Deterministic Wallet

A deterministic wallet is a cryptocurrency wallet in which every private key, and therefore every address, is calculated from one starting secret known as a seed. Because the same seed always produces the same sequence of keys, a user who backs up the seed once can restore the entire wallet, including addresses created later, on any compatible device. Almost all modern software and hardware wallets work this way, and the seed is usually shown to the user as a list of 12 or 24 words called a seed phrase.

Deterministic wallets replaced an earlier design in which a wallet generated each new key at random. Those older wallets held a collection of unrelated keys, so every new address required a fresh backup, and users who restored an old backup could lose funds sent to newer addresses. The most widely used form today is the hierarchical deterministic (HD) wallet, defined in Bitcoin Improvement Proposal 32, which arranges keys in a tree of accounts and sub-accounts.

Imagine a key-cutting machine that, given one master pattern, can cut an endless series of different keys, always in the same order. Anyone holding the master pattern can recreate every key the machine has ever cut, or ever will. A deterministic wallet is that machine, and the seed phrase is the master pattern.

This makes backups simple: writing down a short list of words protects every account and address in the wallet, now and in the future. It also means the list of words is all a thief needs. Whoever learns the seed phrase can rebuild the wallet and take everything in it, which is why it should be kept offline and never typed into a website.

1. Creating the seed. The wallet generates random data and, under the BIP-39 standard, turns it into a mnemonic phrase of common words. The phrase, optionally combined with a passphrase, is converted into a binary seed.
2. Deriving a master key. The seed is passed through a cryptographic hash function to produce a master private key and an extra value called a chain code.
3. Building the tree. Under BIP-32, the master key creates child keys, which create their own children, and so on. Each key has a numbered position, or derivation path, in the tree.
4. Organizing accounts. Later standards, such as BIP-44, assign parts of the path to the coin type, the account number and whether an address is for receiving payments or for change.

Because each step is a fixed mathematical calculation, any wallet that follows the same standards and uses the same derivation path will rebuild exactly the same keys from the same seed.

HD wallets can also derive a branch of public keys from an extended public key, often called an xpub, without knowing any private key. This lets a merchant's web server or an accountant's software generate a fresh receiving address for every payment, or monitor balances, while the private keys stay offline in a hardware wallet or cold storage. Giving out a fresh wallet address for each payment improves privacy, since outsiders cannot easily link all of a user's transactions.

Extended public keys carry their own risks. Anyone who sees an xpub can view every address and transaction in that branch, so sharing it reveals the wallet's full history. In the standard (non-hardened) derivation, if an attacker obtains an xpub and any single child private key, they can calculate the parent private key. Wallets therefore use "hardened" derivation for sensitive levels of the tree.

The Electrum wallet, released in 2011, was among the first Bitcoin wallets to generate keys from a seed. Bitcoin developer Pieter Wuille published BIP-32 in 2012, and BIP-39, which defined the word-list format, followed in 2013. These standards were adopted across Bitcoin wallets and then by wallets for Ethereum and many other blockchains, which use the same structure with different coin numbers. Compatibility is not perfect: some wallets use different derivation paths or their own seed formats, so a phrase from one wallet may not restore correctly in another without adjusting settings.

• Single point of failure. The seed phrase controls every key, so losing it can mean losing access, and exposing it means losing funds.
• Safe storage. Users are advised to write the phrase on paper or metal, keep copies in secure places and never store it in photos, cloud notes or email.
• Passphrases. An optional extra word or phrase creates a different hidden wallet from the same seed, adding protection if the written phrase is found, but forgetting it makes the funds unrecoverable.
• Spreading control. For large holdings, some users combine deterministic wallets with a multi-sig wallet, so that no single seed can move funds alone.