In BIP39 seed derivation, the mnemonic phrase is the input to PBKDF2-HMAC-SHA512, while mnemonic concatenated with the passphrase forms the salt. It is neither the device PIN nor another mandatory word from the list; without a passphrase, an empty string is used.
The mnemonic phrase and the salt mnemonic + passphrase are processed as UTF-8 with NFKD normalization. PBKDF2-HMAC-SHA512 performs 2048 iterations and returns 512 bits, or 64 bytes, of seed. The output length does not mean 512 bits of original secret randomness. [BIP39 — Mnemonic generation and seed conversion]
Letter case and spaces can change the result. At the same time, different Unicode spellings can produce the same input after NFKD: é and e followed by a combining acute accent are an example. It is therefore inaccurate to say that every differently written text must produce a different wallet. [BIP39 — Mnemonic generation and seed conversion]
BIP39 has no passphrase checksum. A typo can derive a valid seed and display a different, usually empty wallet; this does not mean the original funds were deleted. An application can request repeated entry or compare known data. A PIN that merely unlocks the device does not replace the passphrase. [BIP39 — Mnemonic generation and seed conversion] [Trezor — What is a passphrase]
An attacker holding the mnemonic backup can try passphrase candidates offline and compare derived data with the known wallet. A sufficiently unpredictable passphrase that has not leaked can make this attack harder. A short quotation, a reused password or 2048 iterations alone is no guarantee of protection. [BIP39 — Mnemonic generation and seed conversion]
If changing the passphrase derives a different seed, it does not change the signing conditions of existing outputs. Moving to a new wallet therefore requires an actual transaction. Likewise, an empty balance alone does not prove loss: first verify the correct input and recovery parameters. [Trezor — What is a passphrase] [BIP380 — Output Script Descriptors]
Back up the passphrase securely and test recovery through a trusted procedure. Storing it separately from the words reduces joint exposure but must still permit authorized recovery and inheritance. Recovering a strong forgotten passphrase without a backup may be impossible. Besides the words and passphrase, derivation paths and script descriptions may be needed; an Output Descriptor helps preserve these details. [Trezor — What is a passphrase] [BIP380 — Output Script Descriptors]
Another passphrase can serve a separate or decoy wallet. This does not guarantee that an attacker will believe the displayed balance or remove traces of payments and backups. Wallet separation, resistance to guessing and safety under coercion are different properties. [BIP39 — Mnemonic generation and seed conversion]
Letter case can change the wallet
The same mnemonic words with passphrases “alpha” and “Alpha” derive different seeds under BIP 39. These are short examples, not secure passwords. The specification has no passphrase checksum; a typo can open another, usually empty wallet. An application may add its own check.
For the clearest picture, read this entry together with BIP 39, PBKDF2, BIP39 checksum, Self-custody. The reverse links also lead from Seed Phrase, BIP 39, Cold Storage, BIP85.
01Is a passphrase the same as mnemonic words or a PIN?+
No. The words and optional passphrase are two inputs to BIP 39 seed derivation, both with NFKD normalization. If a passphrase was used, the words alone are insufficient. A device PIN does not replace it. Full recovery may also require derivation paths and script information.
02Does a passphrase protect leaked mnemonic words?+
A sufficiently unpredictable passphrase that did not leak with the words can make deriving the correct seed harder. An attacker with the words can still try candidates offline; a short or predictable passphrase is not reliable protection. Losing a strong passphrase without a backup can mean irrecoverable loss of access.