Never type a real seed here. This page is an educational tool for testing and learning. Any seed you enter or generate stays in this browser tab and is shown on screen in plain text. For a wallet you actually use, generate and sign on a trusted offline machine.
Same mnemonic + different passphrase → completely different wallet. Any string is valid; there is no wrong passphrase, only wrong remembering. If you lose it, you lose the wallet permanently.
Security: This page runs entirely in your browser. No data is ever sent to any server. For production wallets, always generate and sign on a trusted offline (air-gapped) machine.
Off: seeds use the browser CSPRNG. On: type your own dice rolls or coin flips and their hash becomes your seed.
Don't know which derivation path to use? Just pick any preset that matches your chain. The path is a template you can customize below. To understand what each path segment does, visit the Learn Paths tab or the Blockchain Guide tab.
How encoding works here: All BIP32 keys via ethers.js (loaded once as UMD). EVM / Tron: ethers Wallet + Keccak-256. Bitcoin-family (0/2/3): pure JS using only ethers primitives - sha256, ripemd160, computePublicKey + inline Bech32 - no bitcoinjs-lib, no CDN class bugs. Ed25519 chains (501/784/637): SLIP-0010 implemented inline on ethers' HMAC-SHA512, plus the TweetNaCl global. Nothing here needs a secure context or a server, so every tab works from file:// with the network off.
Brute-forces random secp256k1 keypairs until an address matches your pattern. Runs on the main thread in small batches - UI stays responsive, works 100% offline (no CDN needed).
Difficulty grows exponentially: Each extra hex character takes ~16× longer. A 4-char prefix like 0xcafe averages ~65,000 tries; a 6-char prefix averages ~16 million. The key is cryptographically random - as secure as any other key.
Brain wallets are always unsafe for real money. Attackers precompute hashes of billions of phrases: quotes, lyrics, passwords, Bible verses, Wikipedia sentences. Funds on brain wallets are routinely stolen within hours. Even a "strong" passphrase has far less entropy than 12 random BIP39 words.
Use the Derive Keys tab for real wallets. This tab exists solely to demonstrate cryptographic concepts.
Adds another layer: the mnemonic is always the same SHA-256 output, but this extra word changes every derived key.
This is a single static HTML page with no build step. Every library is served from this site rather than a CDN, so the page makes no third-party requests and works with the network switched off. Mnemonics never leave the device unless you copy them. The Derive tab turns a BIP39 phrase + path into addresses for Ethereum, Bitcoin (Legacy/SegWit/Native/Taproot), Solana, Tron, Litecoin, Dogecoin, Cosmos, Sui, and Aptos. Vanity searches for EVM address prefixes. Brain wallet demonstrates why human-chosen entropy is unsafe. The Derive tab also has a Physical entropy lab (type your own dice rolls or coin flips so the seed does not depend on your computer alone, enable Expert mode to see it), a paper wallet printer, and an HD tree inspector on the Learn Paths tab. The Experiments tab has a Mnemonic diagnostics panel (find typos or the lost last word) and a Path recovery scanner (match a known address to its derivation path). The current seed also shows in the sticky bar above the tabs. Solana, Sui, and Aptos derivation needs the page served over http:// or https://, because ES module loading is blocked from a file:// origin. Everything else, including the entropy lab and brain wallet, works from file://.
Stack: ethers v5 (BIP32 + UTXO crypto); tweetnacl + inline SLIP-0010 (Solana, Sui, Aptos); qrcode; @noble/hashes (BLAKE2b for Sui, SHA3-256 for Aptos). UTXO chains use zero extra libraries - pure inline Bech32 + ethers primitives. Theme stored in localStorage. All libraries live in src/vendor/ and are served from this site, so nothing is fetched from a third party. To run it air-gapped, clone the repository and open the page with any local server.
