KeySense

BIP39 · BIP32 · BIP44 / 49 / 84 / 86 - Making sense of multi-chain keys and paths
● 100% Offline
Seed No seed generated - click Generate in the Derive tab
Step 1: Seed phrase BIP39

Never type a real seed here. This page is an educational tool for testing and learning. Any seed you enter or generate stays in this browser tab and is shown on screen in plain text. For a wallet you actually use, generate and sign on a trusted offline machine.

Same mnemonic + different passphrase → completely different wallet. Any string is valid; there is no wrong passphrase, only wrong remembering. If you lose it, you lose the wallet permanently.

Security: This page runs entirely in your browser. No data is ever sent to any server. For production wallets, always generate and sign on a trusted offline (air-gapped) machine.

Off: seeds use the browser CSPRNG. On: type your own dice rolls or coin flips and their hash becomes your seed.

Step 2: Presets

Don't know which derivation path to use? Just pick any preset that matches your chain. The path is a template you can customize below. To understand what each path segment does, visit the Learn Paths tab or the Blockchain Guide tab.

Step 3: Custom path BIP44
Derivation path
m/44'/60'/0'/0/0
Step 4: Results
Address
Run Derive to generate
Private key
Public key

How encoding works here: All BIP32 keys via ethers.js (loaded once as UMD). EVM / Tron: ethers Wallet + Keccak-256. Bitcoin-family (0/2/3): pure JS using only ethers primitives - sha256, ripemd160, computePublicKey + inline Bech32 - no bitcoinjs-lib, no CDN class bugs. Ed25519 chains (501/784/637): SLIP-0010 implemented inline on ethers' HMAC-SHA512, plus the TweetNaCl global. Nothing here needs a secure context or a server, so every tab works from file:// with the network off.

Vanity address miner EVM · fully offline

Brute-forces random secp256k1 keypairs until an address matches your pattern. Runs on the main thread in small batches - UI stays responsive, works 100% offline (no CDN needed).

Attempts: 0

Difficulty grows exponentially: Each extra hex character takes ~16× longer. A 4-char prefix like 0xcafe averages ~65,000 tries; a 6-char prefix averages ~16 million. The key is cryptographically random - as secure as any other key.

Critical security warning - read this

Brain wallets are always unsafe for real money. Attackers precompute hashes of billions of phrases: quotes, lyrics, passwords, Bible verses, Wikipedia sentences. Funds on brain wallets are routinely stolen within hours. Even a "strong" passphrase has far less entropy than 12 random BIP39 words.

Use the Derive Keys tab for real wallets. This tab exists solely to demonstrate cryptographic concepts.

Brain wallet demo SHA-256 → BIP39 → multi-chain

Adds another layer: the mnemonic is always the same SHA-256 output, but this extra word changes every derived key.

What this toolkit does

This is a single static HTML page with no build step. Every library is served from this site rather than a CDN, so the page makes no third-party requests and works with the network switched off. Mnemonics never leave the device unless you copy them. The Derive tab turns a BIP39 phrase + path into addresses for Ethereum, Bitcoin (Legacy/SegWit/Native/Taproot), Solana, Tron, Litecoin, Dogecoin, Cosmos, Sui, and Aptos. Vanity searches for EVM address prefixes. Brain wallet demonstrates why human-chosen entropy is unsafe. The Derive tab also has a Physical entropy lab (type your own dice rolls or coin flips so the seed does not depend on your computer alone, enable Expert mode to see it), a paper wallet printer, and an HD tree inspector on the Learn Paths tab. The Experiments tab has a Mnemonic diagnostics panel (find typos or the lost last word) and a Path recovery scanner (match a known address to its derivation path). The current seed also shows in the sticky bar above the tabs. Solana, Sui, and Aptos derivation needs the page served over http:// or https://, because ES module loading is blocked from a file:// origin. Everything else, including the entropy lab and brain wallet, works from file://.

Stack: ethers v5 (BIP32 + UTXO crypto); tweetnacl + inline SLIP-0010 (Solana, Sui, Aptos); qrcode; @noble/hashes (BLAKE2b for Sui, SHA3-256 for Aptos). UTXO chains use zero extra libraries - pure inline Bech32 + ethers primitives. Theme stored in localStorage. All libraries live in src/vendor/ and are served from this site, so nothing is fetched from a third party. To run it air-gapped, clone the repository and open the page with any local server.

