Useful code, thanks! How about adding your bitcoin donations address?

It would be cool to being able to retrieve all the public keys and addresses from an xpub of a multisig hd wallet like Copay.

Hi! I've been trying to manually go through process of creating mnemonic from provided entropy. It didn't work as expected, because there is a bug in function setMnemonicFromEntropy():

    for (var i=0; i<256-bits.length; i++) {
        bits = "0" + bits;
    }

If 2 or more leading zeroes are needed, the loop skips one, because both i and bits.length are incremented at the same time.

Some barcode scanners store a history of scanned barcodes.

If some sensitive data is scanned, such as the mnemonic or the xprv key or a private key, the user may be unaware this is stored in their history which may lead to loss of funds.

Put a warning next to the QR code that history may be stored and may lead to loss of funds.

The text for 'bits of entropy supplied' should have a warning saying 'at most X bits' since it's easy to supply entropy which has less entropy than the 'raw' numbers may otherwise suggest.

When I put in 24 words plus a password, then I do get the same addresses listed that are in my current Mycelium wallet.

BUT When I import the BIP32 Extended Key, aka either the xpub or the xpriv, into either Mycelium, or into Electrum, I get a different list of addresses. They don't match the list on the web site. When importing the extended key from this site into those two wallets, both wallets give the same address list, but it doesn't match the list shown on the website. I'm using m/44'/0'/0'/0 for the path, I don't know why it shows a different list below. Maybe backend programming isn't using the right path?

Test case (by luck this is the first one I generated, thankfully I cross-referenced with other tools. Not all mnemonics / root keys trigger this bug)

mnemonic: fruit wave dwarf banana earth journey tattoo true farm silk olive fence
passphrase: banana

https://iancoleman.github.io/bip39/ derived first address: 17rxURoF96VhmkcEGCj5LNQkmN9HVhWb7F (also shared by Electrum)

Other clients derive a different address (Copay, BIP32JP, etc): 13EuKhffWkBE2KUwcbkbELZb1MpzbimJ3Y

It would be good to have the user interface work in multiple languages.

This is a two-phase issue:

1. Create logic for the user interface to display in different languages.
2. Create a corpus of all sentences in different languages to be used by the page.

The error message should show meaningful text to help solve problems.

Issue arises from this thread:

https://www.reddit.com/r/Bitcoin/comments/4w2mfv/lost_a_bitcoin_did_my_hw_wallet_generate_an/

Specifically the error should say 'metal is not in the wordlist, did you mean medal'

Try this:

1. load the site
2. click 'generate'
3. put 500 in the 'Show more rows' box
4. hit tab to move focus to the 'show' button, but don't click it
5. scroll up to the bip44/bip32 tabs
6. hit return (to activate the focussed 'show' button) then click the 'bip32' tab quickly
7. check the list of generated addresses - I see paths m/0/43 through m/0/119, then m/0/0 through m/0/19. m/0/20 through m/0/42 are missing and the others are out of order

Probably the fix is to either prevent the switching of tabs while addresses are generating, or cancel the generation before doing the switch.

(I discovered this bug without the weird steps described above, but the steps make it more easily reproducible).

• Enter 300 dice rolls to the entropy field
• Change 'mnemonic length' to 'from entropy length'
• Note that there is a period of computation (approx 3s on my laptop) but no 'calculating' feedback shown

This is confusing and makes the UI feel like it's locked-up or frozen or unresponsive.

Suggested change is to show 'calculating' feedback message whenever the mnemonic is updated using 'mnemonic length' select box in the entropy section.

A recent reddit post caused me to notice how you're generating entropy from cards, and how it is throwing away some entropy.

