Bitcoin Universe · Model 07

The recovery phrase machine

How twelve ordinary words can rebuild a whole wallet: a random number, a checksum, a word list, an optional passphrase, a slow hashing press and a tree of keys.

Public test vectors only

Never type your own recovery phrase into this or any website. The four phrases here are published test examples: anyone can take money sent to them, so they are never safe for real funds. A recovery phrase is not a password; the optional passphrase is different again from the password that unlocks a wallet app.

Example entropy

Stage 1 of 7

Entropy

What the machine made

Restore a test wallet

A second wallet receives these words. Change a word with “next word” to see the checksum at work, or untick the passphrase to land in a different wallet. There is no free text entry on purpose.

Use the demonstration passphrase when restoring

1 bits, checksum bits, the active stage and data in flight Public test vectors

Every value is computed for real: SHA-256 checksum, the official BIP39 English word list, PBKDF2-HMAC-SHA512 with 2,048 rounds, BIP32 derivation along the BIP84 path, and the bech32 address. The four example phrases and the passphrase “TREZOR” are the published BIP39 test vectors.