches. An untested backup is a guess, not a backup.
Explain more simply
When a wallet is created it shows a list of words. Those words are a human-readable form of the master secret.
Write them on paper, in order, and keep them offline. Anyone who reads them can spend your bitcoin; anyone who does not have them cannot help you recover.
Never type recovery words into a website, a chat, a photo, a password manager you do not control, or any support agent's form. Real support never asks for them.
Real-world analogy
Recovery words are the master key to a safe you own outright. A passphrase is a second, invisible lock, powerful, and unforgiving if you forget it.
Key facts
- Word order matters; the checksum catches most typos.
- A passphrase creates a different wallet, not a password reset.
- Test recovery before depositing meaningful amounts.
- No legitimate service or support agent ever needs your words.
Common misconception
“If I forget my passphrase, support can restore my wallet.”
There is no support layer in Bitcoin key management. The passphrase is an input to the derivation, so an incorrect one simply derives a different, empty wallet.[7]
Go deeper
BIP39 stretches the mnemonic with PBKDF2-HMAC-SHA512 (2048 iterations) using "mnemonic" plus the optional passphrase as salt, producing the BIP32 master seed.
Because the passphrase is salt rather than a stored secret, every possible passphrase yields a valid wallet. That property enables plausible deniability and also makes typos silently produce an empty wallet.
Multisig (for example 2-of-3) removes the single point of failure: separate backups in separate places, where one lost key is survivable. It increases setup and inheritance complexity, so document it for whoever inherits.
Quick check
Answer every question correctly (100%) to complete this lesson.
1.What does adding a passphrase to a recovery phrase do?
2.What is the safest next step right after writing down recovery words?
Counts towards your streak in this browser.
Extra exam questions
Every question here counts towards your accuracy, XP and rank. No guessing: every answer is explained.
Quick check
Answer every question correctly (100%) to complete this lesson.
1.What does a BIP39 recovery phrase encode?
2.What does adding an optional passphrase to a recovery phrase do?
3.If you forget your passphrase, can support recover your wallet?
4.What is the safest step right after writing down recovery words?
5.Why are digital copies (photos, cloud notes) of a recovery phrase discouraged?
6.What happens if you restore a seed using a wallet with a different default derivation path?
7.Why is a passphrase sometimes called 'plausible deniability' or a hidden wallet feature?
8.What proves that a backup actually works?
Counts towards your streak in this browser.
Sources
- BIP-39: Mnemonic code for generating deterministic keys, bitcoin/bips
- BIP-32: Hierarchical Deterministic Wallets, bitcoin/bips
- Bitcoin Core documentation, Bitcoin Core project
Reference implementation documentation, including validation and release notes.