The twelve words are not a password, and no one chose them for their meaning. They represent a number — the same number described in the previous lesson — written in a way that a person can copy by hand without error. Replacing digits with words doesn't weaken anything: it's just a form of writing.
It all starts with a draw. The wallet asks the operating system, or a chip dedicated to the task, for 128 unpredictable bits. This handful of bits is the entropy, and it's the only thing in this entire lesson that needs to be secret. Everything else is public knowledge.
These 128 bits are then cut into pieces of eleven. Eleven bits count from zero to 2047, and that's exactly why the BIP-39 list has 2048 words: each word is the name of an eleven-bit number, nothing more. Twelve words carry 132 bits in total — the 128 drawn plus four that we will explain later.
The list was carefully assembled. It is ordered alphabetically, has no two words that resemble each other, and the first four letters of each word already distinguish it from all the others — if you write down just four letters, you've noted the entire word. The standard was proposed in 2013 by Marek Palatinus, Pavol Rusnák, Aaron Voisine, and Sean Bowe, and since then it has become the format that almost every wallet in the world understands.
The four remaining bits are the checksum, and this is where the last word is no longer free. The SHA-256 of the entropy is calculated, the first four bits of the result are taken, and they are attached to the end before the cut into elevens. That's why the twelfth word can't be just any word: it carries, within itself, the verification of the previous eleven. A phrase with one wrong word is rejected in fifteen out of sixteen cases, and that's the message the wallet shows when it says the seed is invalid.
This explains why the order matters as much as the words. The phrase is not a set; it's a sequence. Two words swapped in position form another number, which generates another wallet, with a different balance — almost always zero. Writing down the twelve words out of order is like writing a phone number with scrambled digits.
The final step transforms the phrase into a seed, and it is deliberately slow. The words, written in text, enter a function called PBKDF2, which applies HMAC-SHA-512 two thousand and forty-eight times in succession. The result is a 512-bit number: the seed. The repetition exists to make it costly for anyone trying to guess phrases — each attempt costs two thousand times more than it would with just one pass.
Notice a strange and important consequence of this last step. The calculation uses the text of the words, not their position on the list. The list is for you to write and check; the seed comes from the letters. That's why a valid phrase in Italian or Japanese, which BIP-39 also provides for, produces a different seed from anything in English, and why an extra space or a different accent ruins the entire result.
And what happens if a word is missing? The case isn't lost, although it's laborious: there are 2048 possibilities for that position, and the checksum discards almost all of them. Recovery tools do this in seconds. Missing two or three words, the number of combinations grows and the calculation starts to get serious; missing half the phrase, recovery is impossible. It's the difference between an incomplete note and a lost note — and it's the argument for checking the paper before you need it.
This 512-bit seed is not yet a key. It is the root from which thousands of them emerge, organized in a tree with addresses that look like spells, such as m/84'/0'/0'/0/0. In the next lesson, what each symbol in this path means.