128 to 256 bits of entropy plus a checksum of entropy-length/32 bits are split into 11-bit indices, giving 12, 15, 18, 21 or 24 words. The seed is PBKDF2-HMAC-SHA512(password = mnemonic, salt = "mnemonic" ‖ passphrase, 2048 iterations); an optional passphrase creates an entirely different wallet, which protects against theft of the words but is lost if forgotten.
The phrase is the master secret of every account derived from it, on every chain: anyone who sees it controls the funds. Legitimate tools and support staff never ask for it, and this site's tools refuse seed phrases and private keys outright. SLIP-39 (Shamir shares of a seed) is an alternative for split backups.