The last 12 or so cards in a full 52 card shuffled deck have no effect on the generated seed because of this code:

// Calculate the new value by scaling the original value down
var withoutReplace = entropyInt.multiply(maxWithoutReplace).divide(maxWithReplace);

The entropyInt is made by spacing all the individual cards out equally (log(52) bits per card), but the 'scaling' will effectively chop off the end of the string, allowing only the first N cards to have any effect on the outcome. Rather than scaling like this, where only the leading bits affect the outcome, I would use an SHA-2 hash of all the bits and take the first N bits of the result, so that all the input bits affect the outcome.

Hi I just found a bug where when using a root key the derived alt coins are not correct

Reproduce:

1. Generate a mnemonic
2. Select Viacoin and inspect the generated addresses
3. Copy the root key and paste in a new tab
4. Select Viacoin again
5. Notice the derived addresses are not the same

I think this may be because the network parameter is not set in the method calcBip32RootKeyFromBase58()

I use Bitcoin Core's "watch only" addresses to track my BIP44 wallet. I would like to be able to use "createrawtransaction" and "fundrawtransaction" to have it create a raw transaction which I could then sign using my offline machine, but "fundrawtransaction" only works for addresses that I have imported using "importpubkey" rather than using "importaddress".

That is, Core needs to know the public key of the addresses it is watching in order to create a raw transaction that spends them. And that information isn't currently available to me from this website.

I would like to see a new column, after "Path", "Address", and "Private Key" called "Public Key", which I could use with Bitcoin Core's "importpubkey" RPC call. Or maybe it could be a toggle, alternating between "Private Key" and "Public Key". Maybe default to only showing the Public Key even.

hi, I was looking a way to use your tool with the iphone doge coin app doughwallet.

I'm not able to get the proper derivation path to get the correct adresses.

While I was able to use it successfully with the dogecoin app breadwallet, from which dough has been fork, using the derivation path m/0'/0/*.

Do you have any Idea which is the correct derivation path for this app?

See this reddit thread:

https://www.reddit.com/r/Bitcoin/comments/6fw565/using_shamirs_secret_sharing_scheme_ssss_with/

When a user is typing in a mnemonic to recover from a backup, it's convenient to accept 4-character prefixes for BIP39 words, rather than requiring the user to type it all out.

Example: http://cryptosteel.com/ exploits the fact that the English BIP39 wordlist is unambiguous by the fourth character of each word, and is thus designed to preserve at most four characters of each word. Thus, "BROC" would be interpreted as "BROCCOLI."

The forthcoming 0.13 release of Bitcoin Core introduces elementary support for BIP32. I've been using a modified version of your site to test the addresses it generates.

I needed to modify it because Core uses "hardened" derivation for the index of each address as well as for each part of the path.

So the first address it generates is m/0'/0'/0', the 2nd is m/0'/0'/1', etc.

The change I made is to simply generate an address from each of $path/$index and $path/$index' (note the trailing quote) for each index:

     function TableRow(index) {

         function init() {
-            calculateValues();
+            calculateValues(false);
+            calculateValues(true);
         }

-        function calculateValues() {
+        function calculateValues(hardenedIndex) {
             setTimeout(function() {
-                var key = bip32ExtendedKey.derive(index);
+                var key = hardenedIndex ? bip32ExtendedKey.deriveHardened(index) : bip32ExtendedKey.derive(index);
                 var address = key.getAddress().toString();
                 var privkey = key.privKey.toWIF(network);
-                addAddressToList(index, address, privkey);
+                addAddressToList(index + (hardenedIndex ? "'" : ""), address, privkey);
             }, 50)
         }

It's ugly and probably not how you want to do it (if at all). But maybe my clumsy implementation is helpful.

src/index.html:

<input type="number" class="strength form-control" id="strength" value="12">

Each 3 words gives us 32 bits of entropy (and 1 bit of checksum). We need 160 bits of entropy for optimal security, since addresses are 160 bits long. That means we need 5 sets of 3 words, or 15 words. The default of 12 words only gives us 128 bits, which is pretty good but we can do better.

