Electrum made me afraid of BIP39.

[I4BTC]

Hello.
I secure my Bitcoin wallet using BIP39. Today, I installed Electrum for the first time and noticed this.
https://ibb.co/q3BH8Knd
Is it possible that BIP39 might stop working someday, causing me to lose my assets?

Please excuse me if this isn't a good question; I am a student and a Bitcoin enthusiast.
Thanks

[Charles-Tim]

Is it possible that BIP39 might stop working someday, causing me to lose my assets?

BIP39 means bitcoin improvement protocol 39. It is created by the bitcoin developers. You do not need to be worry about anything. As of today, more noncustodial wallets are BIP39 compatible. I prefer the way Electrum generates seed phrase, but BIP39 is also good enough and it is the standard.

[Zaguru12]

Hello.
I secure my Bitcoin wallet using BIP39. Today, I installed Electrum for the first time and noticed this.

Is it possible that BIP39 might stop working someday, causing me to lose my assets?

Please excuse me if this isn't a good question; I am a student and a Bitcoin enthusiast.
Thanks

If electrum actually stops to support bip39 recovery phrase in the future there will be wallets that support it or are compatible with it and even if there is no wallet (which will be rare) you can use some tools to covert your seed phrase into master private key and then recover such wallet.

It is actually safe to know that electrum custom seed and bip39 seed are generated same way which is both uses same PBKDF2. Just little difference as explained in that screenshot

[hosemary]

As already stated above by Charles-Tim and Zaguru12, whatever happens to Electrum in the future , there will be other wallets that can be used to recover your funds. I just want to add that even if Electrum stops supporting BIP39 seed phrases, you will still be able to use its old versions to derive your private keys. Electrum is an open-source wallet, and its source code will always be available.

Also note that your private keys are derived from your seed phrase through some mathematical calculations that can be done even without Electrum or any other wallet software.

[ghost43]

Context:

https://gnusha.org/pi/bitcoindev/90bf12f2-e109-28b4-e93e-54bbc8002cb4@electrum.org/ :

