KeySense

Step 1: Seed phrase BIP39 Expert mode

Mnemonic (12 or 24 words)

Word count

Language

BIP39 passphrase optional extra passphrase

Same mnemonic + different passphrase → completely different wallet. Any string is valid; there is no wrong passphrase, only wrong remembering. If you lose it, you lose the wallet permanently.

Security: This page runs entirely in your browser. No data is ever sent to any server. For production wallets, always generate and sign on a trusted offline (air-gapped) machine.

Off: seeds use the browser CSPRNG. On: roll dice or flip coins and the hash becomes your seed.

Step 2: Presets

Don't know which derivation path to use? Just pick any preset that matches your chain. The path is a template you can customize below. To understand what each path segment does, visit the Learn Paths tab or the Blockchain Guide tab.

Step 3: Custom path BIP44 Expert mode

purpose′ 44 / 49 / 84 / 86

coin_type′ 0=BTC · 60=ETH · 118=COSMOS · 195=TRX · 501=SOL · 784=SUI · 637=APTOS

account′

change 0 = external · 1 = internal

index address index (Sol: hardened)

Explicit path & encoding

When filled, the path below is used for derivation instead of assembling from the segment fields. Use Sync from fields to copy the current segment path here.

Custom derivation path

Output format override

Batch derive (same path, varying index)

Varies the last path component (address index). Max 50 rows. Uses mnemonic + passphrase + segment fields / custom path base.

From index

To index

Derive from extended key (XPUB / XPRV)

Paste an xprv or xpub. Child path is relative (e.g. m/0/0). XPUB derives addresses only (no private key).

Child path

Solana (501) uses path m/purpose′/501′/account′/index′ (Ed25519). The change field is ignored.

Derivation path

m/44'/60'/0'/0/0

Step 4: Results

Address

Run Derive to generate

Private key

—

Public key

—

How encoding works here: All BIP32 keys via ethers.js (loaded once as UMD). EVM / Tron: ethers Wallet + Keccak-256. Bitcoin-family (0/2/3): pure JS using only ethers primitives - sha256, ripemd160, computePublicKey + inline Bech32 - no bitcoinjs-lib, no CDN class bugs. Solana (501): SLIP-0010 via ed25519-hd-key + TweetNaCl global. Brain Wallet uses crypto.subtle, which requires an HTTPS server (blocks on file://). Use a local server for full functionality.

Vanity address miner EVM · fully offline

Brute-forces random secp256k1 keypairs until an address matches your pattern. Runs on the main thread in small batches - UI stays responsive, works 100% offline (no CDN needed).

Prefix to match (e.g. 0xcafe - case-insensitive)

Prefix (starts with) Suffix (ends with) Contains (anywhere)

Attempts: 0

Difficulty grows exponentially: Each extra hex character takes ~16× longer. A 4-char prefix like 0xcafe averages ~65,000 tries; a 6-char prefix averages ~16 million. The key is cryptographically random - as secure as any other key.

Critical security warning - read this

Brain wallets are always unsafe for real money. Attackers precompute hashes of billions of phrases: quotes, lyrics, passwords, Bible verses, Wikipedia sentences. Funds on brain wallets are routinely stolen within hours. Even a "strong" passphrase has far less entropy than 12 random BIP39 words.

Use the Derive Keys tab for real wallets. This tab exists solely to demonstrate cryptographic concepts.

Brain wallet demo SHA-256 → BIP39 → multi-chain

Source passphrase hashed with SHA-256 to produce entropy

BIP39 passphrase optional "25th word" applied to the derived mnemonic

Adds another layer: the mnemonic is always the same SHA-256 output, but this extra word changes every derived key.

Account index

Address index

What this toolkit does

This is a single static HTML page with no build step. Libraries load from CDN on first visit, then everything runs in your browser. Mnemonics never leave the device unless you copy them. The Derive tab turns a BIP39 phrase + path into addresses for Ethereum, Bitcoin (Legacy/SegWit/Native/Taproot), Solana, Tron, Litecoin, Dogecoin, Cosmos, Sui, and Aptos. Vanity searches for EVM address prefixes. Brain wallet demonstrates why human-chosen entropy is unsafe. The Derive tab also has a Physical entropy lab (roll dice / flip coins to create a seed without software RNG, enable Expert mode to see it), a paper wallet printer, and an HD tree inspector on the Learn Paths tab. The Experiments tab has a Mnemonic diagnostics panel (find typos or the lost last word) and a Path recovery scanner (match a known address to its derivation path). The current seed also shows in the sticky bar above the tabs. The entropy lab, brain wallet, and Solana/Sui/Aptos derivation require an HTTPS server (not available on file://).