What this toolkit does not do

It computes. It does not sign a transaction, does not broadcast anything to any network, and does not hold funds at any point, so there is nothing here to check a balance against or to "log into". A seed phrase and the addresses it derives are pure mathematics; using them to actually receive, send, or check funds needs a wallet application or a block explorer, not this page. Generate, back up, and understand a seed here if that helps, then use it in the software you intend to actually run it with.

Blockchain derivation reference

Click any row to load that preset into the Derive tab and see the real address for the seed you have loaded.

Each row is a common convention. Your wallet might use a different path for recovery - always check its docs.

BlockchainDerivation pathCoin typeNotes
Ethereumm/44'/60'/0'/0/060MetaMask, Trust Wallet, most EVM “account 0”
Bitcoin (Native SegWit)m/84'/0'/0'/0/00bc1q… addresses (BIP84)
Bitcoin (Wrapped SegWit)m/49'/0'/0'/0/003… nested SegWit (BIP49)
Bitcoin (Legacy)m/44'/0'/0'/0/001… P2PKH (BIP44)
Bitcoin (Taproot)m/86'/0'/0'/0/00bc1p… (BIP86) - experimental on some altcoins
Solanam/44'/501'/0'/0'501Phantom / Solflare-style; Ed25519 not secp256k1
Polygonm/44'/60'/0'/0/060Same as Ethereum (EVM)
BSCm/44'/60'/0'/0/060Same as Ethereum (EVM)
Avalanche C-Chainm/44'/60'/0'/0/060Same as Ethereum (EVM)
Tronm/44'/195'/0'/0/0195TronLink-style; secp256k1, Base58 T… address
Arbitrumm/44'/60'/0'/0/060Same as Ethereum (EVM)
Optimismm/44'/60'/0'/0/060Same as Ethereum (EVM)
Litecoinm/44'/2'/0'/0/02Legacy; use purpose 84/49 for SegWit-style LTC
Dogecoinm/44'/3'/0'/0/03Legacy-style; SegWit less universal on DOGE
Bitcoin Cashm/44'/145'/0'/0/0145Not modeled in this tool - would need BCH params
Cardanom/1852'/1815'/0'/0/01815CIP-1852; different from BIP44-only wallets
Cosmosm/44'/118'/0'/0/0118secp256k1 + Bech32 with cosmos HRP (Keplr-style)
Suim/44'/784'/0'/0'784Ed25519 (SLIP-0010); address = 0x + BLAKE2b-256(0x00 || pubkey), not the pubkey itself
Aptosm/44'/637'/0'/0'637Ed25519 (SLIP-0010); legacy address (SDK default) = 0x + SHA3-256(pubkey || 0x00). SingleKey accounts from the same seed use a different address. SHA3-256, not Keccak-256
Key observations
  • All EVM chains share coin_type = 60 - the same key yields the same 0x… address on Ethereum, Polygon, BSC, etc. (you still pay gas on the chain you use).
  • Bitcoin changes the purpose number (44 / 49 / 84 / 86) to pick address type, not just coin type.
  • Solana uses Ed25519 derivation (SLIP-0010). You cannot get a Solana address by plugging the same path into a raw secp256k1-only helper.
  • Ed25519 chains (Solana, Sui, Aptos) share the SLIP-0010 derivation pipeline. Every path segment must be hardened; there are no normal (unhardened) children. Sui hashes the public key with BLAKE2b-256 after a 0x00 scheme byte; Aptos hashes it with SHA3-256 followed by a 0x00 scheme byte for the legacy (default) account type, and has a separate SingleKey address scheme from the same key. Neither address is the public key itself, even though a Sui address is the same 32-byte length.
  • Cosmos uses the same secp256k1 curve as Bitcoin/Ethereum, but its address is Bech32 with the cosmos HRP over a raw 20-byte hash160 - not a Bitcoin-style witness version.
  • Non-standard paths are valid mathematically but wallets may not scan them - backup risk.
  • Why every EVM chain shares coin type 60: the address is derived from the key alone, and nothing in it names a chain. Ethereum, Polygon, BSC, Arbitrum, Optimism and Avalanche C-Chain all read the same 0x… as yours. The chain is chosen by the network you broadcast to, not by the address, which is why funds sent on the wrong network still land at "your" address but need that network's gas to move.
  • Why Bitcoin changes purpose rather than coin type: it is one currency with several address encodings. 44, 49, 84 and 86 all derive from the same seed on coin type 0, but produce 1…, 3…, bc1q… and bc1p…. Restoring a seed in a wallet that only scans one purpose is the usual reason coins look missing: they are at a different purpose on the same seed.
  • Why Ed25519 chains have no watch-only xpub: an xpub works because a parent public key can derive child public keys without the private key. SLIP-0010 on Ed25519 defines only hardened derivation, and hardened steps feed the private key into the hash, so there is nothing a public key alone can extend. That is a property of the curve's use here, not a missing feature.
  • What an xpub actually leaks: on its own it exposes every address in that branch, so all your balances and history, but not the ability to spend. Combine it with any one unhardened child private key, though, and the parent private key can be reconstructed, which hands over the whole branch. That is exactly why the standard paths harden purpose, coin type and account.
Learning Path: From Seed to Address

Walk through the key stages of HD wallet derivation. Each step builds on the previous one.

