Never type a real seed here. This page is an educational tool for testing and learning. Any seed you enter or generate stays in this browser tab and is shown on screen in plain text. For a wallet you actually use, generate and sign on a trusted offline machine.
Same mnemonic + different passphrase → completely different wallet. Any string is valid; there is no wrong passphrase, only wrong remembering. If you lose it, you lose the wallet permanently.
Security: This page runs entirely in your browser. No data is ever sent to any server. For production wallets, always generate and sign on a trusted offline (air-gapped) machine.
Off: seeds use the browser CSPRNG. On: type your own dice rolls or coin flips and their hash becomes your seed.
Don't know which derivation path to use? Just pick any preset that matches your chain. The path is a template you can customize below. To understand what each path segment does, visit the Learn Paths tab or the Blockchain Guide tab.
How encoding works here: All BIP32 keys via ethers.js (loaded once as UMD). EVM / Tron: ethers Wallet + Keccak-256. Bitcoin-family (0/2/3): pure JS using only ethers primitives - sha256, ripemd160, computePublicKey + inline Bech32 - no bitcoinjs-lib, no CDN class bugs. Ed25519 chains (501/784/637): SLIP-0010 implemented inline on ethers' HMAC-SHA512, plus the TweetNaCl global. Nothing here needs a secure context or a server, so every tab works from file:// with the network off.
Brute-forces random secp256k1 keypairs until an address matches your pattern. Runs on the main thread in small batches - UI stays responsive, works 100% offline (no CDN needed).
Difficulty grows exponentially: Each extra hex character takes ~16× longer. A 4-char prefix like 0xcafe averages ~65,000 tries; a 6-char prefix averages ~16 million. The key is cryptographically random - as secure as any other key.
Brain wallets are always unsafe for real money. Attackers precompute hashes of billions of phrases: quotes, lyrics, passwords, Bible verses, Wikipedia sentences. Funds on brain wallets are routinely stolen within hours. Even a "strong" passphrase has far less entropy than 12 random BIP39 words.
Use the Derive Keys tab for real wallets. This tab exists solely to demonstrate cryptographic concepts.
Adds another layer: the mnemonic is always the same SHA-256 output, but this extra word changes every derived key.
Optional. When filled, one extra address is derived at this path for comparison. The 5 fixed paths above are always derived unchanged.
This is a single static HTML page with no build step. Every library is served from this site rather than a CDN, so the page makes no third-party requests and works with the network switched off. Mnemonics never leave the device unless you copy them. The Derive tab turns a BIP39 phrase + path into addresses for Ethereum, Bitcoin (Legacy/SegWit/Native/Taproot), Solana, Tron, Litecoin, Dogecoin, Cosmos, Sui, and Aptos. Vanity searches for EVM address prefixes. Brain wallet demonstrates why human-chosen entropy is unsafe. The Derive tab also has a Physical entropy lab (type your own dice rolls or coin flips so the seed does not depend on your computer alone, enable Expert mode to see it), a paper wallet printer, and an HD tree inspector on the Learn Paths tab. The Experiments tab has a Mnemonic diagnostics panel (find typos or the lost last word) and a Path recovery scanner (match a known address to its derivation path). The current seed also shows in the sticky bar above the tabs. Solana, Sui, and Aptos derivation needs the page served over http:// or https://, because ES module loading is blocked from a file:// origin. Everything else, including the entropy lab and brain wallet, works from file://.
Stack: ethers v5 (BIP32 + UTXO crypto); tweetnacl + inline SLIP-0010 (Solana, Sui, Aptos); qrcode; @noble/hashes (BLAKE2b for Sui, SHA3-256 for Aptos). UTXO chains use zero extra libraries - pure inline Bech32 + ethers primitives. Theme stored in localStorage. All libraries live in src/vendor/ and are served from this site, so nothing is fetched from a third party. To run it air-gapped, clone the repository and open the page with any local server.
It computes. It does not sign a transaction, does not broadcast anything to any network, and does not hold funds at any point, so there is nothing here to check a balance against or to "log into". A seed phrase and the addresses it derives are pure mathematics; using them to actually receive, send, or check funds needs a wallet application or a block explorer, not this page. Generate, back up, and understand a seed here if that helps, then use it in the software you intend to actually run it with.
Click any row to load that preset into the Derive tab and see the real address for the seed you have loaded.