> From: Thomas Voegtlin <thomasv@electrum•org>
> To: bitcoin-dev@lists•linuxfoundation.org
> Subject: Re: [bitcoin-dev] BIP Status updates (including to Active/Final Status) - BIP 39, BIP 43, BIP 44, BIP 67, BIP 111, BIP 125, BIP 130
> Date: Wed, 24 Aug 2016 14:51:32 +0200   [thread overview]
> Message-ID: <90bf12f2-e109-28b4-e93e-54bbc8002cb4@electrum.org> (raw)
> In-Reply-To: <201608232012.12588.luke@dashjr.org>
>
>
> I personally believe that BIP39/BIP44 is a bad design. There is limited
> support for these BIPs in Electrum, in order to provide compatibility
> with hardware wallets. However, I do not plan to use BIP39/BIP44 for
> default Electrum wallets, for the following reasons.
>
> (Note that it does not make sense to consider BIP39 and BIP44
> independently. Any wallet that decides to implement one without the
> other would be considered as broken.)
>
> Here is why I rejected this design:
>
> 1 - BIP44 uses multiple accounts. This means that in order to be
> compatible with the standard, a wallet *must* implement multiple
> accounts. A wallet that decides to keep things simple and use only one
> account, will not allow users to recover all their funds when they
> restore from a BIP39 seed, and will be considered as broken.
>
> 2 - An appealing feature of deterministic wallets is that you can use
> the same instance of your wallet on different devices. Two instances of
> your wallet can automatically synchronize their Bitcoin addresses, and
> display the same balance. The problem is that hardened derivations break
> this property. Indeed, with hardened derivations, software wallets need
> to ask the user's password in order to derive new accounts. Therefore,
> in order to implement automated detection of newly created accounts, a
> BIP44-compatible software wallets would need to ask the user's password
> whenever a new account is detected. This means that the wallet would ask
> the password without the user initiating any action. This seems to be an
> avenue for malware.
>
> Of course, hardware wallets do not have that issue, because they can
> derive new accounts without requesting a password from the user. BIP44
> is a standard that has been designed for hardware wallets, but that
> makes things really difficult for software wallets.
>
> 3 - Unneeded complexity. From an end user perspective, the multiple
> accounts in BIP44 achieve the same result as using different derivation
> passphrases with the same BIP39 seed phrase. The only real difference is
> that BIP44 accounts can be enumerated deterministically, while
> passphrases in general cannot. However, this property is of limited
> interest, because automatic synchronization of multiple accounts cannot
> be guaranteed for bip44 software wallets, as explained in 2.
>
> 4 - BIP39 is inconsistent. It uses a hash of the utf8 encoded 'seed
> phrase' in order to derive the BIP32 seed. This hash-based derivation
> was added on my suggestion, in order to make the BIP independent from
> the particular wordlist used to generate the seed phrases. However,
> BIP39 also requires the implementation of a checksum, in order to verify
> that a seed phrase is valid. Suprisingly, the specification of the
> checksum involves wordlist indices. This means the checksum (and thus
> the BIP) requires a fixed wordlist. This defeats the purpose of using a
> hash for the derivation of the seed.
>
> The authors of the BIP should either have used hash functions for both
> the seed AND the checksum (that is what Electrum does), or for none of
> them (in that case case, you can have a bidirectional function between
> seed phrases and entropy, which is nice if you want to perform Shamir
> secret sharing of seed phrases, at the expenses of a fixed wordlist). In
> its current state, BIP39 takes the worst of both worlds.
>
> 5 - The fact that the wordlist must be part of BIP39, and cannot be
> changed in the future, seems a terrible idea to me. I believe that a
> specification should always try to be minimal. In that case, the
> specification includes a 2000+ words dictionary, when it could have
> avoided that.
>
> Even if you decide that BIP39 is final, there will always be users
> requiring the addition of wordlists for new languages. So, in practice,
> this BIP will never be final.
>
> 6 - Finally, and most importantly, BIP39 seed phrases do not have a
> version number. Without a version number, how are you going to derive
> addresses from a BIP39 seed phrase, when wallets start to use to new
> derivation methods (such as SegWit, or Schnorr signatures)? Does it mean
> that a BIP39 compatible wallet will have to check addresses from all the
> derivation methods that ever existed in the past, in order to ensure
> that all coins are correctly retrieved? Or will there be users that
> cannot access their coins because their BIP39 seed phrase is too old for
> newer software?

[SquirrelJulietGarden]

BIP39 means bitcoin improvement protocol 39. It is created by the bitcoin developers. You do not need to be worry about anything. As of today, more noncustodial wallets are BIP39 compatible. I prefer the way Electrum generates seed phrase, but BIP39 is also good enough and it is the standard.

BIP is only a BIP, and there are many wallets or tools for wallet recovery that support a specific BIP.

About BIP39.
iancoleman's Bitcoin Mnemonic Code Converter. If need to use it, let's use it offline.
Bitcoin Feature Matrix: for tracking interoperability of ₿itcoin products & services.
The FinderOuter, a bitcoin recovery tool (v0.21.0 2026-08-31). Use it offline too.

[pooya87]

That warning is just saying that BIP-39 standard does not meet Electrum standard. But it doesn't mean BIP-39 standard is worse or weaker. It just means it is "different", that's all. The warning also explains the difference as well: the lack of version in BIP-39.

Other than that if you look at both algorithms, they are pretty similar. Both use at least 128 bits of entropy (the minimum size for security) and they both use PBKDF2 with HMACSHA512 to derive the seed for BIP-32.

[nc50lc]

I secure my Bitcoin wallet using BIP39. Today, I installed Electrum for the first time and noticed this.
https://ibb.co/q3BH8Knd
Is it possible that BIP39 might stop working someday, causing me to lose my assets?

That is just added as a pre-caution in case Electrum drops its support on importing BIP39 seed phrases in the future.
Currently, I can't find any plan related to it.

