Generate a valid BIP-39 mnemonic (12–24 words) with correct checksum, or validate a phrase and derive its 512-bit seed. Offline wordlist, no network.
Everything runs offline in your browser — never enter a live-funds phrase into an untrusted site.
— output appears here —
— output appears here —
About this tool
The BIP-39 Mnemonic Seed Phrase Generator & Validator creates and checks the human-readable recovery phrases used by cryptocurrency wallets, following the BIP-39 standard exactly and entirely offline. Generate mode draws ENT bits of entropy from crypto.getRandomValues, where ENT is 128, 160, 192, 224, or 256 bits for 12, 15, 18, 21, or 24 words. It then computes a checksum equal to the first ENT/32 bits of SHA-256(entropy), concatenates entropy followed by checksum, splits the result into 11-bit groups, and maps each 0–2047 index to the canonical 2048-word English wordlist bundled with the tool.
The wordlist is embedded locally (about 13 KB), so no network request is ever made and the tool works fully offline. Validate mode takes a pasted phrase, looks up each word, flags any that are not on the list, reassembles the entropy-plus-checksum bit string, recomputes SHA-256, and confirms that the trailing checksum bits match — this is why a single mistyped word almost always fails validation, and why you cannot just invent a phrase.
Both modes can derive the 512-bit master seed used to bootstrap a wallet's key tree: seed = PBKDF2-HMAC-SHA512 over the NFKD-normalised mnemonic with the salt "mnemonic" plus an optional passphrase, run for 2048 iterations, producing 64 bytes shown as 128 hex characters. The optional passphrase (BIP-39's "25th word") changes the seed completely, giving plausible-deniability wallets. Everything runs in your browser — do not enter a seed phrase that controls real funds into any website you do not fully trust.
Frequently asked questions
How does the checksum work?
BIP-39 appends a checksum of ENT/32 bits, taken from the front of SHA-256(entropy), to the entropy before splitting into 11-bit word indices. A 12-word phrase has 128 bits of entropy plus a 4-bit checksum. Validation recomputes that checksum, so a mistyped or reordered word almost always fails.
What does the optional passphrase do?
The passphrase is BIP-39's "25th word." It is folded into the PBKDF2 salt ("mnemonic" + passphrase) when deriving the seed, so any passphrase — including an empty one — yields a completely different, valid seed from the same word list. This enables hidden or plausible-deniability wallets.
Is the seed phrase sent anywhere?
No. The 2048-word list is bundled in the page and all entropy, checksum, and PBKDF2-SHA512 seed derivation happen locally in your browser with no network calls. Still, never paste a phrase that secures real funds into a website you do not fully trust.
Why are only certain word counts allowed?
BIP-39 defines valid mnemonics at 12, 15, 18, 21, or 24 words, corresponding to 128, 160, 192, 224, or 256 bits of entropy — each a multiple of 32 so the checksum divides evenly. Other lengths cannot carry a valid checksum and are rejected by the validator.