Each row is a common convention. Your wallet might use a different path for recovery - always check its docs.
| Blockchain | Derivation path | Coin type | Notes |
|---|---|---|---|
| Ethereum | m/44'/60'/0'/0/0 | 60 | MetaMask, Trust Wallet, most EVM “account 0” |
| Bitcoin (Native SegWit) | m/84'/0'/0'/0/0 | 0 | bc1q… addresses (BIP84) |
| Bitcoin (Wrapped SegWit) | m/49'/0'/0'/0/0 | 0 | 3… nested SegWit (BIP49) |
| Bitcoin (Legacy) | m/44'/0'/0'/0/0 | 0 | 1… P2PKH (BIP44) |
| Bitcoin (Taproot) | m/86'/0'/0'/0/0 | 0 | bc1p… (BIP86) - experimental on some altcoins |
| Solana | m/44'/501'/0'/0' | 501 | Phantom / Solflare-style; Ed25519 not secp256k1 |
| Polygon | m/44'/60'/0'/0/0 | 60 | Same as Ethereum (EVM) |
| BSC | m/44'/60'/0'/0/0 | 60 | Same as Ethereum (EVM) |
| Avalanche C-Chain | m/44'/60'/0'/0/0 | 60 | Same as Ethereum (EVM) |
| Tron | m/44'/195'/0'/0/0 | 195 | TronLink-style; secp256k1, Base58 T… address |
| Arbitrum | m/44'/60'/0'/0/0 | 60 | Same as Ethereum (EVM) |
| Optimism | m/44'/60'/0'/0/0 | 60 | Same as Ethereum (EVM) |
| Litecoin | m/44'/2'/0'/0/0 | 2 | Legacy; use purpose 84/49 for SegWit-style LTC |
| Dogecoin | m/44'/3'/0'/0/0 | 3 | Legacy-style; SegWit less universal on DOGE |
| Bitcoin Cash | m/44'/145'/0'/0/0 | 145 | Not modeled in this tool - would need BCH params |
| Cardano | m/1852'/1815'/0'/0/0 | 1815 | CIP-1852; different from BIP44-only wallets |
| Cosmos | m/44'/118'/0'/0/0 | 118 | secp256k1 + Bech32 with cosmos HRP (Keplr-style) |
| Sui | m/44'/784'/0'/0' | 784 | Ed25519 (SLIP-0010); address = 0x + BLAKE2b-256(0x00 || pubkey), not the pubkey itself |
| Aptos | m/44'/637'/0'/0' | 637 | Ed25519 (SLIP-0010); legacy address (SDK default) = 0x + SHA3-256(pubkey || 0x00). SingleKey accounts from the same seed use a different address. SHA3-256, not Keccak-256 |
coin_type = 60 - the same key yields the same 0x… address on Ethereum, Polygon, BSC, etc. (you still pay gas on the chain you use).cosmos HRP over a raw 20-byte hash160 - not a Bitcoin-style witness version.0x… as yours. The chain is chosen by the network you broadcast to, not by the address, which is why funds sent on the wrong network still land at "your" address but need that network's gas to move.1…, 3…, bc1q… and bc1p…. Restoring a seed in a wallet that only scans one purpose is the usual reason coins look missing: they are at a different purpose on the same seed.Walk through the key stages of HD wallet derivation. Each step builds on the previous one.
A seed phrase is the wallet. Twelve ordinary looking words are the whole thing. Whoever has them can spend everything, and nobody can reset them for you.
Answer each one in your head first, then open it. Being wrong here is normal.
No. A computer generates it from randomness. If you pick the words yourself, you hand the guessing to whoever guesses like you. In one survey of 643 wallet users, 58 percent believed they could choose their phrase the way they choose a password.
No. There is no account and no reset, for anyone. The words are the wallet, not a login for it.
No. Coins sit on the blockchain. The app and the device only read the words you hold. Among people who already run their own wallet, three quarters of what they described never mentioned protecting the phrase.
Those figures come from one study of 643 wallet users plus 20 interviews (CHI 2025). The same study found that only 43 percent of people could pick a seed phrase out of a set of images.
Your phrase is a written form of one long random number. That number is called entropy. Everything else in this walkthrough is arithmetic on it.
Entropy means randomness, counted in bits. One bit is one yes or no question. Every extra bit doubles the number of guesses an attacker needs. So 128 bits is not twice as strong as 64 bits. It is 264 times as strong.
Entropy (128-256 bits)
|
v
BIP39 Checksum (4-8 bits)
|
v
Split into 11-bit chunks - each maps to a word from the 2048-word list
|
v
Mnemonic phrase (12 or 24 words)
|
v
PBKDF2(mnemonic, passphrase, 2048 rounds) - 512-bit seed
The last word carries the checksum. Type a different real BIP39 word in its place and watch whether the checksum still passes.
By default this tool uses the browser CSPRNG. That is not a plain software random number generator. It is a thin wrapper over the operating system, which seeds itself from hardware noise such as thermal noise in the CPU and interrupt timing.