And you wont lose your bitcoins even if Electrum do that in your lifetime.

I noticed a small detail that could be more important than that: The screenshot shows "BIP39: checksum failed".
If you've captured that while your seed phrase is entered, you're not using a standard BIP39 seed and that could cause an issue in the long run.
If so, where did you create it?
If not, disregard this part.

[Mia Chloe]

Hello.
I secure my Bitcoin wallet using BIP39. Today, I installed Electrum for the first time and noticed this.
https://ibb.co/q3BH8Knd
Is it possible that BIP39 might stop working someday, causing me to lose my assets?
Please excuse me if this isn't a good question; I am a student and a Bitcoin enthusiast.
Thanks

I don't think there's anything to worry about. To add to what others have said most of these softwares are kinda backwards compatible in that they can actually understand older scripts and seed formats. It's same reason why a regular legacy wallet from back in the day can be used with zero issues today.

Also note that your private keys are derived from your seed phrase through some mathematical calculations that can be done even without Electrum or any other wallet software.

There are a few sites I've seen that do this and even support SLIP39  but I wouldn't advise anyone to use them though regardless of the fact you're gonna run it offline.

[ABCbits]

Is it possible that BIP39 might stop working someday, causing me to lose my assets?

BIP 39 itself is a standard or rule to generate Bitcoin wallet, so it can't stopped working someday. In unlikely scenario where most up-to-date wallet no longer support BIP 39, you could use older version of wallet that support BIP 39, extract private keys and import/sweep it to up-to-date wallet.

I secure my Bitcoin wallet using BIP39. Today, I installed Electrum for the first time and noticed this.
https://ibb.co/q3BH8Knd
Is it possible that BIP39 might stop working someday, causing me to lose my assets?

That is just added as a pre-caution in case Electrum drops its support on importing BIP39 seed phrases in the future.
Currently, I can't find any plan related to it.

And i doubt they'll drop current BIP 39 support, it's simply too popular despite the limitation.

[NotATether]

BIP39 will never stop working. It is a universal Bitcoin standard for wallet discovery. Many wallets support this seed format.

What the warning is saying is that Electrum might no longer support BIP39.

Honestly, from looking at the Github, it doesn't look like this is going to happen (in the near future).

But even if Electrum stops using BIP39, there are many other wallet softwares that will always support BIP39. Like Sparrow Wallet, Cake Wallet, BlueWallet, and Wasabi, as well as all hardware wallets.

[NeuroticFish]

But even if Electrum stops using BIP39, there are many other wallet softwares that will always support BIP39. Like Sparrow Wallet, Cake Wallet, BlueWallet, and Wasabi, as well as all hardware wallets.

And also don't forget the "older" versions of Electrum.
I consider this pretty important, since if one's hardware wallet stops working, a Tails OS stick with Electrum will probably have older version, which has a very high chance to be just fine.

[pooya87]

But even if Electrum stops using BIP39, there are many other wallet softwares that will always support BIP39. Like Sparrow Wallet, Cake Wallet, BlueWallet, and Wasabi, as well as all hardware wallets.

And also don't forget the "older" versions of Electrum.
I consider this pretty important, since if one's hardware wallet stops working, a Tails OS stick with Electrum will probably have older version, which has a very high chance to be just fine.

If the goal is to just make it work in a scenario where Electrum no longer accepts BIP-39 mnemonics, there are simpler ways compared to using hardware wallets or seeking older versions. You could convert the mnemonic to extended keys (Base-58 encoded xprv family of keys) using a script (preferably offline) and then import that into your Electrum.

Even the reference implementation inside the BIP itself can be used as the script you run. It's a pretty straight forward process: https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki#reference-implementation

[NeuroticFish]

If the goal is to just make it work in a scenario where Electrum no longer accepts BIP-39 mnemonics, there are simpler ways compared to using hardware wallets or seeking older versions. You could convert the mnemonic to extended keys (Base-58 encoded xprv family of keys) using a script (preferably offline) and then import that into your Electrum.

