BIP85: one backup, many wallets

Every wallet you create adds a seed phrase to protect, and protecting a seed phrase properly is not a small job. Two metal plates in two buildings, a tested restore, a note for whoever handles your estate — that is the real cost, and it is the same cost whether the wallet holds a fortune or a coffee fund. Do it four times and most people quietly stop doing it properly.

BIP85 answers that directly. One master seed becomes a factory that produces as many completely ordinary seed phrases as you ask for, each one a real wallet you can restore anywhere, each one derived again from the master whenever you need it. You back up one thing. Everything else is reproducible.

That is a genuinely good trade for some people and a bad one for others, and the difference is not about how technical you are. It is about whether you will keep a record.

A single metal seed plate on a workbench, and fanned out in front of it a row of blank paper cards — each one a wallet that does not exist yet. Shot from a low angle so the plate reads as the source and the cards as the output.

Image to come

1What it actually does

BIP85 — Deterministic Entropy From BIP32 Keychains — takes your master seed and a number you choose, and produces a fresh block of entropy from the two of them. That entropy is then formatted as whatever you asked for: most usefully, a standard BIP39 seed phrase of twelve or twenty-four words.

The number you choose is called the index. Index 0 produces one seed phrase. Index 1 produces a completely different one. Index 847 produces a third. The same master with the same index and the same word count always produces the same phrase, on any device that implements the standard.

Three properties do the real work here, and each one is worth stating on its own.

• The children are ordinary seeds. A BIP85-derived phrase is not a special format. It restores into Sparrow, Electrum, a hardware wallet, or anything else that speaks BIP39, and nothing downstream ever needs to know where it came from.
• Derivation only runs one way. Someone holding a child seed cannot work backwards to the master, and cannot reach any of its siblings. Each child is genuinely isolated from the others.
• Nothing is stored. The children are not saved on the device or written into the master's backup. They are recomputed from the master and the index every time, which is exactly why you only have to protect one backup.

2The parameters are part of the address

The index alone does not identify a wallet. The full derivation path also carries the application and, for seed phrases, the language and the word count:

m/83696968'/39'/0'/12'/0' — BIP85, BIP39 words, English, 12 words, index 0.

Change the word count and you get a different wallet. Twelve words at index 0 and twenty-four words at index 0 are unrelated phrases leading to unrelated wallets, from the same master, at the same index. This surprises people, and it is the most common way a BIP85 wallet gets mislaid.

• Asking for the wrong word count does not produce an error. It produces a valid, empty wallet — the same silent failure a mistyped passphrase produces, for the same underlying reason.
• Different tools present these fields differently. Some ask for word count explicitly, some default to 12, some to 24. Note what you actually selected rather than what you assume the default was.

3The obligation nobody mentions

Here is the part that decides whether BIP85 helps you or hurts you.

Your master seed is safe on its metal plate. Two years later you want to reach the wallet that holds most of your savings. You have the master. You have a BIP85-capable device. What you need now is the answer to which index, at which word count — and that answer exists nowhere except in your memory or in a note you wrote.

BIP85 does not remove the record-keeping. It replaces several seed backups with one seed backup plus an index, and the index is the half people forget is load-bearing.

The failure is recoverable in principle: you can walk indexes 0, 1, 2 upward at both word counts and check each resulting wallet for a balance. It is tedious, it is easy to give up on, and it is a genuinely bad thing to be doing for the first time during an emergency — or for your family to be attempting without you.

So write it down, and write it down in a form that survives you:

• Record that BIP85 is in use at all. A lone master seed with no note looks like an ordinary single wallet. Whoever restores it will find the master's own wallet, see whatever is in it, and never look for the other five.
• Record each index, its word count, and what that wallet is for — in plain language, not a private code. Index 1, 24 words, long-term savings beats 1/24/LTS when the reader is not you.
• Keep that record with the master backup or alongside it. Unlike a passphrase, the index list is not a secret worth separating: on its own it opens nothing, and separating it just gives you a second thing to lose.
• Update it the moment you derive a new child, not later. The wallet you forgot to record is always the one you created quickly.

