BIP-39 Mnemonic Generator & Validator

Generate a 12–24-word English BIP-39 seed phrase from cryptographic entropy, verify the SHA-256 checksum bits on any phrase, round-trip mnemonic ↔ entropy, and derive the 512-bit BIP-39 seed (PBKDF2-HMAC-SHA512, 2048 iterations, "mnemonic" + passphrase salt) that HD wallets feed into BIP-32. Everything runs in your browser — the seed never touches the network.

⚠ Security: if you plan to store real funds against a phrase produced here, generate it on an air-gapped machine you trust. This page uses crypto.getRandomValues (a browser CSPRNG), does no network I/O, and the source is on GitHub — but a compromised browser or extension could still read the DOM. For play/test wallets it's fine.

Generate

word count / entropy

optional BIP-39 passphrase (25th word)

Validate & decode a phrase

mnemonic phrase (space-separated, case-insensitive) passphrase for seed derivation

show entropy + checksum bits

Entropy → mnemonic

entropy (hex, multiples of 32 bits: 32, 40, 48, 56, or 64 hex chars)

Reference vectors (Trezor test)

Load a known-good vector from the BIP-39 spec appendix — useful for verifying this page against another implementation.

How BIP-39 works

Pick ENT bits of entropy from a CSPRNG: 128, 160, 192, 224, or 256.
Compute the first ENT/32 bits of SHA-256(entropy) — those are the checksum CS.
Concatenate: entropy_bits + checksum_bits ⇒ length is a multiple of 11.
Split into 11-bit groups; each group indexes into the 2048-word English wordlist.
Seed = PBKDF2(mnemonic_utf8_nfkd, "mnemonic"+passphrase_utf8_nfkd, HMAC-SHA512, 2048), 64 bytes out. This seed becomes the BIP-32 master key.

The passphrase is not validated by any checksum — a typo simply derives a different, empty wallet. Store it as carefully as the phrase itself.