What is the BIP-39 wordlist?
Explore the BIP-39 wordlist and discover why it is 2,048 words long, how the 11 bit binary mapping and checksums work and what word length analysis reveals!
Jonathan Evans
Jon is a certified information systems security professional (CISSP) and founder of IT Security Locksmith
Background
BIP-39 or Bitcoin Improvement Proposal 39 defines the standard for creating seed phrases using English words. The proposal enables a very long cryptographically random binary number to be represented as easier to remember and articulate words. Sometimes they are referred to as seed phrases, recovery phrases or mnemonics.
BIP-39 was created on the 10th September 2013 and is licensed under MIT by Marek Palatinus, Pavol Rusnak, Aaron Voisine and Sean Bowe. Referenced from the official BIP-39 specification.
This article will take a closer look at the wordlist, the languages it is available in, its length, word selection, unique prefixes, selectivity and we finish off with an analysis of the wordlist.
If you are interested in finding out more about the standard in general our article BIP-39 Explained may be of interest.
BIP39 languages
The most frequently used BIP-39 wordlist is in English but other language variants exist. For simplicity and consistency it is recommended that the English version is used. This is to enable maximum support and compatibility from the majority of wallet vendors and crypto-service providers.
The language used is predominantly American English not British English with an exception for the British English spelling of word “artefact” not the American English spelling “artifact”. Obvious examples of American English spellings in the wordlist include: armor, color, favorite, flavor, harbor and labor.
Does this affect the functionality of the wordlist and how it’s used? The simple answer is no because every word in the list has a unique prefix for the first four letters and the spelling between British English and American English are the same for all words for the first four letters except 'artefact' / 'artifact'. The word in the BIP39 wordlist starting 'arti' is 'artist' and the risk of mistaking 'artifact' for 'artist' is low in our opinion.
The BIP-39 wordlist is available in other languages and referencing GitHub you can find Chinese (simplified and traditional), Czech, French, Italian, Japanese, Korean, Portuguese and Spanish.
More details can be found on the GitHub BIP-39 repository.
BIP-39 wordlist length
Let’s start with the BIP-39 wordlist itself. It comprises 2,048 words. The length is deliberate because 2048 = 2^11, meaning each word in the wordlist can represent each 11-bit binary value. The selection of 2,048 to provide a direct mapping to all 11-bit binary numbers is not coincidental it is by design.
BIP-39 supports various lengths of mnemonic, they are 12, 15, 18, 21 and 24. The longer the mnemonic the better from an entropy or security perspective because of the larger search space and enhanced resistance to brute force attacks. However, the longer length needs to be traded off against the need for more words to be recorded, remembered and recalled accurately. The mnemonic lengths defined are not arbitrary they have been selected deliberately. The tables below will help with understanding what’s happening and why mathematically it simply works.
| Mnemonic | Entropy | Multiple of 32 |
|---|---|---|
| 12 | 128 | 32 × 4 |
| 15 | 160 | 32 × 5 |
| 18 | 192 | 32 × 6 |
| 21 | 224 | 32 × 7 |
| 24 | 256 | 32 × 8 |
The challenging part to understand is how different mnemonic lengths can be supported while ensuring that the resultant binary value can always be divided into 11-bit chunks each of which maps to a word in the BIP-39 wordlist. Simply put “how does that work?”. It’s surprisingly simple. All you need to do is add checksum bits that guarantee division by 11 every time. The table below should help aid understanding.
| Mnemonic | Entropy | Multiple of 32 | Checksum | New Length | Divisible by 11 |
|---|---|---|---|---|---|
| 12 | 128 | 32 × 4 | 4 | 33 × 4 | Yes |
| 15 | 160 | 32 × 5 | 5 | 33 × 5 | Yes |
| 18 | 192 | 32 × 6 | 6 | 33 × 6 | Yes |
| 21 | 224 | 32 × 7 | 7 | 33 × 7 | Yes |
| 24 | 256 | 32 × 8 | 8 | 33 × 8 | Yes |
In the table above, you can see that each mnemonic has a random number that we call entropy. The length of the entropy is a multiple of 32. That is important to remember. The multiples are from 4 to 8. It is no coincidence that each checksum is also from 4 to 8 and corresponds to the multiple used. If you include the checksum the length is always (32 x n)+(1 x n) which equals (33 x n) and is always divisible by 11!
For the more technical reader the checksum design satisfies (Entropy + Checksum) mod 11 = 0 and the binary number being represented can always be divided into 11-bit values.
