# Can you choose the mnemonic seed to create a wallet?

To recover a wallet, all it requires is your 25 word recovery seed. I was wondering if you can create a wallet by selecting these 25 words yourself and going from there. This would be cool because then people could pick more easily memorize their seed and also would allow people to create a wallet completely offline without any software.

Also, is the 25 word seed function specific to certain wallets or could you use those 25 words to recover a wallet on any wallet software...(i know mymonero.com uses only 12 words or at least used to)

## 5 Answers

I was wondering if you can create a wallet by selecting these 25 words yourself and going from there.

Yes. But you actually select 24 words and compute the last one (25th is the checksum, and it will always be one of the 24 words of your seed mnemonic).

Your wallet is really defined by those first 24 words, and the last one is an extra which lets you check for errors when recovering or makes recovery easier if you lose a few words somehow.

This would be cool because then people could pick more easily memorize their seed

It would (note that you'd need the correct dictionary to pick from), but I'd strongly advise against this. Human brain is horrible at producing randomness. You really should roll a random seed first, and then memorize it if you will. The generation should always be truly random.

and also would allow people to create a wallet completely offline without any software.

You can do this with dice, here's a simple way:

• Perform 4 rolls of 6-sided dice and calculate a number between 0 and 1295 like: WordIndex = 6 * 6 * 6 * (roll_1 - 1) + 6 * 6 * (roll_2 - 1) + 6 * (roll_3 - 1) + (roll_4 - 1).
• Pick a corresponding word from the dictionary using the number above as index.
• Repeat until you have 24 words.
• Compute the 25th checksum word.

Note that it will have somewhat reduced entropy (it will be about 248 bits) because we're not using a part of the dictionary but that's not really a big deal. I was playing around with this a while ago and came up with this system to minimize entropy loss.

Also, is the 25 word seed function specific to certain wallets or could you use those 25 words to recover a wallet on any wallet software...(i know mymonero.com uses only 12 words or at least used to)

It's a wallet convention thing, and any wallet can have its own if you will. The protocol doesn't care about mnemonic or seed. All you need protocol-wise is a private spend key and a private view key, where a private key is just some number smaller than l where l is a prime order of the EC curve basepoint l=2^252 + 27742317777372353535851937790883648493. Anything bigger than that will get wrapped around ie a and a+l are equivalent. There are 2 conventions in use (for now) and the 13-word one will be deprecated AFAIK.

This site, made by one developer from the core team (Luigi1111), has a great explanation on how the whole key derivation process works, and below text is taken from the site and formatted to suit SE:

Cryptonote Public Addresses differ in several ways compared to Bitcoin. First, Cryptonote uses two keypairs, known as the spend keypair and the view keypair. Furthermore, these keys are EdDSA (specifically ed25519) keys, whereas Bitcoin uses ECDSA (specifically secp256k1) keys. Finally, Cryptonote Public Addresses are direct representations of the pair of public keys, whereas Bitcoin (and clones) uses a hash of the single public key. EdDSA keys (both private and public) are 256 bits long, or 64 hexadecimal characters. Not every 256-bit integer is a valid EdDSA scalar (private key); it must be less than the "curve order". The function to do this is labeled sc_reduce32.

To add to the confusion, there are presently at least three different methods of private key derivation in existence for Monero (and other Cryptonotes), though Bitcoin also has many:

1. Original (non-deterministic) Style – The Private Spend Key and Private View Key are both independently and randomly chosen to form an account. You can simulate this above by pressing the "Random" buttons next to fields 3. and 4., then pressing "Gen 5.", "Gen 6.", and "Gen 7.", in that order. There is no good way to back up a non-deterministic account other than keeping copies of the files; you need to have a copy of both private keys, but presently only MyMonero will accept the two keys as input instead of a seed/wallet file. For these reasons, it is not recommended to use an account of this type.
2. Mnemonic (Electrum or Deterministic) Style – In this style, the Private View Key is derived from the Private Spend Key, so you only need to remember one thing: the seed, which is actually just a representation of the Private Spend Key itself. This 256-bit scalar can be easily converted to a "24-digit" Base1626 "number" in the form of a mnemonic seed, which is 25 words long with the last word being used as a checksum. Mnemonics convert on a ratio of 4:3 minimum: four bytes creates three words, plus one checksum word; eight bytes creates six words, plus one checksum word; and so on. The "seeds" created by this method will always be valid scalars as they are sent to sc_reduce32 first. The Private View Key is derived by hashing the Private Spend Key with Keccak-256, producing a second 256-bit integer, which is then sent to sc_reduce32. You can test out this style above by pressing the "Random" button on the upper right, or by pressing either of the "Random" buttons next to fields 1. and 2., then the various "Gen x." buttons. You can backup accounts of this type by writing down or otherwise saving the 25 word deterministic seed; you can easily restore using both Simplewallet and MyMonero.
3. MyMonero Style – This is similar to 2., but uses a 13 word seed instead of a 25 word seed. The 13 words convert to a 128-bit integer that is used for both spend and view key derivation, in the following form: the 128-bit integer is hashed with Keccak-256 to produce a 256-bit integer, a. a is sent to sc_reduce32, which returns the Private Spend Key. a is hashed once more with Keccak-256 to produce a second 256-bit integer, b. b is then sent to sc_reduce32, which returns the Private View Key. You may have noticed a critical difference between this style and the Electrum Style: MyMonero's Private View Key derivation is done by hashing random integer a, while Electrum Style derivation is done by hashing the Private Spend Key. This means that 13 and 25 word seeds are not compatible – it is not possible to create an Electrum Style seed (and account) that matches a MyMonero Style seed (and account) or vice versa; the view keypair will always be different. You can test out this style above with the "Random MyMonero" button. To backup MyMonero accounts, save the 13 word seed; you can currently "restore" using MyMonero only (you're really just logging in) – Simplewallet does not currently support 13-word seeds.

Also, inspecting that site's code will tell you a great deal about how it all works, if you understand JavaScript. For example, if we're interested in how exactly is the checksum derived, we must look at the code as the process is not explained on the site.

The relevant functions for conversions between seed and mnemonic are in the mnemonic.js file. If you're generating the seed by some other means, all you really need to do is compute the checksum to end up with a valid mnemonic.

function mn_get_checksum_index(words, prefix_len) {
var trimmed_words = "";
for (var i = 0; i < words.length; i++) {
trimmed_words += words[i].slice(0, prefix_len);
}
var checksum = crc32.run(trimmed_words);
var index = checksum % words.length;
return index;
}

What that function does is: assemble a string of prefixes of each of your 24 words, run a CRC32 on that string and use the resulting number to pick a checksum word. The word is picked from one of the words found in your mnemonic.

For example, if we have the mnemonic:

skirting trash phase buckets apology gags sedan coffee vinegar else fifteen pitched idled gorilla siren cucumber urban junk vastness laboratory rift rhino situated taxi

The string which we feed to CRC32 will be:

skitraphabucapogagsedcofvinelsfifpitidlgorsircucurbjunvaslabrifrhisittax

and the result of CRC32 performed on it will be 1790087523.

Performing a mod on that number with the number of words in your checksummed data (24 in this case) will give you an index of the checksum word:

3.

So, the checksum is the 4th (note that index is 0-based) word of your mnemonic:

buckets.

• "it will have somewhat reduced entropy (it will be about 248 bits) " ==> you can only obtain 75 unique numbers with the dice procedure (you lose all the numbers that are not a multiple of 2, 3 and 5). So the new entropy will be 150 bits (75^24), not 248 (1296^24). Apr 25, 2017 at 9:38
• Wow thanks! Great answer and links...im still trying to wrap my head around how people can programmatically order a cpu to make randomness but cant themselves. And shouldnt the person that knows how to program a good RNG know how to do it themselves? My intuition tells me that prng and rng arent perfect and that they may actually produce less entropy (like @assylias posted above) and lead to a smaller field for an attacker to guess at. Apr 27, 2017 at 20:53
• @assylias my idea was 4 rolls: 4^6 = 1296; 24 sets for each word: 1296^24 = 5E74; log2(5E74) = 248, but I see now how the procedure doesn't make that because simply multiplying ignores the position. I'll update. Studnt, because computer takes randomness from sources like background noise etc. For a good RNG, there's always 50:50 chance that the next bit will be 1 or 0, regardless of the sequence history. Humans make patterns, computers don't. If you can't tell the pattern, you must guess all possibilites. 4 rolls of dice always produce the same entropy buy my procedure was faulty and wasted it Apr 28, 2017 at 18:06

You can randomly select your word from the list and may be able to generate a valid address. However, not all combination would return a valid mnemonic seed because...