If you would rather not depend on that, open the Physical entropy lab on the Derive tab with Expert mode on. Type your own dice rolls or coin flips. The SHA-256 hash of what you type becomes the entropy.
The value of real dice is not that they are more random than the CPU. It is that they do not depend on your machine, so malware on it cannot predict them. The simulate buttons in that panel use the browser CSPRNG, so real throws are what count.
Every option below makes a phrase that looks equally convincing. What differs is how many guesses stand between an attacker and your coins. Type a passphrase to see where your own idea would land.
Move this and watch every row change. Notice what stays true at any speed. 128 bits stays out of reach, while the weak rows fall to a patient attacker rather than a fast one.
Ten random words from a 7776 word list would reach about 2129, which is the same strength as twelve BIP39 words.
But if you can memorise ten random words, you can memorise a twelve word BIP39 phrase. That phrase carries a checksum, which catches typos, and every wallet can restore it. So inventing your own is not merely riskier. It is worse at the one job it was supposed to do.
The BIP39 passphrase is a second, separate secret. It does not strengthen the first one. The same words with no passphrase and with a passphrase are two unrelated wallets.
Forgetting this "25th word" is the most common reason people think a restored wallet is empty. It usually is not empty. It is on the wrong branch.
In July 2026 a hardware Bitcoin wallet lost roughly $116M this way. One firmware flag was checked for whether it existed, not for what it was set to. That silently sent seed generation to a poorly seeded software generator instead of the device hardware source.
Effective entropy fell from 128 bits to as little as 40, and the output still looked like a normal, checksummed phrase. There was no visual tell, the same way there was no visual tell in this tool's own Sui bug. The flaw sat in open source code for five years.
The maker's advice: seeds built from real dice rolls were never at risk, because that path never touched the broken code. This tool checks its own randomness for the same class of failure on every load.
After an incident like that one, the useful question is not what is safest. It is which defence protects against which failure, and at which moment. These are the ones that matter, with their limits:
Answer in your head first, then open the question. Recalling an answer before seeing it is what makes it stick.
In the words. The app and the device only read them, and so does any other wallet you later restore them into. Why this matters: anything that asks for the words is asking for the wallet.
128. Twelve words carry 132 bits, and the last 4 are the checksum, so the secret part is 128 bits. A 24-word phrase carries 256.
Almost always the wallet refuses, because the checksum no longer matches. There is a 1 in 16 chance with 12 words, or 1 in 256 with 24 words, that the mistake still passes and derives a different, empty wallet. That is why typing carefully matters.
No. Nobody holds a copy, including this tool. Your real options are backing the words up properly, or moving funds to a new wallet with a new phrase.
No. The passphrase selects a different branch of a tree whose root is still guessable. Why this matters: an attacker who sweeps the seed can sweep the passphrase branches too.
Because the words are the wallet itself, not a login name. Why this matters: whoever receives them can derive every key and spend everything within minutes.
Each segment above ends with a few questions. These mix all six together, the way a real problem arrives, with no label telling you which part of the tree you are looking at. Answer first, then open the answer.
No. Both are real addresses on the same seed. They sit on different branches, because the two wallets default to a different purpose (84 against 44). A wallet only shows you the branch it knows about.
Almost never. The order is part of the value, and a wrong order usually fails the checksum. About 1 time in 16 for 12 words it passes anyway and builds a different, empty wallet, which is the dangerous case.
They can see every address that account will ever use, so your balance and your history. They cannot see your private keys, your master key, or the other accounts on your seed.
The master private key is the root secret. The master chain code is the extra randomness that makes each child unique. Child derivation needs both.
A different derivation path (purpose, account, or a wallet's own unusual default), or a passphrase you have forgotten you set. Both change the branch, so the wallet looks empty rather than wrong.
Coin type is part of the path and it is hardened, so 60 and 0 land on two different branches. Different branches, different keys.
Wrong. Order changes the entropy, so it changes every key below it. The same set of words in a different order is a different wallet, or no wallet at all.
Because the steps from key to address run one way. A hash cannot be undone, so publishing an address gives nothing that leads back to the key.
The whole account. The unhardened step can be run backwards from the child key plus the public data, which rebuilds the parent private key. A watch-only wallet stops being watch-only at that moment.
128 more bits of guessing, which takes it from about 2^128 to about 2^256. Both are far out of reach today, so the weak point is rarely the length. It is how the words were made.
Two of the ideas above matter more than the rest. If you can explain these out loud, without the page, you have the whole picture. Try before you open the model answer.