Steps to reproduce

• Generate a random mnemonic
• Delete the mnemonic value (should show feedback 'Blank mnemonic')
• Delete the BIP32 root key value (should show feedback 'Invalid root key')
• Select one of the tabs in the Derivation Path section
• Note the following incorrect behaviors:
  • the BIP32 Root Key value is magically populated with a valid value
  • addresses table is populated with values

The expected behavior when there is no mnemonic or root key is to show an error and not generate any addresses.

I suspect this is due to some incorrect caching of the root key value. Smells like a code refactor to remove 'global' variables in index.js may be a good use of time.

The order of coins in the network select is currently a rather arbitrary chronological order.

This should be changed to an ordering that's easier for users to find their particular coin.

I suggest alphabetical order, keeping the default as bitcoin.

An alternative is to order by 'popularity' as per market cap, so the most popular coins appear at the top of the list. Since this can change it's less maintainable than alphabetical, and not as easy to use for most users (who may not be familiar with the market caps of most coins).

To reproduce:

• visit https://dcpos.github.io/bip39/
• enter 'belt belt belt' as mnemonic
• select Litecoin from the coin menu
• examine BIP44 tab
• a) note derivation path: m/44'/2'/0'/0 and extended key: Ltpv7AGXcL...
• change 'coin' input field on BIP44 tab from 2 to 0
• b) note derivation path: m/44'/0'/0'/0 and extended key: Ltpv7AGXcL...
• change 'coin' input field on BIP44 tab back to 2
• c) note derivation path: m/44'/2'/0'/0 and extended key: Ltpv7AG3oy...
• change 'coin' input field on BIP44 tab back to 0, then switch to 'Bitcoin' and back to 'Litecoin' in the menu near the top of the page
• d) note derivation path: m/44'/2'/0'/0 and extended key: Ltpv7AGXcL...

b) and c) are correct. a) and d) both have the derivation path from c) but the extended key from b).

The problem appears to be that networkChanged() calls setBip44DerivationPath() which updates the DOM but doesn't modify the derivationPath global.

Moving the derivationPath = DOM.bip44path.val(); from bip44Changed() into setBip44DerivationPath() would probably fix the problem.

See https://www.reddit.com/r/Bitcoin/comments/50zvvs/hd_wallet_trying_to_get_xpub_from_12_words/

Just a usability / gui thing.

It already drops from whatever the counter says, to the next lowest multiple of 3.

This would just communicate to users that it needs to be multiple of 3, in a more obvious way, for those unfamiliar with the workings of bip32.

To reproduce:

1. visit https://dcpos.github.io/bip39/
2. generate random mnemonic
3. select BIP32 tab - see BIP32 addresses with paths m/0/0, m/0/1, etc.
4. switch coin from Bitcoin to Litecoin
5. BIP32 tab is now displaying BIP44 addresses with paths m/44'/2'/0'/0/0, m/44'/2'/0'/0/1, etc.
6. switch to BIP44 tab and back to BIP32 tab; this fixes the display back to m/0/0, etc.

Step 5 is the error. I want the BIP32 tab to show BIP32 addresses, not BIP44.

It gives random mnemonic code -> seed functionality,
but no way to go back, if you lose the mnemonic but have the seed?

We need seed -> mnemonic code functionality on the page, or is it there an I'm not seeing it?

I've just been doing a few tests in viability of using this tool to generate BIP39 seeds for Electrum. It does work to some extent but there is some strangeness about how root keys, xprv and xpubs interact and I'm looking for some clarity on how/why there seems to be differences in how these are created and why they don't match for matching seeds.