Even the reference implementation inside the BIP itself can be used as the script you run. It's a pretty straight forward process: https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki#reference-implementation

My point was for those already having HW, which, like any electrical device, will break at some point (hopefully in the very far future)
Tails was the pre-made option and already safe.
Then (imho) using other already working wallet software may be easier option than installing this or that.

But the link you provided is an interesting one too (I've bookmarked it!), because I expect that some people do customize themselves recovery/tools stick where this is more reliable than many others.

[Forsyth Jones]

Context:

https://gnusha.org/pi/bitcoindev/90bf12f2-e109-28b4-e93e-54bbc8002cb4@electrum.org/ :

> I personally believe that BIP39/BIP44 is a bad design. There is limited
> support for these BIPs in Electrum, in order to provide compatibility
> with hardware wallets. However, I do not plan to use BIP39/BIP44 for
> default Electrum wallets, for the following reasons.

> 6 - Finally, and most importantly, BIP39 seed phrases do not have a
> version number. Without a version number, how are you going to derive
> addresses from a BIP39 seed phrase, when wallets start to use to new
> derivation methods (such as SegWit, or Schnorr signatures)? Does it mean
> that a BIP39 compatible wallet will have to check addresses from all the
> derivation methods that ever existed in the past, in order to ensure
> that all coins are correctly retrieved? Or will there be users that
> cannot access their coins because their BIP39 seed phrase is too old for
> newer software?

I almost completely disagree with Thomas Voegtlin about BIP39/44 and others being a bad design.
BIP39 has proven to be very efficient, nowadays, the problem of this wallet not restoring balances due to using different derivation paths no longer exists. Today, all the most famous and reputable wallets use the BIP44, 49, 84 standards, and the most modern ones use BIP86 to access those funds.

Electrum's own software has a tool to scan balances in different derivation paths of the same BIP39 seed phrase, performing a rescan of all derivation paths (at least the most well-known ones, of which there are many).

The BIP39 seed phrase doesn't have a version number, but his statement 6 has aged very poorly (he wrote this in 2016). This was easily resolved through other derivation paths and with descriptors in more advanced wallets, making the method quite accurate.

One thing that bothers me about Electrum is that if a new address type is added, the user has to create a new Electrum seed phrase (this was the case with Legacy, Segwit, and probably with Taproot if it will added to Electrum). With the BIP39 standard, the user does not need to worry about creating a new seed phrase, they can simply access the same wallet on another derivation path/script to access that address type (if the wallet supports it), and it is done.

Electrum seed phrases may seem simple, but things start to get complicated when the user needs to access their funds in Legacy, Segwit (and Taproot if added to Electrum), because each address type has its own version number......

[bitmover]

Hello.
I secure my Bitcoin wallet using BIP39. Today, I installed Electrum for the first time and noticed this.
https://ibb.co/q3BH8Knd
Is it possible that BIP39 might stop working someday, causing me to lose my assets?

Please excuse me if this isn't a good question; I am a student and a Bitcoin enthusiast.
Thanks

Complementing what others have said , electrum does not use bip39 because they consider their seed phrases better for 2 reasons.

You can read them in the Electrum docs

BIP39 was introduced two years after Electrum. BIP39 seeds include a checksum, in order to help users figure out typing errors. However, BIP39 suffers the same shortcomings as early Electrum seed phrases:

 - A fixed wordlist is still required. Following our recommendation, BIP39 authors decided to derive keys and addresses in a way that does not depend on the wordlist. However, BIP39 still requires the wordlist in order to compute its checksum, which is plainly inconsistent, and defeats the purpose of our recommendation. This problem is exacerbated by the fact that BIP39 proposes to create one wordlist per language. This threatens the portability of BIP39 seed phrases.