1
Seed
2
Master Key
3
Path
4
Hardened
5
Address

1. The BIP39 Seed Phrase

A mnemonic seed phrase is a human-readable encoding of random entropy. It is the root of your entire wallet tree.

  • 12 words = 128 bits of entropy + 4-bit checksum
  • 24 words = 256 bits of entropy + 8-bit checksum
  • The last word is partially determined by the checksum of all previous words
  • The wordlist has exactly 2048 words (211) - each word encodes 11 bits
Entropy (128-256 bits) | v BIP39 Checksum (4-8 bits) | v Split into 11-bit chunks - each maps to a word from the 2048-word list | v Mnemonic phrase (12 or 24 words) | v PBKDF2(mnemonic, passphrase, 2048 rounds) - 512-bit seed
With your seed
Try it: edit the last word

The last word carries the checksum. Type a different real BIP39 word in its place and watch whether the checksum still passes.

Try it: flip the bits yourself

Bring your own randomness: By default this tool uses the browser's CSPRNG, which is not a plain software RNG. It is a thin wrapper over the operating system, which seeds itself from hardware noise such as the CPU's on-die thermal-noise generator and interrupt timing. If you would rather not depend on that, open the Physical entropy lab on the Derive tab (enable Expert mode) and type your own dice rolls or coin flips. The SHA-256 hash of what you type becomes the entropy instead. The value of real dice is not that they are more random than the CPU, it is that they do not depend on your machine, so malware on it cannot predict them. The simulate buttons in that panel use the browser CSPRNG, so real throws are what matter.

How much randomness is really in there?

Every one of these produces a valid seed phrase that looks exactly as convincing as the others. What differs is how many guesses stand between an attacker and your coins. Type a passphrase to see where your own idea would land.

Move this and watch every row above change. The point is what stays true regardless: 128 bits stays absurd at any of these speeds, while the weak rows do not need a fast attacker to fall, only a patient one.

To reach 128 bits using random words you could actually memorise, you need ten Diceware words: 777610 is about 2129. But if you can memorise ten random words, you can memorise a twelve word BIP39 phrase, which is the same strength, carries a checksum that catches typos, and is restorable in every wallet. That is the whole argument against inventing your own: it is not merely riskier, it is worse at the one job it was supposed to do.

Same 12 words, different passphrase

The BIP39 passphrase is a second, separate secret, not a strengthening of the first. The same words with no passphrase and with any passphrase are two completely unrelated wallets. Forgetting this "25th word" is the most common reason people believe a restored wallet is empty - it usually is not, it is just the wrong branch.

This is not hypothetical

In July 2026, a hardware Bitcoin wallet lost roughly $116M this way. A firmware build flag was checked for whether it existed rather than what it was set to, which silently routed seed generation to a poorly-seeded software random number generator instead of the device's hardware source. Effective entropy collapsed from 128 bits to as little as 40. The output still looked like a completely normal, valid, checksummed recovery phrase - there was no visual tell, the same way there was no visual tell in this tool's own Sui bug. The bug sat in open-source code for five years before anyone noticed.

The maker's own advice to affected users: seeds built from real dice rolls were never at risk, because that path never touched the broken code. That is exactly the Physical entropy lab above. This tool's own randomness is checked for the equivalent failure on every load; see the note in the entropy lab if you want the detail.