Stack: ethers v5 (BIP32 + UTXO crypto); ed25519-hd-key + tweetnacl (Solana, Sui, Aptos); qrcode; browser crypto.subtle (SHA-256 for the entropy lab + brain wallet, SHA3-256 for Aptos). UTXO chains use zero extra libraries - pure inline Bech32 + ethers primitives. Theme stored in localStorage. Download button saves the full page for offline or air-gapped use.

Blockchain derivation reference

Each row is a common convention. Your wallet might use a different path for recovery - always check its docs.

Blockchain	Derivation path	Coin type	Notes
Ethereum	`m/44'/60'/0'/0/0`	60	MetaMask, Trust Wallet, most EVM “account 0”
Bitcoin (Native SegWit)	`m/84'/0'/0'/0/0`	0	`bc1q…` addresses (BIP84)
Bitcoin (Wrapped SegWit)	`m/49'/0'/0'/0/0`	0	`3…` nested SegWit (BIP49)
Bitcoin (Legacy)	`m/44'/0'/0'/0/0`	0	`1…` P2PKH (BIP44)
Bitcoin (Taproot)	`m/86'/0'/0'/0/0`	0	`bc1p…` (BIP86) - experimental on some altcoins
Solana	`m/44'/501'/0'/0'`	501	Phantom / Solflare-style; Ed25519 not secp256k1
Polygon	`m/44'/60'/0'/0/0`	60	Same as Ethereum (EVM)
BSC	`m/44'/60'/0'/0/0`	60	Same as Ethereum (EVM)
Avalanche C-Chain	`m/44'/60'/0'/0/0`	60	Same as Ethereum (EVM)
Tron	`m/44'/195'/0'/0/0`	195	TronLink-style; secp256k1, Base58 `T…` address
Arbitrum	`m/44'/60'/0'/0/0`	60	Same as Ethereum (EVM)
Optimism	`m/44'/60'/0'/0/0`	60	Same as Ethereum (EVM)
Litecoin	`m/44'/2'/0'/0/0`	2	Legacy; use purpose 84/49 for SegWit-style LTC
Dogecoin	`m/44'/3'/0'/0/0`	3	Legacy-style; SegWit less universal on DOGE
Bitcoin Cash	`m/44'/145'/0'/0/0`	145	Not modeled in this tool - would need BCH params
Cardano	`m/1852'/1815'/0'/0/0`	1815	CIP-1852; different from BIP44-only wallets
Cosmos	`m/44'/118'/0'/0/0`	118	secp256k1 + Bech32 with `cosmos` HRP (Keplr-style)
Sui	`m/44'/784'/0'/0'`	784	Ed25519 (SLIP-0010); address = 0x + 32-byte pubkey hex
Aptos	`m/44'/637'/0'/0'`	637	Ed25519 (SLIP-0010); address = 0x + SHA3-256(pubkey)

Key observations

All EVM chains share coin_type = 60 - the same key yields the same 0x… address on Ethereum, Polygon, BSC, etc. (you still pay gas on the chain you use).
Bitcoin changes the purpose number (44 / 49 / 84 / 86) to pick address type, not just coin type.
Solana uses Ed25519 derivation (SLIP-0010). You cannot get a Solana address by plugging the same path into a raw secp256k1-only helper.
Ed25519 chains (Solana, Sui, Aptos) share the SLIP-0010 derivation pipeline. Every path segment must be hardened; there are no normal (unhardened) children. Sui's address is the raw 32-byte Ed25519 public key as hex; Aptos hashes it with SHA3-256.
Cosmos uses the same secp256k1 curve as Bitcoin/Ethereum, but its address is Bech32 with the cosmos HRP over a raw 20-byte hash160 - not a Bitcoin-style witness version.
Non-standard paths are valid mathematically but wallets may not scan them - backup risk.