 - BIP39 seed phrases do not include a version number. This means that software should always know how to generate keys and addresses. BIP43 suggests that wallet software will try various existing derivation schemes within the BIP32 framework. This is extremely inefficient and rests on the assumption that future wallets will support all previously accepted derivation methods. If, in the future, a wallet developer decides not to implement a particular derivation method because it is deprecated, then the software will not be able to detect that the corresponding seed phrases are not supported, and it will return an empty wallet instead. This threatens users funds.

For these reasons, Electrum does not generate BIP39 seeds.

https://electrum.readthedocs.io/en/latest/seedphrase.html

[pooya87]

I almost completely disagree with Thomas Voegtlin about BIP39/44 and others being a bad design.
BIP39 has proven to be very efficient, nowadays, the problem of this wallet not restoring balances due to using different derivation paths no longer exists. Today, all the most famous and reputable wallets use the BIP44, 49, 84 standards, and the most modern ones use BIP86 to access those funds.

It's about automation and having a simpler UI and a simpler code.

If the UI has to ask the user for more inputs, that adds complication. You have to remember that you and I understand what BIP44, 49, etc are or what P2WPKH means. Many users, specially the newcomers, do not. When the UI has to ask them to choose one, it adds to the confusion.
In comparison when the mnemonic itself contains that information, the end-user doesn't have to do anything. They have 1 input (the mnemonic) and enter that and get the correct wallet.

Same with underlying code. It is not impossible to write the code to scan different derivation paths and check each address to see if they were ever used and decide which derivation path(s) were used in order to find the wallet the user wanted to recover. But that is more work and complexity added to the code that could have been avoided simply with a version in the mnemonic.

There is another aspect which I personally like in programming: explicitness.
Take private keys for example. A hexadecimal private key has no explicitness, you can derive any public key from it (compressed, uncompressed or even hybrid!). But when it is encoded using Base58, it becomes explicit. Your wallet will never derive a compressed public key from a WIF that starts with 5 because you explicitly told it to derive an uncompressed public key without needing to know what compressed/uncompressed keys are.
It's the same situation with an Electrum mnemonic. When a user enters the 12 words into the app, those words are explicitly telling the software what to do, that derivation path to use, what type of addresses to derive, etc.

[Forsyth Jones]

It's about automation and having a simpler UI and a simpler code.

If the UI has to ask the user for more inputs, that adds complication. You have to remember that you and I understand what BIP44, 49, etc are or what P2WPKH means. Many users, specially the newcomers, do not. When the UI has to ask them to choose one, it adds to the confusion.
In comparison when the mnemonic itself contains that information, the end-user doesn't have to do anything. They have 1 input (the mnemonic) and enter that and get the correct wallet.

Same with underlying code. It is not impossible to write the code to scan different derivation paths and check each address to see if they were ever used and decide which derivation path(s) were used in order to find the wallet the user wanted to recover. But that is more work and complexity added to the code that could have been avoided simply with a version in the mnemonic.

There is another aspect which I personally like in programming: explicitness.
Take private keys for example. A hexadecimal private key has no explicitness, you can derive any public key from it (compressed, uncompressed or even hybrid!). But when it is encoded using Base58, it becomes explicit. Your wallet will never derive a compressed public key from a WIF that starts with 5 because you explicitly told it to derive an uncompressed public key without needing to know what compressed/uncompressed keys are.
It's the same situation with an Electrum mnemonic. When a user enters the 12 words into the app, those words are explicitly telling the software what to do, that derivation path to use, what type of addresses to derive, etc.

BIP39 wallets already create segwit bech32 addresses by default in BIP84 (or BIP86, or both for multiscript wallets), so the user doesn't even need to manually select inputs, do you often see users of BIP39 wallets, like Bluewallet for instance, reporting being confused?

Electrum seeds do encode this information within the mnemonic itself, however, for users who want to access multiple address types within a single wallet, the Electrum seed becomes inefficient and obsolete, as it derives only one address type and one account.

I don't want to manage 04 separate mnemonics for every address type, each with its own version number that derives a specific path and script.

Complementing what others have said , electrum does not use bip39 because they consider their seed phrases better for 2 reasons.