It computes. It does not sign a transaction, does not broadcast anything to any network, and does not hold funds at any point, so there is nothing here to check a balance against or to "log into". A seed phrase and the addresses it derives are pure mathematics; using them to actually receive, send, or check funds needs a wallet application or a block explorer, not this page. Generate, back up, and understand a seed here if that helps, then use it in the software you intend to actually run it with.
Click any row to load that preset into the Derive tab and see the real address for the seed you have loaded.
Each row is a common convention. Your wallet might use a different path for recovery - always check its docs.
| Blockchain | Derivation path | Coin type | Notes |
|---|---|---|---|
| Ethereum | m/44'/60'/0'/0/0 | 60 | MetaMask, Trust Wallet, most EVM “account 0” |
| Bitcoin (Native SegWit) | m/84'/0'/0'/0/0 | 0 | bc1q… addresses (BIP84) |
| Bitcoin (Wrapped SegWit) | m/49'/0'/0'/0/0 | 0 | 3… nested SegWit (BIP49) |
| Bitcoin (Legacy) | m/44'/0'/0'/0/0 | 0 | 1… P2PKH (BIP44) |
| Bitcoin (Taproot) | m/86'/0'/0'/0/0 | 0 | bc1p… (BIP86) - experimental on some altcoins |
| Solana | m/44'/501'/0'/0' | 501 | Phantom / Solflare-style; Ed25519 not secp256k1 |
| Polygon | m/44'/60'/0'/0/0 | 60 | Same as Ethereum (EVM) |
| BSC | m/44'/60'/0'/0/0 | 60 | Same as Ethereum (EVM) |
| Avalanche C-Chain | m/44'/60'/0'/0/0 | 60 | Same as Ethereum (EVM) |
| Tron | m/44'/195'/0'/0/0 | 195 | TronLink-style; secp256k1, Base58 T… address |
| Arbitrum | m/44'/60'/0'/0/0 | 60 | Same as Ethereum (EVM) |
| Optimism | m/44'/60'/0'/0/0 | 60 | Same as Ethereum (EVM) |
| Litecoin | m/44'/2'/0'/0/0 | 2 | Legacy; use purpose 84/49 for SegWit-style LTC |
| Dogecoin | m/44'/3'/0'/0/0 | 3 | Legacy-style; SegWit less universal on DOGE |
| Bitcoin Cash | m/44'/145'/0'/0/0 | 145 | Not modeled in this tool - would need BCH params |
| Cardano | m/1852'/1815'/0'/0/0 | 1815 | CIP-1852; different from BIP44-only wallets |
| Cosmos | m/44'/118'/0'/0/0 | 118 | secp256k1 + Bech32 with cosmos HRP (Keplr-style) |
| Sui | m/44'/784'/0'/0' | 784 | Ed25519 (SLIP-0010); address = 0x + BLAKE2b-256(0x00 || pubkey), not the pubkey itself |
| Aptos | m/44'/637'/0'/0' | 637 | Ed25519 (SLIP-0010); legacy address (SDK default) = 0x + SHA3-256(pubkey || 0x00). SingleKey accounts from the same seed use a different address. SHA3-256, not Keccak-256 |
coin_type = 60 - the same key yields the same 0x… address on Ethereum, Polygon, BSC, etc. (you still pay gas on the chain you use).cosmos HRP over a raw 20-byte hash160 - not a Bitcoin-style witness version.0x… as yours. The chain is chosen by the network you broadcast to, not by the address, which is why funds sent on the wrong network still land at "your" address but need that network's gas to move.1…, 3…, bc1q… and bc1p…. Restoring a seed in a wallet that only scans one purpose is the usual reason coins look missing: they are at a different purpose on the same seed.Walk through the key stages of HD wallet derivation. Each step builds on the previous one.
A mnemonic seed phrase is a human-readable encoding of random entropy. It is the root of your entire wallet tree.