Learning Path: From Seed to Address

Walk through the key stages of HD wallet derivation. Each step builds on the previous one.

Seed

Master Key

Path

Hardened

Address

1. The BIP39 Seed Phrase

A mnemonic seed phrase is a human-readable encoding of random entropy. It is the root of your entire wallet tree.

12 words = 128 bits of entropy + 4-bit checksum
24 words = 256 bits of entropy + 8-bit checksum
The last word is partially determined by the checksum of all previous words
The wordlist has exactly 2048 words (2¹¹) - each word encodes 11 bits


Entropy (128-256 bits)
    |
    v
BIP39 Checksum (4-8 bits)
    |
    v
Split into 11-bit chunks - each maps to a word from the 2048-word list
    |
    v
Mnemonic phrase (12 or 24 words)
    |
    v
PBKDF2(mnemonic, passphrase, 2048 rounds) - 512-bit seed

Bring your own randomness: By default this tool uses the browser's CSPRNG. If you distrust software RNG, open the Physical entropy lab on the Derive tab (enable Expert mode): roll dice or flip coins, and the SHA-256 hash of your rolls becomes the entropy instead.

2. From Seed to Master Key (BIP32)

The 512-bit seed from PBKDF2 is split into two halves to create the master key pair.

HMAC-SHA512(key="Bitcoin seed", message=seed) produces 512 bits
Left 256 bits = master private key (the root secret)
Right 256 bits = master chain code (entropy for child derivation)
Every child key in the tree derives from this master node


512-bit seed (from PBKDF2)
    |
    v
HMAC-SHA512(key="Bitcoin seed", data=seed)
    |
    +--- Left 256 bits: Master Private Key
    |
    +--- Right 256 bits: Master Chain Code
    |
    v
Master Node (m) = private key + chain code
    |
    v
Child keys: CKD(parent, index) - child private key + child chain code

3. The Derivation Path

A derivation path navigates the HD key tree. Each level has a specific purpose.

m / purpose' / coin_type' / account' / change / address_index

purpose' Which BIP standard: 44 (legacy), 49 (wrapped segwit), 84 (native segwit), 86 (taproot)

coin_type' SLIP-0044 coin index: 0=BTC, 60=ETH, 501=SOL, 195=TRX, 2=LTC, 3=DOGE, 118=COSMOS, 784=SUI, 637=APTOS

account' Separates independent wallets from the same seed (account 0, 1, 2...)

change 0 for external (receiving) addresses, 1 for internal (change) addresses (UTXO only)

index The nth address in this chain. Most wallets increment this for each new address

4. Hardened vs Normal Derivation

The apostrophe (') means hardened - the child key requires the parent private key, not just the public key.

Type	Security / UX	Typical use
Hardened (`'`)	Higher isolation; cannot derive from watch-only parent xpub	purpose, coin_type, account; Solana last segment
Normal	Derivable from xpub; useful for generating receiving addresses without the private key	change + index on Bitcoin-like chains

Why harden the first levels? If someone gets your xpub for account 0, they can derive all addresses in that account. But they cannot derive hardened children, so the master key and sibling accounts remain safe.

Ed25519 chains are fully hardened. Solana, Sui, and Aptos use Ed25519 keys via SLIP-0010. SLIP-0010 requires every path segment to be hardened, not just the first few. This is why their paths look like m/44'/501'/0'/0' with no unhardened levels.

5. From Private Key to Address

The private key produces a public key, which is then encoded into an address format specific to each blockchain.

Ethereum / EVM

Private key - secp256k1 public key - Keccak-256 - last 20 bytes - 0x...

Bitcoin

Private key - secp256k1 public key - SHA-256 - RIPEMD-160 - encode with version byte + checksum - address varies by purpose (P2PKH, P2SH, Bech32, Bech32m)

Solana

Private key (Ed25519) - public key (32 bytes) - Base58 encode - address

Tron

Same as Ethereum (Keccak-256 of public key) but encoded as Base58Check starting with T

Cosmos

Same secp256k1 curve as Bitcoin/Ethereum, but the address is Bech32 with the cosmos HRP over the raw 20-byte hash160 of the compressed public key (no witness version byte).

