BIP-39 — Bitcoin Improvement Proposal 39 — is the specification that turned the abstract concept of "256 bits of entropy" into the twelve or twenty-four English words almost every modern wallet uses to back up keys. Authored by Marek Palatinus, Pavol Rusnak, Aaron Voisine, and Sean Bowe and ratified in 2013, it is now the de facto standard across Ledger, Trezor, Coldcard, Keystone, MetaMask, Rabby, and dozens of others.
The three things BIP-39 standardized
First, the wordlist. A fixed 2,048-word English wordlist, chosen so that the first four letters of each word are unique — useful for shorter steel-plate engravings where engraving the full word is impractical. Translated wordlists exist for Japanese, Korean, Spanish, French, and seven other languages, but the English wordlist remains the most widely supported and the recommended default.
Second, the entropy-to-words conversion. The wallet hashes entropy, appends checksum bits (one bit per thirty-two bits of entropy), and slices the result into eleven-bit chunks. Each chunk indexes into the wordlist. The result is twelve words for 128 bits of entropy, fifteen for 160, eighteen for 192, twenty-one for 224, twenty-four for 256.
Third, the words-to-seed conversion. The words pass through PBKDF2-HMAC-SHA512 with 2,048 iterations and an optional passphrase as salt. The output is a 512-bit seed that BIP-32 derivation paths consume to produce private keys.
The checksum quietly catching mistakes
If you transcribe the words wrong, the checksum bits will fail validation and the wallet will refuse to restore. This catches roughly 1-in-16 single-word swaps and almost all multi-word substitutions. It is one of the most underappreciated user-protection features in crypto, and the reason "I think I wrote it down right" is at least partially verifiable on a clean device.
What BIP-39 is not
BIP-39 is not BIP-32 (the derivation tree) or BIP-44 (the multi-account, multi-coin path structure). They are three separate standards that compose: BIP-39 turns words into a seed, BIP-32 turns the seed into a tree of keys, BIP-44 organizes the tree into account and coin slots. Almost every modern wallet implements all three.
The catch: BIP-39 is dominant but not universal. Cardano uses a different scheme (Icarus / Yoroi specification). Solana's older wallets use raw seed phrases without the BIP-32 derivation step. Always verify the wallet you are migrating to follows the same combination of BIP-39, BIP-32, and BIP-44.
Further reading: Mnemonic, BIP-32, BIP-44, Derivation path.