BIP-39

BIP-39 (Bitcoin Improvement Proposal 39) is the specification that defines how to generate, encode, and recover a mnemonic phrase. Adopted by the Bitcoin community in 2013, it has since become an industry default: every major TON wallet (Tonkeeper, MyTonWallet, Tonhub, in-Telegram Wallet) uses it, and so do Ethereum, Bitcoin, Solana, and most other ecosystems.

What the standard defines

BIP-39 nails down three things:

1. Wordlists. A 2048-word list in eleven languages (English, Japanese, Chinese Simplified and Traditional, French, Italian, Spanish, Korean, Czech, Portuguese). English is the de facto standard on TON.
2. Generation algorithm. Random entropy (128, 192, or 256 bits) → SHA-256 → checksum → bits split into 11-bit groups → each group indexes into the wordlist → word.
3. Seed derivation. Mnemonic + optional passphrase → PBKDF2-HMAC-SHA512 (2048 iterations) → 64-byte master seed.

Why 2048 words

11 bits per word (2¹¹ = 2048). 24 words × 11 bits = 264 bits, of which 256 are entropy and 8 are a checksum that catches typos on manual entry.

Words are chosen so that the first four letters are unique, allowing prefix input with autocomplete. The list also avoids similar-looking words and any word shorter than three characters, both to reduce input error.

TON and BIP-39

TON wallets use only the English BIP-39 wordlist and 24-word phrases. Key derivation follows a TON-specific scheme (Ed25519, path m/44'/607'/0'), but the source mnemonic is standard BIP-39. In theory the same 24-word phrase could be used in both a TON wallet and a Bitcoin or Ethereum wallet — they would produce different keys and addresses because the derivation paths differ.

Passphrase (the BIP-39 “25th word”)

An optional password mixed into the mnemonic at the PBKDF2 step. Changing it changes the master seed, hence every address. In practice TON wallets rarely use passphrases — Tonkeeper, for example, does not — while Bitcoin users (especially with Ledger) often do.