Sui

Ed25519 key (SLIP-0010). The address is simply 0x + the 32-byte raw Ed25519 public key as lowercase hex. No hashing of the public key.

Aptos

Ed25519 key (SLIP-0010). The address is 0x + SHA3-256(32-byte public key || 0x00 scheme byte). Uses the browser Web Crypto API for SHA3-256 (ethers v5 has no SHA3).

1 / 5

Understanding derivation paths

A path is a route through a tree of keys. The usual BIP44 layout:

m / purpose' / coin_type' / account' / change / address_index

Solana in this tool: m / purpose' / 501' / account' / index' - the extra hardened level replaces change / index so Phantom first account matches account=0, index=0 in the form.

Path structure breakdown

Level	Symbol	Meaning	Example values
Master	`m`	Root of the HD tree	Always `m`
Purpose	`44'`	Which BIP family	44, 49, 84, 86...
Coin type	`60'`	Registered coin index (SLIP-0044)	0 BTC, 60 ETH, 501 SOL...
Account	`0'`	Separate accounts	0, 1, 2...
Change	`0`	External (0) vs internal change (1) for UTXO	0 or 1 - ignored for Solana in this UI
Address index	`0`	Nth address in that chain	0, 1, 2... - for SOL, this field is the last hardened index

Hardened vs normal derivation

The apostrophe (') means hardened: child keys require the parent private key, not just an xpub.

Type	Security / UX	Typical use
Hardened (`'`)	Higher isolation; cannot derive from watch-only parent	purpose, coin_type, account; and Solana last segment
Normal	Derivable from xpub - good for receiving addresses	change + index on Bitcoin-like chains

Common scenarios

MetaMask Account 1, 2, 3...

Often increments the final address_index (not account):

m/44'/60'/0'/0/0 m/44'/60'/0'/0/1 m/44'/60'/0'/0/2

Multiple wallets from one seed

Bump account for separation:

m/44'/60'/0'/0/0 m/44'/60'/1'/0/0

Same EVM address everywhere

Because EVM chains use coin type 60, the same path gives the same 0x address on many networks, but balances and contracts differ per chain.

Tron uses the same curve, not the same display

Coin type 195 and path like m/44'/195'/0'/0/0 give a secp256k1 key. The Keccak-256 of the uncompressed public key (same idea as Ethereum) becomes the 20-byte payload, but Tron shows it as a Base58Check string starting with T, not 0x.

Important notes

Same seed + same path = same keys (deterministic).
Losing the path can mean losing access even if you keep the words.
Compare any result against a second tool or a test wallet before mainnet use.

HD derivation tree inspector

Step 1: click Build tree from current seed below (uses the mnemonic from the Derive tab). Step 2: the root and its first branches appear. Click any node to derive its keys; click a branch node again to expand or collapse its children.

No tree yet. Click "Build tree from current seed" above to start.

Click a tree node on the left to see its derived keys, extended key (xprv/xpub), and EVM address here.

Try it yourself

Visualize the tree - click "Build tree from current seed" above to see every derivation branch and click nodes to derive keys.
Find a lost path - on the Experiments tab, use "Path recovery" to scan ~15 common wallet paths and match a known address back to its derivation.
Bring your own entropy - on the Derive tab, enable Expert mode to open "Physical entropy lab" and roll dice to create a seed without trusting software RNG.

Alpha features. These tools are experimental and may change. They use the mnemonic and BIP39 passphrase from the Derive tab (Step 1).

Recover a seed

Find typos or the lost last word of an existing mnemonic. Type your mnemonic in the Derive tab Step 1, then use these tools.

Where are my funds? Path recovery

Restored a seed in a new wallet and see no balance? Different wallets use different derivation paths. Paste the address you expect, and this scans ~15 common paths to find the match.

Target address (the one you expect to hold funds)

Uses the mnemonic and BIP39 passphrase from Step 1 (Derive tab).

Explicit path & encoding

BIP32 extended keys (secp256k1)

All UTXO formats (same private key)

Batch derive (same path, varying index)

Derive from extended key (XPUB / XPRV)

Critical security warning - read this

1. The BIP39 Seed Phrase

2. From Seed to Master Key (BIP32)

3. The Derivation Path

4. Hardened vs Normal Derivation

5. From Private Key to Address