This design means that longer mnemonics have longer checksums. There’s a 4-bit checksum for a 12-word mnemonic whereas there’s an 8-bit checksum for a 24-word mnemonic. As a result there is a 1 in 16 chance of a random 12-word phrase having a valid checksum whereas there is a 1 in 256 chance of a random 24-word phrase having a valid checksum. The longer the checksum the stronger the error detection. Most accidental transcription errors will result in an invalid mnemonic but there may be rare instances where an incorrect phrase passes the validation checks but derives the wrong wallet. The checksum provides basic error detection but was not designed to detect all possible errors.
Wordlist alphabetical ordering
The BIP-39 wordlist is alphabetically sorted. This simplifies implementation by supporting binary search as opposed to sequential searching. It also makes prefix-based lookups more efficient.
Word binary mapping
Each word in the BIP-39 wordlist has a unique position and that position corresponds to an 11-bit binary value. If we take the first 10 words we have:
| Index | Word | Binary11 |
|---|---|---|
| 0 | abandon | 00000000000 |
| 1 | ability | 00000000001 |
| 2 | able | 00000000010 |
| 3 | about | 00000000011 |
| 4 | above | 00000000100 |
| 5 | absent | 00000000101 |
| 6 | absorb | 00000000110 |
| 7 | abstract | 00000000111 |
| 8 | absurd | 00000001000 |
| 9 | abuse | 00000001001 |
| 10 | access | 00000001010 |
There are 2048 words in total because 2^11 = 2048. Each word represents one of 2048 possible 11-bit binary values.
Unique prefix
The words selected for inclusion in the BIP-39 wordlist have by design unique prefixes for the first four letters. Entering the first four letters is sufficient to uniquely identify a BIP-39 word. Most modern wallets will then auto-complete the word for you. This design property allows wallets to support entry of only the first four letters during data entry to uniquely identify each word.
By designing the system such that no two words share the same four-letter prefix the probability of recording or using the wrong word is greatly reduced. A user who records only the first four letters of each word still has enough information to reconstruct their original mnemonic using the standard BIP-39 wordlist.
Selectivity
The BIP-39 specification tries to avoid words that are easily confused. As an example, because the authors selected the word ‘woman’ they avoided the word ‘women’. They also preferred commonly used words and short words.
The words selected are designed to maximise: memorability, readability and pronunciation clarity. This is achieved by using familiar everyday used words, concrete and abstract nouns, common verbs, familiar adjectives, short words, easily pronounced words and unique first four letters. The specification avoids rarely used words, technical terms, long words, obsolete words, similar spellings, similar sounding words and most proper nouns (with Satoshi being the notable exception).
Analysis of the wordlist
The wordlist as we have said comprises of 2,048 words. A breakdown of the distribution of word lengths can be found in the table below.
| Length | Count | Percentage |
|---|---|---|
| 3 letters | 103 | 5.03% |
| 4 letters | 442 | 21.58% |
| 5 letters | 555 | 27.10% |
| 6 letters | 508 | 24.80% |
| 7 letters | 352 | 17.19% |
| 8 letters | 88 | 4.30% |
73.5% of all BIP-39 words are between 4 and 6 letters long. This distribution and the avoidance of longer words make the system less error-prone and usable. The shortest words in the wordlist are three letters long and the longest are eight letters. There are 88 that are 8 letters long and no word exceeds eight letters.
Pulling it all together
To create a mnemonic there are five steps to be followed:
- Generate entropy – this is a very long random binary number
- Calculate checksum – the length depends on the entropy
- Append the checksum to the end of the entropy value
- Split the entropy + checksum into 11-bit chunks
- Map each chunk to a word in the BIP-39 wordlist
Conclusion
This article has highlighted that the BIP-39 wordlist combines four-letter prefixes, short word lengths and 11-bit binary mapping with usability in mind to reduce human error while achieving the cryptographic demands placed on it.
Memorable facts:
- Wordlist has 2,048 words (2^11)
- Every word can be uniquely identified from its first four letters
- More than 73% of the words in the wordlist are between 4 and 6 letters
- No word exceeds 8 letters
- The wordlist is alphabetically sorted to support binary search and auto-completion
- The list is mostly American English except for the British English spelling of 'artefact'
- A final fact we like is that the authors included ‘satoshi’ in the list as well as hedgehog, kangaroo, mosquito, scorpion, squirrel and tortoise!
If you enjoyed this article, please feel free to share a link and subscribe to our blog if you haven't already!