BIP39 passphrase

Imagine a wallet you created without a passphrase and its recovery words. Those words alone are enough to derive the same set of keys. When you enter a passphrase, the wallet combines both inputs to calculate a different starting point for its keys, called a seed. You are now accessing a different wallet, rather than adding a lock to the original one. A PIN usually unlocks the device; a passphrase helps determine the keys themselves. It is sometimes called the “25th word”, but it need not be a single word or an item from the BIP39 wordlist. [1] [2]

With an ordinary account, a typo usually produces a “wrong password” message. Here, the same mistake can open a different, usually empty wallet: BIP39 has no passphrase checksum. Your original bitcoin has not been deleted. First check the backup, the exact text you entered, the account and the recovery settings. Letter case and spaces matter too. There is a technical exception: some Unicode spellings, such as é and an e followed by a combining accent, become identical under NFKD normalization. In practice, still keep an exact record; do not rely on characters looking similar. The application may add its own confirmation or checks. [1] [2]

If someone obtains your recovery words, a sufficiently unpredictable passphrase can make reaching the right wallet much harder. But it must remain secret and difficult to guess. A birthday, a familiar quotation or a password reused elsewhere is a weak choice. An attacker with the words can try guesses offline, on their own computer without asking your device. Its PIN and attempt limit will not stop that attack. If you are not yet confident about ordinary backup and recovery, learn those first. A more complicated arrangement is not automatically safer. [1] [2]

If you start entering a new passphrase, funds in the original wallet remain controlled by the original keys. To switch, first check the new wallet and its recovery process, then actually send bitcoin to it. The same applies when moving from a wallet without a passphrase. Do not confuse this with changing the PIN: changing how you unlock a device does not itself create a new set of Bitcoin keys. [2] [3]

Record the exact passphrase securely and consider who could find it when legitimately needed. Keeping it separate from the recovery words reduces the risk of both leaking together, but must not prevent recovery or inheritance. A strong, forgotten passphrase with no backup may be impossible to recover. Before depositing a larger amount, test recovery using a trusted procedure for that wallet. Keep the necessary settings too, such as the address type and the derivation path that tells the wallet where to look for accounts. An Output Descriptor is a machine-readable description of these rules; where supported, it can be an important part of the backup. It does not replace a missing passphrase. [2] [3]

Different passphrases can be used for separate wallets. Some people therefore keep a smaller decoy wallet too. There is no guarantee, however, that an attacker will believe you have shown them everything. Payment records, backups or other traces may reveal further holdings. Resistance to password guessing and safety under physical coercion are different concerns. [1]

You do not have to perform this calculation yourself to use a wallet. BIP39 supplies the recovery words as the password input to PBKDF2-HMAC-SHA512. The second input is called salt and takes the form "mnemonic" + passphrase. Here, salt is the technical name for an additional input, not another item you must invent or back up. The recovery words are not appended to it. Both text inputs undergo NFKD normalization and UTF-8 encoding. After 2048 iterations, the result is a 512-bit seed, or 64 bytes. Without a passphrase, that phrase is empty, but the salt still contains "mnemonic". A long output or repeated calculation does not turn an easily guessed passphrase into a strong secret. [1]