Entropy (128-256 bits)
|
v
BIP39 Checksum (4-8 bits)
|
v
Split into 11-bit chunks - each maps to a word from the 2048-word list
|
v
Mnemonic phrase (12 or 24 words)
|
v
PBKDF2(mnemonic, passphrase, 2048 rounds) - 512-bit seed
The last word carries the checksum. Type a different real BIP39 word in its place and watch whether the checksum still passes.
Bring your own randomness: By default this tool uses the browser's CSPRNG, which is not a plain software RNG. It is a thin wrapper over the operating system, which seeds itself from hardware noise such as the CPU's on-die thermal-noise generator and interrupt timing. If you would rather not depend on that, open the Physical entropy lab on the Derive tab (enable Expert mode) and type your own dice rolls or coin flips. The SHA-256 hash of what you type becomes the entropy instead. The value of real dice is not that they are more random than the CPU, it is that they do not depend on your machine, so malware on it cannot predict them. The simulate buttons in that panel use the browser CSPRNG, so real throws are what matter.
Every one of these produces a valid seed phrase that looks exactly as convincing as the others. What differs is how many guesses stand between an attacker and your coins. Type a passphrase to see where your own idea would land.
Move this and watch every row above change. The point is what stays true regardless: 128 bits stays absurd at any of these speeds, while the weak rows do not need a fast attacker to fall, only a patient one.
To reach 128 bits using random words you could actually memorise, you need ten Diceware words: 777610 is about 2129. But if you can memorise ten random words, you can memorise a twelve word BIP39 phrase, which is the same strength, carries a checksum that catches typos, and is restorable in every wallet. That is the whole argument against inventing your own: it is not merely riskier, it is worse at the one job it was supposed to do.
The BIP39 passphrase is a second, separate secret, not a strengthening of the first. The same words with no passphrase and with any passphrase are two completely unrelated wallets. Forgetting this "25th word" is the most common reason people believe a restored wallet is empty - it usually is not, it is just the wrong branch.
In July 2026, a hardware Bitcoin wallet lost roughly $116M this way. A firmware build flag was checked for whether it existed rather than what it was set to, which silently routed seed generation to a poorly-seeded software random number generator instead of the device's hardware source. Effective entropy collapsed from 128 bits to as little as 40. The output still looked like a completely normal, valid, checksummed recovery phrase - there was no visual tell, the same way there was no visual tell in this tool's own Sui bug. The bug sat in open-source code for five years before anyone noticed.
The maker's own advice to affected users: seeds built from real dice rolls were never at risk, because that path never touched the broken code. That is exactly the Physical entropy lab above. This tool's own randomness is checked for the equivalent failure on every load; see the note in the entropy lab if you want the detail.
After an incident like that one, the useful question is not "what is safest" but "which defence protects against which failure, at which moment". These are the ones that matter, and their limits:
Answer in your head first, then open the question. Recalling an answer before seeing it is what makes it stick.
128. Twelve words carry 132 bits and the last 4 are checksum, so the secret part is 128 bits. 24-word phrases carry 256.
Almost always the wallet refuses: the checksum no longer matches. There is a 1-in-16 chance (12 words) or 1-in-256 (24 words) the mistake still passes and silently derives a different, empty wallet - which is why typing words carefully matters.
No. The passphrase selects a different branch of a tree whose root is still the guessable entropy. An attacker who sweeps the seed can sweep the passphrase branches too. Strength has to be in the entropy itself.
Trust nothing, including this tool. The checks below recompute the official BIP39, BIP32, BIP44 and BIP84 test vectors right now, in your browser, with the same code the Derive tab uses. Every row must read PASS. A FAIL means this copy of the page is broken or has been tampered with: do not use it, and re-download it from the official repository.