As an example, I can use this tool to generate a random seed (12 words): spin hobby shoot crunch riot coil creek arctic usage produce dance blood

And the root key is: xprv9s21ZrQH143K45vQYApHCpF2TSVhyeQ9h5EoFRf3nY3AFj9KECzDXWxTAqDTryiGF3n44FSnmzr3pnChT1QTYZcvNwN3HY3rwMKkxJXoGns

BIP32 (BIP44 derivation path) xprv is:
xprvA1aCxyentjgsZXNhyqSKu6BytDEohr2NidfmCCV38vQaGcoJftBM4PLPcr6g6RhSMAshUE8npU4nYMgC8BVtR6BGr1fLnjZPsvuuHMPDqoB

BIP32 (BIP44 derivation path) xpub is:
xpub6EZZNVBgj7FAn1TB5ryLGE8iSF5J7JkE5rbMzatehFwZ9R8TDRVbcBesU7LomwFNYwUzVxJCcJRh2uwfkHLVCQFJ8zgs4yZ3bak9yXHBTaD

Restoring this seed to Electrum (as BIP39) creates the same address list: 1KtVmkercr9AiNcN9QTozKbL42L6tnrv3i ...
(which is great, as this makes this a useful and compatible tool, initially).

But the actual xprv stored in the Electrum wallet is different from above:
xprv9yeoQ31aaJA1k9WSwqyrT1ekYdViDsgRzMQquePrbTdiSVFRzRF9ECEvJNiXqWUEfSes7hbKPBgRPpthYuG5u7UBpZwz7XXzceaTpFPP5Le
(and when this is pasted into this tool as root key it gives a differing address list - so root key here is not the same as xprv in Electrum).

And when the BIP32 xprv above, from this tool, is used to restore a wallet you get a different address list.

But what I find most confusing is that the seed word list I started with above results in an xpub that is not usable in Electrum. From this tool above,

xpub6EZZNVBgj7FAn1TB5ryLGE8iSF5J7JkE5rbMzatehFwZ9R8TDRVbcBesU7LomwFNYwUzVxJCcJRh2uwfkHLVCQFJ8zgs4yZ3bak9yXHBTaD

compared to the one Electrum generates for same seed words,

xpub6Ce9oYYUQfiJxdav3sWrp9bV6fLCdLQHMaLSi2oU9oAhKHaaXxZPmzZQ9fqwNq6a3rFqRniJz7z94uhVPidAs2hiPAfAD4WDJKR7RZJw6oM

Hence, while you could use this tool to generate a seed word list and create an Electrum wallet with same addresses, the matching xpub will not generate a same watch-only wallet - even though on this tool the xpub given supposedly matches the same address list. Weird? Or not? Either xpubs are not deterministic for seed words, or there is a bug in the xpub calculation (here or in Electrum) or some differing derivation method maybe? Strangely, the address list does match!

I would like to work out what's going on here so that some clear process exists for using this tool in a useful and reliable way with Electrum in general (and maybe other wallets). Any explanation possible of what reliably works would be helpful.

I question the validity of the xpub shown by this tool when the differing xpub in Electrum does create a watch-only wallet with same address list as this tool. And the xpub from this tool when likewise plugged into Electrum (same restore, standard, by public key, xpub pasted) creates a different address list than here.

I know it's not your fault but the whole BIP32/BIP39/BIP44 world is currently a holy f** mess as compatibility between nearly all existing wallets is very spotty at best - according to this online reference matrix:

https://onedrive.live.com/view.aspx?resid=584F122BA17116EE!313&app=Excel

Specifically, I have a mnemonic, and I'd like to convert it into a mnemonic+passphrase that yields the same seed.

Your tool allows me to go from the mnemonic to bip39 seed. What I'd like to do is now go the other direction, entering in the bip39 seed and a passphrase, and see the new mnemonic that combines with the passphrase to yield the same seed.

Is there any way to do that?

Steps to reproduce

• Load page and leave mnemonic field blank
• Click BIP32 tab
• Note an error is thrown in the developer console

When choosing "Supply my own source of entropy" option and entering mnemonic length any from 12 to 24 words, mnemonic calculated is incorrect.