You can read them in the Electrum docs

BIP39 was introduced two years after Electrum. BIP39 seeds include a checksum, in order to help users figure out typing errors. However, BIP39 suffers the same shortcomings as early Electrum seed phrases:

 - A fixed wordlist is still required. Following our recommendation, BIP39 authors decided to derive keys and addresses in a way that does not depend on the wordlist. However, BIP39 still requires the wordlist in order to compute its checksum, which is plainly inconsistent, and defeats the purpose of our recommendation. This problem is exacerbated by the fact that BIP39 proposes to create one wordlist per language. This threatens the portability of BIP39 seed phrases.

 - BIP39 seed phrases do not include a version number. This means that software should always know how to generate keys and addresses. BIP43 suggests that wallet software will try various existing derivation schemes within the BIP32 framework. This is extremely inefficient and rests on the assumption that future wallets will support all previously accepted derivation methods. If, in the future, a wallet developer decides not to implement a particular derivation method because it is deprecated, then the software will not be able to detect that the corresponding seed phrases are not supported, and it will return an empty wallet instead. This threatens users funds.

For these reasons, Electrum does not generate BIP39 seeds.

https://electrum.readthedocs.io/en/latest/seedphrase.html

If that were truly the case, the Electrum seed would be the standard rather than BIP39. It has been over +13 years since BIP39 was introduced, and to this day, I don't see people struggling to access their balances, the fact that few software apps support the Electrum seed version speaks volumes...

[DireWolfM14]

I'm with Forsyth Jones on this one.  As big a fan as I am of Electrum wallet, I'm not a fan at all of Electrum's seeds.  Having a standard that only one few software wallets (and no hardware wallets) accommodate poses more risks and problems than Electrum's extra checksum is meant to remedy.

To address each of TV's points:

1.  Multiple accounts is a rich feature of Bip39/44 not a problem.  Many modern wallets (such as Sparrow and Trezor Suite) have implemented them into a single wallet file flawlessly.  I hope Electrum can follow suit, although I don't see any plans to do so.

2. This point has been made mute by modern implementations.  No modern wallet requires passwords to access derivation paths.

3.  I disagree with Thomas on this.  Software handling multiple derivation paths in the background is far simpler for the end user than having the user juggle multiple passphrases on his own.  And in reality, they are not the same thing so they should not be equated as such.  One does not to exclude the other.

4.  I'm not 100% sure I understand Thomas' concern here, so I'll pass.

5.  I suspect this point and the previous are related, and again, I'm not sure why Thomas would be opposed to a list of 2048 words.  If his concern is to keep things minimal, 2048 words is hardly anything for today's computers (or those from 2016) to sift through.  Contemporary storage wasn't an issue for a file of that size, and it's becoming even less of an issue day by day.

6.  To counter this point, I'll ask us all to recollect a little bit of history; there were indeed some growing pains when SegWit was first starting to become the standard, hell I even had an issue with this recently when one of my buddies in the Fantasy Football league had a problem sending his payment to the escrow address (Coinomi  )  So, I can understand Thomas's concern at the time.  However, as FJ pointed out, the Electrum dev team has addressed this issue since then by implementing a tool that searches for funds in off-the-beaten-path derivations, so this has become a non-issue.  Were that derivation search tool to be coupled with more modern implementations of multiple accounts in a single file, it would be even less of an issue.

/opinion

To address the OP's original concern, don't be afraid.  Many of us go out of our way to use Electrum with old fashioned Bip39 mnemonics.  

[NotATether]

I don't want to manage 04 separate mnemonics for every address type, each with its own version number that derives a specific path and script.

To create 5 separate account wallets for my BTCPay Server stores, I had to extract the zprv from the Electrum wallet after typing the seed, manually derive each store's zpub using m/84'/0'/[0-4]' using Iancoleman and then copy the resulting zprv into Sparrow Wallet, since Electrum couldn't do it.

I would appreciate it if Electrum could better handle account wallets like this though.