From moneropedia

In the official wallet, the mnemonic seed comprises 25 words with the last word being used as a checksum...

Therefore you may need to make the last word as checksum. There maybe other requirements that I'm not sure of.

You can read more here about the mnemonic seed.

"The mnemonic seed is an alternate representation of it via a list of words, which makes it easy to write it down."

So, the private key is first generated then the mnemonic seed created from it, but there is no stopping you from randomly making a mnemonic seed and it may create a valid private key/address.

• To rephrase, are you saying for every private key there corresponds a mnemonic seed but not vice versa? Apr 20, 2017 at 2:34
• I edited my answer and included some information about the mnemonic seed. Apr 20, 2017 at 2:42
• @Studnt Every key will have a valid mnemonic and every valid mnemonic will have a key. Note that 24 words define the key, 25th is a checksum which can be calculated from the 24 words if you should randomize those. Apr 21, 2017 at 21:37

be very careful, this could be considered a "brain wallet". brain wallets that are created from non-random sources have a high potential to be easily guessed. https://www.youtube.com/watch?v=foil0hzl4Pg&t=4s

• Thanks for the link...its an intriguing topic so ill check it out. But I think there is a lot to be said about being able to create a wallet yourself and being able to trust your own randomness than having to trust software to do it for you (even if it includes some user inputted randomness). Apr 20, 2017 at 21:55

With it taking around 20 minutes to scan the Monero blockchain with a viewkey, it is a power hungry proposition to guess what a brainwallet is when contrasted to Bitcoin or its altcoins.

% echo -n "MOONERO brraneWaLLeTS are not BS" | shasum -a 256 ba7d83c11cdac84a4fa4c5f93a8cfc65f1320cd85a0b5bee79950a173cb4ae9c -

% echo ba7d83c11cdac84a4fa4c5f93a8cfc65f1320cd85a0b5bee79950a173cb4ae9c | ./xmr

Seed                 : ba7d83c11cdac84a4fa4c5f93a8cfc65f1320cd85a0b5bee79950a173cb4ae9c
Private Spend Key    : 650adf7c2f5e2332c620113f67c325aaf0320cd85a0b5bee79950a173cb4ae0c
Private View Key     : 974285987a7d3158dd8976d589efc4938ab8098de98e2c3ef1b9fc718733cc0a
Public Spend Key     : ac551cebde86eacd9d56ff20f6d1e3182705e840b1af3ff967792e64ab90cb3e
Public View Key      : 46646d51b254fd8d739fdbfc1f01dd8caf43802a812fdab90600f203b6a125e7
Monero Address       : 489tHVH8TUDbPiicnbu1Az53Jv1w1gFkriiXvJduytQiBR9RWY5DQgkQfFyq1m4Qe8QXpPetusaY1Xwxdvs2MAhaT9md1ez
Electrum Seed Words  : voted gnaw taboo apply dubbed initiate awesome feast memoir maze dyslexic unbending glide fudge click dormant rural point pram umpire woozy movement agnostic auctions auctions

Compare results above with what https://xmr.llcoins.net/ can generate offline or what https://xmr.llcoins.net/addresstests.html can generate online.

The 1626 English Electrum seed words are found here. It is also worth noting that 1626^3 = 2^32. Was hoping there would be a simple manual base-1626 means to demonstrate how Electrum seed words map to a private spend key. No can do at this point of time.

Without reverse engining source code, it is not readily apparent how to pick the first 24 Electrum words and compute the 25 Electrum word from a checksum operation. I could not make out head or tails from JollyMort's working example when trying to recreate results independently.

If you would like to calculate the checksum word without trusting some online service with your seed, here is the python code. Put this into a python file and run it in the command line:

from binascii import crc32 as crc
input = "skitraphabucapogagsedcofvinelsfifpitidlgorsircucurbjunvaslabrifrhisittax"
print((crc(input.encode())%24)+1)