Seed phrase mechanics

A BIP-39 seed phrase encodes 128–256 bits of random entropy as 12–24 words: entropy plus a SHA-256-derived checksum is split into 11-bit segments, each indexing a 2048-word list. The phrase (optionally salted with a user passphrase) is stretched via PBKDF2 into a seed, from which an entire wallet's keys are derived deterministically (see hd-wallets). The words are the wallet: anyone with the phrase (and passphrase, if set) can regenerate every key and spend everything, on any compatible software, with no access to the original device.

Nuance: 12 words (128 bits) is within BIP-39 spec and generally considered computationally sufficient; 24 words (256 bits) is common for hardware wallets. The checksum means a mistyped phrase is usually detected, not silently accepted. The optional passphrase creates an entirely different wallet per passphrase — protection and foot-gun in equal measure.

Common misstatements:

• "The seed phrase is a password to your account." — There is no account and no reset; the phrase deterministically is the keys.
• "The wallet company can recover your seed." — For self-custodial wallets, no party can; that is the defining property (and responsibility).
• "Any 12 words work." — Words must come from the wordlist in a checksum-valid combination.