When defences actually help

After an incident like that one, the useful question is not "what is safest" but "which defence protects against which failure, at which moment". These are the ones that matter, and their limits:

  • Own entropy (dice) protects at creation time only. Mixing real dice rolls into the seed means no software bug on your device - then or later - could have predicted it. It says nothing about any seed generated before or after by other means.
  • A passphrase selects a different wallet. It does not repair a weak one. If the underlying entropy is guessable, an attacker sweeping the seed can also sweep every passphrase branch. Strength comes from entropy, not from a memorable word on top of it.
  • Updates cannot fix an already-created seed. A seed generated while a random source was broken stays weak forever, whatever firmware ships afterwards. The only remedy is moving funds to a freshly generated seed - which is why "was my device affected" questions are so urgent after RNG disclosures.
  • Verification catches bugs before they cost you. Deriving the same seed in two independent tools and comparing addresses is the cheapest end-to-end check that exists. This page verifies itself against the official BIP test vectors live - see the This page verifies itself card below this walkthrough.
  • Failing closed beats failing quietly. A tool whose randomness is unavailable should refuse to generate anything (this one does - it is tested in CI), because a plausible-looking phrase from a broken source is worse than an honest error.

Check your understanding

Answer in your head first, then open the question. Recalling an answer before seeing it is what makes it stick.

How many bits of real entropy are in a 12-word phrase?

128. Twelve words carry 132 bits and the last 4 are checksum, so the secret part is 128 bits. 24-word phrases carry 256.

You restore your wallet and mistype one word. What happens?

Almost always the wallet refuses: the checksum no longer matches. There is a 1-in-16 chance (12 words) or 1-in-256 (24 words) the mistake still passes and silently derives a different, empty wallet - which is why typing words carefully matters.

Does adding a strong passphrase make a weakly generated seed safe?

No. The passphrase selects a different branch of a tree whose root is still the guessable entropy. An attacker who sweeps the seed can sweep the passphrase branches too. Strength has to be in the entropy itself.

1 / 5
This page verifies itself

Trust nothing, including this tool. The checks below recompute the official BIP39, BIP32, BIP44 and BIP84 test vectors right now, in your browser, with the same code the Derive tab uses. Every row must read PASS. A FAIL means this copy of the page is broken or has been tampered with: do not use it, and re-download it from the official repository.

Understanding derivation paths

A path is a route through a tree of keys. The usual BIP44 layout:

m / purpose' / coin_type' / account' / change / address_index

Solana in this tool: m / purpose' / 501' / account' / index' - the extra hardened level replaces change / index so Phantom first account matches account=0, index=0 in the form.

Path structure breakdown
LevelSymbolMeaningExample values
MastermRoot of the HD treeAlways m
Purpose44'Which BIP family44, 49, 84, 86...
Coin type60'Registered coin index (SLIP-0044)0 BTC, 60 ETH, 501 SOL...
Account0'Separate accounts0, 1, 2...
Change0External (0) vs internal change (1) for UTXO0 or 1 - ignored for Solana in this UI
Address index0Nth address in that chain0, 1, 2... - for SOL, this field is the last hardened index
Hardened vs normal derivation

The apostrophe (') means hardened: child keys require the parent private key, not just an xpub.

TypeSecurity / UXTypical use
Hardened (')Higher isolation; cannot derive from watch-only parentpurpose, coin_type, account; and Solana last segment
NormalDerivable from xpub - good for receiving addresseschange + index on Bitcoin-like chains
Common scenarios
MetaMask Account 1, 2, 3...

Often increments the final address_index (not account):

m/44'/60'/0'/0/0 m/44'/60'/0'/0/1 m/44'/60'/0'/0/2
Multiple wallets from one seed

Bump account for separation:

m/44'/60'/0'/0/0 m/44'/60'/1'/0/0
Same EVM address everywhere

Because EVM chains use coin type 60, the same path gives the same 0x address on many networks, but balances and contracts differ per chain.

Tron uses the same curve, not the same display

Coin type 195 and path like m/44'/195'/0'/0/0 give a secp256k1 key. The Keccak-256 of the uncompressed public key (same idea as Ethereum) becomes the 20-byte payload, but Tron shows it as a Base58Check string starting with T, not 0x.

Important notes
  • Same seed + same path = same keys (deterministic).
  • Losing the path can mean losing access even if you keep the words.
  • Compare any result against a second tool or a test wallet before mainnet use.
What is the real offer?

Every scam around seed phrases is a version of one trick: getting you to expose the words. Read each scenario, decide what is really being asked, then open it to compare.

A stranger in a forum offers to "verify your recovery phrase is safe" using their professional tool.

The offer is: give me your words. There is nothing to verify - a valid phrase is valid. Whoever receives it owns the wallet within minutes.

"Wallet support" asks you to read your 12 words aloud to "restore your account after suspicious activity".

No legitimate support channel, ever, asks for the words. The words are not a credential you present; they are the wallet itself. The "suspicious activity" is this conversation.

A site asks you to type your seed phrase to "check whether your wallet is affected by the latest RNG bug".

