BIP85 is an application specification for deterministically deriving entropy from a BIP 32 private root. It reproduces children without handing the master root to destination wallets; it does not split a backup into shares.
The input is a BIP 32 extended private root, not arbitrary text. BIP 39 first encodes entropy as a phrase, then produces a seed for the root from that phrase and a passphrase. BIP85 does not reverse this process: it cannot recover the original phrase from the root. It produces new, application-separated entropy. [BIP 85 — Deterministic Entropy From BIP32 Keychains] [BIP 32 — Hierarchical Deterministic Wallets] [BIP 39 — Mnemonic code for generating deterministic keys]
Every derivation step is hardened. The resulting 32-byte private key k becomes the message for HMAC-SHA512 with the key bip-entropy-from-k; the output is 64 bytes. A public xpub is insufficient. This transformation separates the resulting entropy from the key; it is not an instruction to also use that key for signing. [BIP 85 — Deterministic Entropy From BIP32 Keychains] [BIP 32 — Hierarchical Deterministic Wallets]
The path m/83696968'/39'/0'/12'/0' selects BIP85, the BIP 39 application, the English wordlist, 12 words and index 0. Index 1 produces another child. The Czech wordlist code is 8', regardless of this page's language. Changing language or word count changes the path, not just the presentation of the same phrase. [BIP 85 — Deterministic Entropy From BIP32 Keychains]
For 12 words, take the first 128 output bits; for 24 words, take the first 256 bits. BIP 39 adds the checksum and words. Creating the seed afterwards is a separate step. BIP85 itself defines neither scripts, address paths nor wallet history. A longer output cannot increase the uncertainty of a weak original secret. [BIP 85 — Deterministic Entropy From BIP32 Keychains] [BIP 39 — Mnemonic code for generating deterministic keys]
The XPRV application uses m/83696968'/32'/0': the first 32 bytes become the chain code and the second 32 the private key, reversing the order used to create a BIP 32 root. An invalid resulting scalar must produce an error; the user chooses the next index. HEX and passwords have different applications and format rules. [BIP 85 — Deterministic Entropy From BIP32 Keychains] [BIP 32 — Hierarchical Deterministic Wallets]
With a correct implementation, deriving the parent or siblings from a child is computationally infeasible. Anyone obtaining the master root and derivation context can reproduce children; losing the root endangers those without separate backups. Exporting a child to a connected wallet therefore limits the scope of a possible leak, but does not repair a compromised master root. [BIP 85 — Deterministic Entropy From BIP32 Keychains] [COLDCARD — Export Deterministic Entropy (BIP-85)]
The parent BIP 39 phrase's passphrase changes the input root and all its children. An additional passphrase applied to the derived phrase in the destination wallet changes that wallet's seed; BIP85 does not back up this passphrase. Recovery needs the exact parent context, application, format, wordlist, length and index, plus any destination passphrase. [BIP 39 — Mnemonic code for generating deterministic keys] [COLDCARD — Export Deterministic Entropy (BIP-85)]
COLDCARD documentation describes reproduction using the same parent, format and index, and exports for BIP 39, WIF, XPRV and HEX. BIP85 support does not imply support for every application. Before relying on a backup, verify reproduction of the child and destination wallet addresses; record the required parameters and check the particular implementation against public test vectors. [COLDCARD — Export Deterministic Entropy (BIP-85)] [BIP 85 — Deterministic Entropy From BIP32 Keychains]
For the clearest picture, read this entry together with HD Wallet, BIP 39, BIP39 passphrase, Derivation Path, Hardware Wallet. The reverse links also lead from Duress Wallet.