A path is a route through a tree of keys. The usual BIP44 layout:
Solana in this tool: m / purpose' / 501' / account' / index' - the extra hardened level replaces change / index so Phantom first account matches account=0, index=0 in the form.
| Level | Symbol | Meaning | Example values |
|---|---|---|---|
| Master | m | Root of the HD tree | Always m |
| Purpose | 44' | Which BIP family | 44, 49, 84, 86... |
| Coin type | 60' | Registered coin index (SLIP-0044) | 0 BTC, 60 ETH, 501 SOL... |
| Account | 0' | Separate accounts | 0, 1, 2... |
| Change | 0 | External (0) vs internal change (1) for UTXO | 0 or 1 - ignored for Solana in this UI |
| Address index | 0 | Nth address in that chain | 0, 1, 2... - for SOL, this field is the last hardened index |
The apostrophe (') means hardened: child keys require the parent private key, not just an xpub.
| Type | Security / UX | Typical use |
|---|---|---|
Hardened (') | Higher isolation; cannot derive from watch-only parent | purpose, coin_type, account; and Solana last segment |
| Normal | Derivable from xpub - good for receiving addresses | change + index on Bitcoin-like chains |
Often increments the final address_index (not account):
m/44'/60'/0'/0/0
m/44'/60'/0'/0/1
m/44'/60'/0'/0/2
Bump account for separation:
m/44'/60'/0'/0/0
m/44'/60'/1'/0/0
Because EVM chains use coin type 60, the same path gives the same 0x address on many networks, but balances and contracts differ per chain.
Coin type 195 and path like m/44'/195'/0'/0/0 give a secp256k1 key. The Keccak-256 of the uncompressed public key (same idea as Ethereum) becomes the 20-byte payload, but Tron shows it as a Base58Check string starting with T, not 0x.
Every scam around seed phrases is a version of one trick: getting you to expose the words. Read each scenario, decide what is really being asked, then open it to compare.
The offer is: give me your words. There is nothing to verify - a valid phrase is valid. Whoever receives it owns the wallet within minutes.
No legitimate support channel, ever, asks for the words. The words are not a credential you present; they are the wallet itself. The "suspicious activity" is this conversation.
A phrase already generated cannot be checked for bugs by looking at it - the risk lived in the device that made it, at creation time. Typing it anywhere simply hands it over.
Connecting a wallet never involves the phrase - signatures and approvals expose nothing reusable. Any input field asking for it is a drain attempt, however professional the page looks.
The jargon of this page in one place.
2048 is 211, so each word encodes exactly 11 bits with no waste. 12 words x 11 bits = 132 bits = 128 entropy + 4 checksum.
128 bits of entropy is already beyond any brute-force horizon; 24 words (256 bits) mainly help when you trust the phrase to survive partial exposure or want headroom against future attacks.
Mathematically possible, practically impossible: the space of seeds is so much larger than the space of addresses that a collision has never occurred by chance.
Usually a different derivation path (try the Path recovery tool on the Experiments tab) or a passphrase set long ago and forgotten. The funds are almost certainly fine.
It carries the checksum: in a 12-word phrase its last 4 bits are computed from all 128 entropy bits, so it is not freely choosable.
No. It only selects which branch of the tree exists. Forget it and that wallet is unreachable with today's technology, by design.
The 2048 English words every BIP39 wallet knows. Type to search - the uniqueness of the first four letters is verified live below every time you do.
Step 1: click Build tree from current seed below (uses the mnemonic from the Derive tab). Step 2: the root and its first branches appear. Click any node to derive its keys; click a branch node again to expand or collapse its children.
No tree yet. Click "Build tree from current seed" above to start.
Click a tree node on the left to see its derived keys, extended key (xprv/xpub), and EVM address here.
Alpha features. These tools are experimental and may change. They use the mnemonic and BIP39 passphrase from the Derive tab (Step 1).
Find typos or the lost last word of an existing mnemonic. Type your mnemonic in the Derive tab Step 1, then use these tools.
Restored a seed in a new wallet and see no balance? Different wallets use different derivation paths. Paste the address you expect, and this scans ~15 common paths to find the match.
Uses the mnemonic and BIP39 passphrase from Step 1 (Derive tab).