A phrase already generated cannot be checked for bugs by looking at it - the risk lived in the device that made it, at creation time. Typing it anywhere simply hands it over.

An airdrop form says "connect your wallet by entering your seed phrase".

Connecting a wallet never involves the phrase - signatures and approvals expose nothing reusable. Any input field asking for it is a drain attempt, however professional the page looks.

Plain-language glossary

The jargon of this page in one place.

Entropy
The actual random data behind a seed. Everything else - words, keys, addresses - is derived from it. Its length in bits is the real strength of a wallet.
Checksum
A few extra bits computed from the entropy and appended before encoding, so that typos produce an invalid phrase instead of a different valid-looking wallet.
Mnemonic
The 12-24 word phrase: a human-writable encoding of entropy plus checksum, one word per 11 bits.
Seed (BIP39)
Not the words themselves. The 512-bit value PBKDF2 produces from mnemonic plus passphrase; the root of all keys.
Master key / chain code
The two halves of HMAC-SHA512 at the root: the first private key, and the entropy used to derive children deterministically.
xprv / xpub
Serialized extended keys: a key plus its chain code. An xpub alone can derive child addresses but no private keys.
Hardened (')
A derivation step that needs the parent private key. It cannot be computed from an xpub, which is why account levels are hardened.
Derivation path
The route through the key tree, like m/44'/60'/0'/0/0. Same seed plus different path equals different keys.
Purpose / coin type
First two path levels: which BIP standard (44, 49, 84, 86) and which chain (SLIP-0044 registry: 0 BTC, 60 ETH, 501 SOL...).
WIF
Wallet Import Format: a private key packaged for copy-paste between Bitcoin wallets.
Bech32 / HRP
The address alphabet Bitcoin segwit uses, and its human-readable prefix (bc, cosmos, ltc...).
secp256k1 / Ed25519
The two signing curves here. Bitcoin, Ethereum and friends use secp256k1; Solana, Sui and Aptos use Ed25519, whose derivation (SLIP-0010) is hardened at every level.
Frequently asked
Why exactly 2048 words?

2048 is 211, so each word encodes exactly 11 bits with no waste. 12 words x 11 bits = 132 bits = 128 entropy + 4 checksum.

Are 12 words enough, or do I need 24?

128 bits of entropy is already beyond any brute-force horizon; 24 words (256 bits) mainly help when you trust the phrase to survive partial exposure or want headroom against future attacks.

Can two different seeds ever produce the same address?

Mathematically possible, practically impossible: the space of seeds is so much larger than the space of addresses that a collision has never occurred by chance.

Why does my restored wallet show an empty balance?

Usually a different derivation path (try the Path recovery tool on the Experiments tab) or a passphrase set long ago and forgotten. The funds are almost certainly fine.

What does the last word do that is special?

It carries the checksum: in a 12-word phrase its last 4 bits are computed from all 128 entropy bits, so it is not freely choosable.

Is the passphrase stored or recoverable anywhere?

No. It only selects which branch of the tree exists. Forget it and that wallet is unreachable with today's technology, by design.

Wordlist explorer

The 2048 English words every BIP39 wallet knows. Type to search - the uniqueness of the first four letters is verified live below every time you do.

HD derivation tree inspector

Step 1: click Build tree from current seed below (uses the mnemonic from the Derive tab). Step 2: the root and its first branches appear. Click any node to derive its keys; click a branch node again to expand or collapse its children.

No tree yet. Click "Build tree from current seed" above to start.

Click a tree node on the left to see its derived keys, extended key (xprv/xpub), and EVM address here.

Try it yourself
  • Visualize the tree - click "Build tree from current seed" above to see every derivation branch and click nodes to derive keys.
  • Find a lost path - on the Experiments tab, use "Path recovery" to scan ~15 common wallet paths and match a known address back to its derivation.
  • Bring your own entropy - on the Derive tab, enable Expert mode to open "Physical entropy lab" and type your own dice rolls so the seed does not depend on your computer alone.

Alpha features. These tools are experimental and may change. They use the mnemonic and BIP39 passphrase from the Derive tab (Step 1).

Recover a seed

Find typos or the lost last word of an existing mnemonic. Type your mnemonic in the Derive tab Step 1, then use these tools.

Where are my funds? Path recovery

Restored a seed in a new wallet and see no balance? Different wallets use different derivation paths. Paste the address you expect, and this scans ~15 common paths to find the match.

Uses the mnemonic and BIP39 passphrase from Step 1 (Derive tab).