Skip to content
ecdsa.com

BIP-32 (hierarchical deterministic wallets)

The Bitcoin standard for deriving a tree of keys from one seed with HMAC-SHA512 and chain codes, so one backup covers all addresses and extended public keys can derive receive addresses without private keys.
Also written asBIP-32BIP32HD wallethierarchical deterministicchain code

The master key and chain code come from HMAC-SHA512("Bitcoin seed", seed). A child at index i comes from HMAC of the parent's chain code over the parent public key (normal derivation, i below 2³¹) or the parent private key (hardened, i of 2³¹ or more, written i'). Extended keys serialize as 78 bytes with version, depth, parent fingerprint, index, chain code and key, Base58Check-encoded as xprv… or xpub….

Normal derivation has a sharp edge: an xpub together with any one non-hardened child private key reveals the parent private key, so never expose child private keys derived under a shared xpub. Hardened levels in standard paths (m/84'/0'/0') contain that risk. Ethereum wallets use the same scheme on secp256k1.

Standards and references

All terms