If you’ve ever set up a MetaMask wallet, you have experienced this moment: a screen shows you twelve ordinary words, tells you to write them down, and warns you that if you lose them, whatever is in that wallet is gone forever. No customer support line. No password reset. No exceptions.

Those words are used to seed, or create, the private key for your wallet. I want to slow down and show you what those twelve words actually are, and why they carry all the weight they do.

You can find a version of the code used in this post on GitHub.

The phrase is not a password

A wallet password only unlocks the MetaMask app on the device sitting in front of you. It’s a convenience layer, nothing more. The twelve-word phrase, formally called a Secret Recovery Phrase, is something else entirely: it’s a human-readable encoding of the actual cryptographic seed that every key in your wallet is generated from.

That distinction matters because of what follows from it. Reinstall MetaMask on a new laptop, and your password does nothing for you. Type in the twelve words, though, and the exact same private keys and addresses reappear, because they were never stored anywhere. They were always just a deterministic function of those words.

Following the chain, step by step

The standard behind this is called BIP-39, and the process it defines is fully public and auditable. Nothing about it is proprietary to MetaMask. Roughly, three things happen in sequence:

  1. A source of randomness generates 128 bits of entropy.
  2. That entropy is mapped onto a fixed dictionary of 2,048 English words, producing the twelve words you see on screen. A checksum is baked in, so a single mistyped word will fail validation rather than silently pointing at the wrong wallet.
  3. The words themselves are run through a key-stretching function (PBKDF2) to produce a 512-bit seed, and that seed feeds a hierarchical deterministic wallet structure (BIP-32/BIP-44) that can derive an entire tree of private keys and addresses, all from that one starting point.

Every wallet you’ve ever seen, whether it’s holding Ether, Bitcoin, or almost anything else, is running some version of this same pipeline underneath its UI.

Seeing it in code

Here’s a short demonstration in Python. It generates a fresh twelve-word phrase, then derives an Ethereum-style private key and address from it, following the same derivation path (m/44'/60'/0'/0/0) that MetaMask uses internally.

from mnemonic import Mnemonic
from bip_utils import Bip39SeedGenerator, Bip44, Bip44Coins, Bip44Changes


def generate_seed_phrase():
    """Generate a new 12-word BIP-39 Secret Recovery Phrase."""
    mnemo = Mnemonic("english")
    return mnemo.generate(strength=128)


def derive_wallet_from_phrase(mnemonic_phrase, passphrase=""):
    seed_bytes = Bip39SeedGenerator(mnemonic_phrase).Generate(passphrase)
    bip44_ctx = Bip44.FromSeed(seed_bytes, Bip44Coins.ETHEREUM)
    account = (
        bip44_ctx.Purpose()
        .Coin()
        .Account(0)
        .Change(Bip44Changes.CHAIN_EXT)
        .AddressIndex(0)
    )
    private_key_hex = account.PrivateKey().Raw().ToHex()
    wallet_address = account.PublicKey().ToAddress()
    return private_key_hex, wallet_address


words = generate_seed_phrase()
print(words)

private_key, address = derive_wallet_from_phrase(words)
print(f"Private Key: {private_key}")
print(f"Wallet Address: {address}")

Run that derivation twice on the same twelve words, and you get the identical private key and address both times. No randomness re-enters the picture after the phrase is generated. That’s the whole point, and it’s also the whole risk: the words are the wallet. Anyone who has them can run this exact same derivation and arrive at your private key.

The practical takeaway

This isn’t abstract cryptography trivia. It changes how you should actually treat that recovery phrase:

  • Write it on paper, or better, stamp it into metal. Never store it as a photo, a note on your phone, or text in an email.
  • Never type it into a website. MetaMask will never ask for it outside its own extension, and any prompt claiming otherwise is a phishing attempt.
  • Treat the twelve words as equivalent to the funds themselves, because cryptographically, that’s exactly what they are.

The convenience of “just write down some words” hides a real cryptographic pipeline underneath. Once you’ve seen the pipeline, the warning screen stops feeling like boilerplate and starts feeling like exactly what it is.