Let's use 128 bit entropy example from Andreas Antonopolous book: 0c1e24e5917779d297e14d45f14e1a1a. Enter this to the "Entropy" field and then, from combo "Mnemonic length" choose "12 words" option. After that, mnemonic calculated is as follows: "enact swarm curious dash next scorpion couple fabric hour loop can diamond" instead of the correct one: "army van defense carry jealous true garbage claim echo media make crunch".

The problem is inside the function setMnemonicFromEntropy. If user selects any option other than the first one in the "Mnemonic Length" combobox, all bits from user's entropy are overwritten with the SHA256 hash of it. After that, calculation of mnemonic is based on hash instead of entropy.

See https://github.com/bitcoin/bips/blob/master/bip-0039/bip-0039-wordlists.md

I tested the site using mnemonic and passphrases from test vector at https://github.com/bip32JP/bip32JP.github.io/blob/master/test_JP_BIP39.json

I always obtained a different xpriv key. For example the first element of test vector is:

{
       "entropy": "00000000000000000000000000000000",
       "mnemonic": "あいこくしん　あいこくしん　あいこくしん　あいこくしん　あいこくしん　あいこくしん　あいこくしん　あいこくしん　あいこくしん　あいこくしん　あいこくしん　あおぞら",
       "passphrase": "メートルガバヴァぱばぐゞちぢ十人十色",
       "seed": "a262d6fb6122ecf45be09c50492b31f92e9beb7d9a845987a02cefda57a15f9c467a17872029a9e92299b5cbdf306e3a0ee620245cbd508959b6cb7ca637bd55",
       "bip32_xprv": "xprv9s21ZrQH143K258jAiWPAM6JYT9hLA91MV3AZUKfxmLZJCjCHeSjBvMbDy8C1mJ2FL5ytExyS97FAe6pQ6SD5Jt9SwHaLorA8i5Eojokfo1"
},

but the web site for this mnemonic and passphrase returns:

seed: 46f8c196417a09a1dfdff5824538098509f99cc4f291acc3d77a4d0a3edde480806141c82b73102db2e05c21ba7a1aa46a2b3e12efba1c082773eacb657518d7
root key: xprv9s21ZrQH143K2oyoD9x9rxhdUmfzcDhCXA8UUHeSvJh6tU37dHjK8ncouWeLBbLt2G8QEtNtbztRX8KWp2huTCscBtJh9PWYZWH6qKfhr9u

Hi,

i added a balance/tx-lookup for derived addresses to your site - its currently only a quick hack, but would you include it? Then ill brush it up a bit.

You can test it here: https://raw.githack.com/DanielWeigl/bip39/master/src/index.html

(it uses the blockr-api to fetch the data)

I forked this repository a while ago (before you removed the wallet-specific tabs), hacked out a huge chunk of unused code (encryption, message and transaction signing, verifying, md5, etc.) and added CLAM support, but realise it would be better to have CLAM added to your site rather than have it in an increasingly out-of-date fork.

CLAM: http://clamclient.com/ | https://github.com/nochowderforyou/clams/ | https://bitcointalk.org/index.php?topic=623147

My fork: https://dooglus.github.io/bip39/ uses this for the CLAM fields:

clam: {
  bip32: {
    public: 0xa8c26d64,
    private: 0xa8c17826
  },
  pubKeyHash: 0x89,
  wif: 0x85,
}

Note that the other fields are unused in the BIP39 app. I'm unaware of a standard BIP32 coin number for CLAM, or standard magic numbers. I picked 4 for the coin number, since the version I forked used 0 through 3, and picked magic numbers such that the keys start "cpubk" and "cprvk". Nobody's using this yet, so feel free to assign whichever coin number seems appropriate.

Hey Ian, the tools you've built are awesome and invaluable to the community, thank you very much for all your effort!

I was wondering if I could ask some advice.

I am managing btc and alts for a bunch of friends. I would like for each of them to have their own bip44 wallet, however I would also like to have a single super-master key that can access all funds. Something like:

m / super_account' (i.e. bob's wallet) / purpose' / coin_type' / ...