A model answer: those words are not a password to an account that someone else holds. They are the account. Every address and every key on every chain is worked out from them, so whoever has them has the money, and whoever loses them loses the money. A screen can fail, and a phone can be lost. A cloud copy can be read by someone you never met. So the safest copy is one on paper, in order, kept away from the internet. Nothing else is needed, and nothing else can rescue them.
A model answer: the words do not lead to one wallet. They lead to a tree, and a wallet only looks at the branches it knows about. Two wallets can default to a different branch from the same words, so each one shows a different set of addresses. The funds are not lost. They are on a branch you are not looking at. So the first thing to check is the path, and then whether a passphrase was mixed in.
Trust nothing, including this tool. The checks below recompute the official BIP39, BIP32, BIP44 and BIP84 test vectors right now, in your browser, with the same code the Derive tab uses. Every row must read PASS. A FAIL means this copy of the page is broken or has been tampered with: do not use it, and re-download it from the official repository.
A path is a route through a tree of keys. The usual BIP44 layout:
Solana in this tool: m / purpose' / 501' / account' / index' - the extra hardened level replaces change / index so Phantom first account matches account=0, index=0 in the form.
| Level | Symbol | Meaning | Example values |
|---|---|---|---|
| Master | m | Root of the HD tree | Always m |
| Purpose | 44' | Which BIP family | 44, 49, 84, 86... |
| Coin type | 60' | Registered coin index (SLIP-0044) | 0 BTC, 60 ETH, 501 SOL... |
| Account | 0' | Separate accounts | 0, 1, 2... |
| Change | 0 | External (0) vs internal change (1) for UTXO | 0 or 1 - ignored for Solana in this UI |
| Address index | 0 | Nth address in that chain | 0, 1, 2... - for SOL, this field is the last hardened index |
Taught in step 4 of Learn Paths, with a live comparison on your own seed. Not repeated here.
m/44'/60'/0'/0/0
m/44'/60'/0'/0/1
m/44'/60'/0'/0/2
Bump account for separation:
m/44'/60'/0'/0/0
m/44'/60'/1'/0/0
Because EVM chains use coin type 60, the same path gives the same 0x address on many networks, but balances and contracts differ per chain.
Coin type 195 and path like m/44'/195'/0'/0/0 give a secp256k1 key. The Keccak-256 of the uncompressed public key (same idea as Ethereum) becomes the 20-byte payload, but Tron shows it as a Base58Check string starting with T, not 0x.
Every scam around seed phrases is a version of one trick: getting you to expose the words. Read each scenario, decide what is really being asked, then open it to compare.
The offer is: give me your words. There is nothing to verify - a valid phrase is valid. Whoever receives it owns the wallet within minutes.
No legitimate support channel, ever, asks for the words. The words are not a credential you present; they are the wallet itself. The "suspicious activity" is this conversation.
A phrase already generated cannot be checked for bugs by looking at it - the risk lived in the device that made it, at creation time. Typing it anywhere simply hands it over.
Connecting a wallet never involves the phrase - signatures and approvals expose nothing reusable. Any input field asking for it is a drain attempt, however professional the page looks.
The jargon of this page in one place.
2048 is 211, so each word encodes exactly 11 bits with no waste. 12 words x 11 bits = 132 bits = 128 entropy + 4 checksum.
128 bits of entropy is already beyond any brute-force horizon; 24 words (256 bits) mainly help when you trust the phrase to survive partial exposure or want headroom against future attacks.
Mathematically possible, practically impossible: the space of seeds is so much larger than the space of addresses that a collision has never occurred by chance.
Usually a different derivation path (try the Path recovery tool on the Experiments tab) or a passphrase set long ago and forgotten. The funds are almost certainly fine.
It carries the checksum: in a 12-word phrase its last 4 bits are computed from all 128 entropy bits, so it is not freely choosable.
No. It only selects which branch of the tree exists. Forget it and that wallet is unreachable with today's technology, by design.
The 2048 English words every BIP39 wallet knows. Type to search - the uniqueness of the first four letters is verified live below every time you do.
Step 1: click Build tree from current seed below (uses the mnemonic from the Derive tab). Step 2: the root and its first branches appear. Click any node to derive its keys; click a branch node again to expand or collapse its children.
No tree yet. Click "Build tree from current seed" above to start.
Click a tree node on the left to see its derived keys, extended key (xprv/xpub), and EVM address here.
Alpha features. These tools are experimental and may change. They use the mnemonic and BIP39 passphrase from the Derive tab (Step 1).
Find typos or the lost last word of an existing mnemonic. Type your mnemonic in the Derive tab Step 1, then use these tools.
Restored a seed in a new wallet and see no balance? Different wallets use different derivation paths. Paste the address you expect, and this scans ~15 common paths to find the match.
Uses the mnemonic and BIP39 passphrase from Step 1 (Derive tab).