<blockquote>
  <p>2048^12 = 2^132 &lt;&lt; 2^256</p>
</blockquote>

<p>It doesn't need to be able to describe every private key. You always start with the mnemonic, never calculating a mnemonic from a private key.</p>

CC BY-SA 3.0
2017-09-08T16:42:50.390Z
But at some point (agreeably, a long time in the future; possibly after the heat death of the universe), the mnemonics will be exhausted but the private keys won't. Also, what stops clashes with private keys generated without the mnemonic?
Xophmeister
CC BY-SA 3.0
2017-09-08T16:45:05.647Z
Firstly 2^132 is a huge number. Roughly equal to the number of atoms in the universe. And that also answers your second question, where pure chance basically is the answer.
weston
CC BY-SA 3.0
2017-09-08T16:46:21.253Z
Actually, maybe not atoms in the universe, google failure there, but extremely huge.
weston
CC BY-SA 3.0
2017-09-08T16:48:11.093Z
I invite you to experiment with https://iancoleman.github.io/bip39/ a great resource for seeing how it works.
weston
CC BY-SA 3.0
2017-09-08T16:50:13.700Z
Also take a look at this https://bitcoin.stackexchange.com/questions/8804/is-each-bitcoin-address-unique which should answer your question on why there won't be clashes better than I can.
weston
CC BY-SA 3.0
2017-09-08T16:56:40.203Z
So it's a "drop in the ocean" argument...actually, I just calculated that (average drop is ~50ml, volume of water on Earth is ~1.4Tm^3) and even that's a vast under-representation (by 15 orders of magnitude), so maybe that's a good way of visualising it. I don't know why I didn't see this before; it's pretty obvious when put like that! Thanks :)
Xophmeister
CC BY-SA 3.0
2017-09-08T16:57:09.113Z
np, and what makes it even more amazing is that each mnemonic doesn't generate a single private key, but can generate infinite private keys on infinite derivation paths, and none of that matters, you still won't increase the chances of getting a clash
weston
CC BY-SA 3.0
2017-09-08T17:00:08.773Z
50ml is a big drop, that's 1/6-1/7th of a drink can!
weston
CC BY-SA 3.0
2017-09-08T17:01:36.537Z
Typo; I meant μl!
Xophmeister
CC BY-SA 3.0
2017-09-08T16:40:27.843Z
2017-09-08T16:40:27.843Z
weston
<p>The seed is actually a 512 bit number, but you can generate one from a 128-256 bit number.  This 128-256 bit number can be represented by a BIP39 mnemonic of 12-24 words.  Just as you can hash any integer (even just the number 1) and get a 256 bit number, so too can you generate a 512 bit number from a 128 bit number.</p>

<p>The 512 bit seed provides a starting point for your HD addresses, and you can generate all the addresses you will need from this one seed.</p>

CC BY-SA 4.0
2019-02-15T14:32:37.820Z
2019-02-15T14:32:37.820Z
John C.
<p>My understanding is that the 12-word seed is used to recover wallets' private keys. However, if each private key is 256-bits long, and the dictionary for the seed only contains 2048 words, then that's not nearly enough to cover them all: 2048^12 = 2^132 &lt;&lt; 2^256.</p>

<p>Where is my misunderstanding?</p>

CC BY-SA 4.0
2020-04-23T20:47:20.450Z
Note: a 12-word seed phrase encodes 128 bits of entropy.  24 word seed = 256. See [BIP-39](https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki#generating-the-mnemonic) for more details.
Jonathan Cross
<private-key><mnemonic-seed>
BIP39 seed and secret key
Xophmeister
# BIP39 seed and secret key

(Asked by: username_0 on 2017-09-08)

My understanding is that the 12-word seed is used to recover wallets' private keys. However, if each private key is 256-bits long, and the dictionary for the seed only contains 2048 words, then that's not nearly enough to cover them all: 2048^12 = 2^132 << 2^256.

Where is my misunderstanding?

**Tags:** private-key, mnemonic-seed

> **Comments:**
> **username_1**: Note: a 12-word seed phrase encodes 128 bits of entropy.  24 word seed = 256. See [BIP-39](https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki#generating-the-mnemonic) for more details.  

---

## 2 answers

### Answer by username_2 on 2017-09-08. Score: 2 | Accepted answer

> 2048^12 = 2^132 << 2^256

It doesn't need to be able to describe every private key. You always start with the mnemonic, never calculating a mnemonic from a private key.

> **Comments:**
> **username_0**: But at some point (agreeably, a long time in the future; possibly after the heat death of the universe), the mnemonics will be exhausted but the private keys won't. Also, what stops clashes with private keys generated without the mnemonic?  
> **username_2**: Firstly 2^132 is a huge number. Roughly equal to the number of atoms in the universe. And that also answers your second question, where pure chance basically is the answer.  
> **username_2**: Actually, maybe not atoms in the universe, google failure there, but extremely huge.  
> **username_2**: I invite you to experiment with https://iancoleman.github.io/bip39/ a great resource for seeing how it works.  
> **username_2**: Also take a look at this https://bitcoin.stackexchange.com/questions/8804/is-each-bitcoin-address-unique which should answer your question on why there won't be clashes better than I can.  
> **username_0**: So it's a "drop in the ocean" argument...actually, I just calculated that (average drop is ~50ml, volume of water on Earth is ~1.4Tm^3) and even that's a vast under-representation (by 15 orders of magnitude), so maybe that's a good way of visualising it. I don't know why I didn't see this before; it's pretty obvious when put like that! Thanks :)  
> **username_2**: np, and what makes it even more amazing is that each mnemonic doesn't generate a single private key, but can generate infinite private keys on infinite derivation paths, and none of that matters, you still won't increase the chances of getting a clash  
> **username_2**: 50ml is a big drop, that's 1/6-1/7th of a drink can!  
> **username_0**: Typo; I meant μl!  

---

### Answer by username_3 on 2019-02-15. Score: 1

The seed is actually a 512 bit number, but you can generate one from a 128-256 bit number. This 128-256 bit number can be represented by a BIP39 mnemonic of 12-24 words. Just as you can hash any integer (even just the number 1) and get a 256 bit number, so too can you generate a 512 bit number from a 128 bit number.

The 512 bit seed provides a starting point for your HD addresses, and you can generate all the addresses you will need from this one seed.


---