Instead of:

m / purpose' / coint_type' / ...

Basically a master xprv/xpub that has as children bip44 xprv/xpub. Something like m/0'/44'/0'/0'/0 instead of m/44'/0'/0'/0.

Any suggestions on how to go about that and whether it makes sense?

Developer tools shows a 404 error when requesting favicon.ico

This is a contentless error and should not show.

Favicon should be of a format to keep the page as a single file (probably datauri).

I recently saw a reddit post in which the author was expressing concern about entropy collection in your bip39 code.

I replied here https://www.reddit.com/r/Bitcoin/comments/4fomsb/how_secure_are_the_hd_wallets_generated_by_bip39/d2bid2j with a modified version of your site in which the user can enter a long string which is hashed to provide the 'randomness' rather than using the PRNG. This allows the user to generate an HD wallet by rolling dice, flipping coins, or just hammering on the keyboard for ten minutes.

Is this something that you would consider adding to the site?

I can see it could be misused. If you use a short memorable phrase then it is just as insecure as a traditional single key 'brain wallet' - but for people who know what they are doing it allows them to use true physical randomness, avoiding any worry that their PRNG is somehow weak.

My change is here: dooglus@bed8b774

Steps to reproduce

• Refresh page
• Enter an xpub key into the BIP32 Root Key field
• Observe an error is thrown in the developer console
• Observe no addresses are generated, even though it would be expected they should be

If I use this as the mnemonic:

urge cat bid

I get a bip32 root key ending with

un5LhrbC

If I add an extra space anywhere:

urge cat  bid

the root key changes completely, now ending:

W5KKb2Mb

We have an inbuilt checksum to guard against typos, but it doesn't catch these whitespace errors. Accidentally adding an extra space anywhere will generate the wrong sequence of private keys and possibly lead to lost funds.

I'll make a pull request to fix this.

If I toggle the private key display to hide the private keys and then attempt to generate more addresses, I get an error in the console:

Uncaught ReferenceError: privkeCell is not defined

Hi, perhaps you may want to add a disclaimer to the web tool, something like "use it at your own risk"

Is it possible to use for Ethereum?
e.g. with Metamask (12 words seed).
Thanks in advance for your answer.

It would be nice to be able to generate addresses starting at an index other than zero.

Hi Ian, first-off great tool, this thing is amazing!

I'd like to bring up a few points on release and update practices.

1. Improve Release Practices by using the Github "Release" features, this way I can get a solid ZIP release of the tool, along with an MD5 hash of the ZIP, release reference number
2. Everytime an update is made to the tool, I think it should be noted in a CHANGE_LOG.md file, that way we know if a bug is created in the tool, we can diagnose more clearly and quickly what it is
3. You may want to accompany the release of any new updates with a Tweet, and potentially post the new release number and MD5 hash with it

Thanks so much for writing this tool @iancoleman! I would like to recommend it as a way to generate/manage keys for Ethereum, but I want to see some basic release and update practices maintained before I can do this.

As well, I may be able to have the tool professionally code-frozen and audited (I would pay/raise the money for that). That way we have a solid copy that works and is audited, with a specific release and MD5 hash attached.

Should be easy to view some bits of text on the page as QR codes to make it easy to scan it with mobile phones.

I'm thinking

• BIP39 Seed
• BIP32 Root Key
• BIP32 Extended Key (xprv and xpub)
• Address
• Public Key
• Private Key

Perhaps a good implementation might be anything selected (with no spaces in the selection) will show a qr code for the selected text in the top right of the screen.

Mycelium only import level 3, not level 0 or 4 generated in this project. Any plan to support level 3 xpub/xprv? The point is to generate a receive only HD account until it is time to import the xprv.

Add automated tests. Manual testing has reached the limit of usefulness.

See https://chromium.googlesource.com/chromium/src/+/master/headless/README.md