Modern wallets back up a single seed phrase and derive every key from it. Several BIPs define how.
BIP39: words to seed
The wallet generates 128 to 256 bits of random entropy and adds a checksum. The result is split into 11-bit chunks, each mapped to one of 2,048 words, giving 12 to 24 words. The words, plus an optional passphrase, go through PBKDF2-HMAC-SHA512 with 2,048 iterations and salt "mnemonic"+passphrase, producing a 512-bit seed. A different passphrase gives a completely different wallet.
BIP32: the key tree
HMAC-SHA512 of the seed gives a master private key and a 32-byte chain code. From any key, a child can be derived by index:
- Normal children (index below 231) can be derived from the parent public key, so an extended public key (xpub) can generate all receiving addresses without any private key. Ideal for watch-only wallets and shops.
- Hardened children (index 231 and up, written with ' or h) need the parent private key. They stop a leaked child private key plus the xpub from exposing the parent.
BIP44/49/84/86: standard paths
Paths have the form m / purpose' / coin' / account' / change / index.
m/44'/0'/0'/0/0: first legacy (1…) address.m/49'/…: wrapped SegWit (3…).m/84'/…: native SegWit (bc1q…).m/86'/…: single-key Taproot (bc1p…).
Coin type 0' is Bitcoin and 1' is testnet. Change 0 is for receiving and 1 for change. BIP44 also defines a gap limit of 20: wallets stop scanning after 20 unused addresses in a row.
Where it breaks down
A seed phrase does not say which paths or script types were used. Restoring in another wallet may show zero balance until it scans the right path. Output descriptors solve this by writing the full recipe down.
Security note
Anyone with your seed words, and passphrase if used, has your coins. Never type them into a website.