How the words are made
Where do the words come from? Many wallets build them under BIP-39, a Bitcoin Improvement Proposal assigned in 2013 and now marked as deployed.
The wallet starts with 128 to 256 bits of random data, adds a checksum taken from the first bits of its SHA-256 hash, and cuts the result into 11-bit pieces. Each piece picks one word from a list of 2,048. That allows phrases of 12 to 24 words, in steps of three.
The checksum is small. It is 4 bits on a 12-word phrase and 8 bits on a 24-word one, which the specification itself, in its list of shortcomings, says gives only modest odds of catching a typo and no help in correcting one. The English list is designed so that the first four letters are enough to identify any word.
An optional passphrase changes everything. The specification notes that every passphrase produces a valid wallet, and only the right one opens the wallet that holds your funds.
Where you will meet it
You see the phrase once, when you create a self-custody wallet, and again only when you restore that wallet on a new phone or device. Wallet maker MetaMask says on its support site that its team will never ask for it, and that anyone who does is trying to scam you.
How the scam runs
What does a theft attempt look like? A Canadian Anti-Fraud Centre bulletin, republished by New Brunswick’s Financial and Consumer Services Commission on August 10, 2026, describes fraudsters who claim there is a problem with your wallet that needs immediate action.
Some arrive by email or text, others by phone or post, and fake websites and harmful software are part of the kit too. The bulletin compares the phrase to a master key and warns that whoever holds it may not need your phone or your hardware wallet at all.
People who have already lost crypto get a second approach, from someone claiming they can recover it. The bulletin says these callers may already know the amount lost or a public wallet address, and that knowing correct details proves nothing about who they are.
Its storage advice is just as concrete. Keep the phrase out of email and cloud storage, and never photograph it. Neither the police nor a genuine wallet provider will ask you to send it, the bulletin adds, so the request itself is the warning sign.