Most modern ZCash wallets create a recovery phrase based on BIP39, the same standard used by Bitcoin and Ethereum wallets. Understanding how that phrase is built helps you back it up correctly, verify it, and avoid the mistakes that cause permanent fund loss.
Step 1: Generating Entropy
The process starts with random entropy. BIP39 allows 128, 160, 192, 224, or 256 bits. A 12-word phrase uses 128 bits, and a 24-word phrase uses 256 bits. Good wallets draw this randomness from the operating system's cryptographically secure random number generator.
Step 2: Adding a Checksum
The SHA-256 hash of the entropy is calculated. The first ENT/32 bits of that hash are appended to the entropy. For 128 bits of entropy, that means 4 checksum bits. This checksum lets software detect most typos and invalid phrases before any funds are touched.
Step 3: Splitting Into 11-Bit Groups
The combined bit string is split into groups of 11 bits. Each group is an index from 0 to 2047 into the standardized BIP39 English wordlist, which contains 2048 words. A 12-word phrase therefore encodes 132 bits in total: 128 bits of entropy plus 4 checksum bits.
Step 4: Deriving the Seed
The mnemonic words are converted to a 64-byte seed using PBKDF2 with HMAC-SHA512, 2048 iterations, and the salt 'mnemonic' followed by an optional passphrase. The passphrase is an extra secret. If you lose it, the phrase alone will not restore the same wallet, even though the words are correct.
Step 5: Deriving ZCash Keys
The 64-byte seed feeds into BIP32 hierarchical deterministic key derivation. ZCash uses different derivation paths depending on the address type:
- Transparent addresses follow BIP44 with coin type 133, for example m/44'/133'/0'/0/0.
- Shielded addresses use ZIP32, which defines its own derivation scheme for Sapling and Orchard keys.
Because derivation paths differ, the same phrase can show different addresses in wallets that use different paths. When restoring a wallet, confirm the wallet supports the account type you used.
Why Partial Recovery Is Hard
If you remember only some words, the checksum limits the possible combinations, but the search space is still very large for a 24-word phrase. Recovery is realistic mainly when you know most of the words, know their positions, or remember a small number of unknown words with the rest confirmed. Guessing a phrase from scratch is not practical.
Protecting Your Phrase
- Write the phrase on paper or metal and store copies in separate secure locations.
- Never type your phrase into a website, app, or support chat that you did not verify yourself.
- Be cautious of anyone who offers to recover your funds for an upfront fee or asks for your seed phrase. Legitimate wallet developers never ask for it.
- Test your backup by restoring it to a new device with small amounts before storing large balances.
- Work with sensitive keys only on an offline or trusted device.
Summary
ZCash's use of BIP39 follows the same core pipeline as other BIP39 wallets: entropy, checksum, wordlist indices, PBKDF2 seed derivation, and BIP32 key generation. Knowing these steps makes it easier to back up a phrase correctly and recognize the limits of recovery. If you have lost access to your own wallet, start with your original backups and the wallet's official recovery documentation, and keep your keys offline throughout the process.