Seed Phrase (BIP-39)

A seed phrase is a sequence of ordinary words, usually 12 or 24 of them, drawn from a fixed list of 2,048, that represents a large random number. Anyone holding that sequence of words can reconstruct the exact same cryptographic keys it was generated from, on any device, at any time, with no server or account involved. That's the whole point: instead of asking someone to back up a 32-byte binary blob (or, worse, a private key formatted as an unmemorable hex string), you hand them words they can write on paper, read aloud, or type back in one at a time without a single typo going unnoticed.

How it actually works

Start with randomness, not words. A wallet generates 128 or 256 bits of entropy from a secure random source. It appends a short checksum (a few bits taken from a hash of that entropy) and slices the whole thing into 11-bit chunks, each chunk indexes one word in a standardized 2,048-word list. 128 bits of entropy plus its checksum produces 12 words; 256 bits produces 24. The checksum is why a mistyped or reordered word list usually gets rejected outright rather than silently producing a different, wrong key.

The words themselves are never used directly as a key. They're passed, as text, including any BIP-39 passphrase extension, through PBKDF2-HMAC-SHA512 with 2,048 rounds and the fixed salt "mnemonic", which stretches them into a 64-byte seed. That seed is the actual cryptographic material; the words are just a human-readable, error- checked way of writing it down and carrying it around.

Why losing it is unrecoverable, and why that's the design, not a bug

There is no password reset for a seed phrase. The entire reason it works as a self-custody mechanism is that no third party, not the wallet vendor, not a server, nobody, holds a copy or a way to regenerate it. That symmetry cuts both ways: it means no company can seize or freeze what the phrase controls, and it also means a lost phrase with no backup is keys, funds, and any identity derived from them, gone for good. A phrase that leaks, photographed, phished, or copied into an insecure note app, is just as final in the other direction: whoever has the words has everything it derives, instantly and irreversibly, with no way to revoke just the leaked copy while keeping the rest.

This single point of failure is exactly what backup schemes exist to soften, writing the phrase on metal instead of paper, splitting it across multiple physical locations, or replacing it entirely with a scheme that doesn't rely on one unsplit secret at all (see guardian-based social recovery, below).

Solidus status

Standard, unmodified BIP-39: Solidus did not touch the word list, the entropy sizes, or the stretching step, all of which carry the scrutiny of over a decade of production use across the wider cryptocurrency ecosystem via @scure/bip39.

What Solidus built on top is its own: a single BIP-39 seed derives more than one Solidus key, not just one. The DID identity key (used for credentials, guardians, and recovery, and fee-exempt on-chain) comes from the first 32 bytes of the stretched seed. A separate VALUE key, used only to hold and move SLDS, is derived via HKDF under its own domain-separation label. The chain enforces this split; a single key cannot double as both a DID and a funds-holding address. The result is that resolving someone's public DID reveals nothing about their balance or transaction history. This splitting scheme is Solidus's own construction on top of BIP-39, and it has not been independently audited.

It runs today on Solidus's public testnet only: there is no mainnet. Generation happens two ways in canon: client-side, entirely on-device, in the wallet; and server-side in identity, as a one-time step during OAuth (Google/GitHub) onboarding, where the backend generates the phrase, registers the resulting DID on-chain, hands the phrase back to the user once, and then forgets it. Neither path has carried real funds for a paying customer.

See also

Guardian Recovery is the alternative Solidus ships for identity keys, social recovery through trusted guardians instead of a single backed-up phrase being the only way back in. Pairwise DID is one of the identities derived from this same seed, kept deliberately unlinkable across verifiers.