BIP39 passphrase
A BIP39 passphrase (sometimes called the "25th word") is an optional extra secret mixed into the seed. The same recovery phrase with a different passphrase gives a completely different wallet: different master fingerprint, xpubs and addresses.
BitTool Signer supports it both when creating and when importing a wallet: turn on BIP39 passphrase, type it twice. It is stored inside the encrypted vault together with the phrase, so the user does not type it again to sign.
The recovery phrase alone cannot restore a wallet that has a passphrase. The app says so on every backup screen, and none of the backup forms (words, QR code, recovery cards) include the passphrase. The passphrase is also not the wallet password: the password only encrypts the vault on this phone.
How it enters the seed
seed = PBKDF2-HMAC-SHA512(password = NFKD(phrase), salt = NFKD("mnemonic" + passphrase), 2048 iterations, 64 bytes)
- The passphrase is normalized with Unicode NFKD, as BIP39 requires. This matters for passphrases with accents, full-width characters or CJK compatibility characters: a wallet that skips normalization derives a different seed from the same text.
- It is used exactly as typed otherwise: no trimming, no case folding. A trailing space is part of the passphrase.
- An empty passphrase means "no passphrase". If the option is turned on, it must be non-empty and both entries must match.
- Up to 1,024 bytes (UTF-8).
The implementation was checked against the published BIP39 vectors and the official Japanese vectors, which include a passphrase with compatibility characters.
Example
The public test phrase with and without the passphrase TREZOR (the passphrase used by the published BIP39 test vectors):
| No passphrase | Passphrase TREZOR | |
|---|---|---|
| Master fingerprint | 73c5da0a | b4e3f5ed |
Bitcoin m/84'/0'/0'/0/0 | bc1qcr8te4kr609gcawutmrza0j4xv80jy8z306fyu | bc1qv5rmq0kt9yz3pm36wvzct7p3x6mtgehjul0feu |
EVM m/44'/60'/0'/0/0 | 0x9858EfFD232B4033E47d90003D41EC34EcaEda94 | 0x9c32F71D4DB8Fb9e1A58B0a80dF79935e7256FA6 |
TRON m/44'/195'/0'/0/0 | TUEZSdKsoDHQMeZwihtdoBiN46zxhGWYdH | TAyDUYP5rcf56xFwrg8cU1qQwvnWpkeapM |
Solana m/44'/501'/0'/0' | HAgk14JpMQLgt6rVgv7cBQFJWFto5Dqxi472uT3DKpqk | 7zSmbu6gKkb6HB7UDPtHYjwCWuBHU1D4TpNZFm4sndQe |
The 64-byte seeds
5eb00bbddcf069084889a8ab9155568165f5c453ccb85e70811aaed6f6da5fc19a5ac40b389cd370d086206dec8aa6c43daea6690f20ad3d8d48b2d2ce9e38e4
c55257c360c07c72029aebc1b53c05ed0362ada38ead3e3e9efa3708e53495531f09a6987599d18264c1e1c92f2cf141630c7a3c4ab7c81b2f001698e7463b04
What it means for your wallet
Nothing special: the passphrase never leaves BitTool Signer. A passphrase wallet simply pairs with its own master fingerprint and xpubs, and its signing requests must carry that fingerprint. To your integration it is just another wallet.
Two practical consequences:
- One phrase, several wallets. A user can have the same phrase in BitTool Signer twice, with and without a passphrase. They show different fingerprints; do not merge accounts by phrase or by name, only by the exported public keys.
- The fingerprint is a quick check. If a user expects a passphrase wallet but pairs one whose fingerprint they recognize from the no-passphrase wallet, they probably forgot (or mistyped) the passphrase.