Work out wallet key derivation instantly with clear inputs, formula shown and shareable results.
BIP-39 encodes entropy plus a checksum into words from a 2048-word list, so each word carries 11 bits: 12 words is 128 bits of entropy plus 4 checksum bits, and 24 words is 256 plus 8. The mnemonic is stretched to a seed with PBKDF2-HMAC-SHA512 at 2048 iterations, then BIP-32 derives a tree of keys, with BIP-44 giving each account an external and a change chain.
BIP-39 and BIP-44
entropy bits = words x 11 x 32/33; checksum bits = entropy / 32; addresses = accounts x addresses per account x 2 chains
128 bits of entropy is beyond brute force, so yes for almost all purposes. 24 words gives 256 bits, which some prefer for very long-term or high-value storage.
It is fixed by the BIP-39 specification for interoperability, which is weak by password-hashing standards. Security relies on the mnemonic's own entropy, not on key stretching, so an optional passphrase is what protects a stolen mnemonic.