4Where it earns its place

The clearest wins are the ones where you were going to create several wallets anyway and were quietly dreading the backup work.

• Separating money by purpose. A spending wallet on a phone, a savings wallet on a signing device, and a wallet you use for anything public-facing — three real separations, one backup behind them.
• A hot wallet you can afford to lose. Derive the phone wallet's seed from the master, load it with what you would carry in cash, and treat the phone as disposable rather than as something needing its own backup ritual.
• Wallets with a short life. A wallet for one project, one trip, or one counterparty, which you would otherwise never get around to backing up at all.
• Replacing a device without replacing your backups. The child seed goes onto the new hardware; the metal plate in the safe is untouched and still correct.
• Practice and testing. Deriving a throwaway wallet to rehearse a restore costs nothing and puts nothing real at risk.

Notice what these have in common: in each one the alternative was not a better-protected wallet, it was a wallet whose backup you were going to neglect. BIP85 is at its best when it replaces a bad habit rather than a good one.

5Uncle Jim

Most families have one person who ends up as the bitcoin help desk. In bitcoin circles that person has a name — Uncle Jim — and BIP85 is frequently recommended to them, because it appears to solve the hardest part of the job.

The pitch is easy to see. Your sister wants to hold some bitcoin and is never going to maintain a seed backup. So you derive index 5 from your master, hand her those twelve words on a card, help her restore them into a wallet, and she is holding her own bitcoin on her own phone. If she loses the card, her phone, and the note she wrote on the back of an envelope, you can regenerate her seed from your master and have her wallet back in ten minutes.

That backstop is real, and for someone who would otherwise have left the money on an exchange, it is a meaningful improvement. But the arrangement has a property that must be said out loud, in plain words, to everyone in it.

You can spend her bitcoin. Not through a support process or a legal claim — directly, at any time, from your own master seed, without her knowing.

That does not make it a bad arrangement. It makes it a custodial one, and the trouble starts when it is described as self-custody to someone who then relies on it as though it were.

Two hands across a kitchen table: one passing a small card of recovery words, the other reaching to take it. Warm domestic light, faces out of frame — the transaction is between the hands, not the people.

Image to come

Doing it honestly

• Say the quiet part first. “I generated this from my own seed, which means I can access it. You should treat this as training wheels, not as a vault.” If that sentence changes their mind, it needed saying.
• Match the amount to the trust. This arrangement suits pocket-money balances and first steps. It does not suit someone's retirement.
• Plan the graduation. The goal is that they eventually generate their own seed, on their own device, and move the funds to it. Agree what triggers that — an amount, a date, or a level of confidence.
• Say what happens if you die. Their bitcoin is now downstream of your master seed and your index list. If your estate plan does not mention their wallet, your executor may restore the master, see funds derived from it, and treat them as yours.
• Keep their index recorded like any other. Index 5, 12 words, Sarah's phone wallet — in the same list, in the same place.

And note the asymmetry the diagram above already showed: they cannot reach your wallets, and they cannot reach each other's. The exposure runs in exactly one direction, and it is the direction pointing at you.

When to reach for something else

If the amount matters, or the relationship would not survive a dispute about who owns what, the honest answer is not a better BIP85 arrangement. It is either their own independently generated seed — with you helping them back it up properly — or a 2-of-3 multisig where you hold one key and genuinely cannot spend alone. Multisig is more work, and it is the arrangement that actually means what the Uncle Jim setup only appears to mean.

6Where it must not be used

Two mistakes here are serious enough to be worth naming explicitly, because both look reasonable from the inside.

Never derive multiple keys of one multisig from one master

It is tempting: three keys from indexes 0, 1 and 2, one backup covering the lot. It also completely dismantles what multisig is for. The whole premise is that no single secret can move the funds — and if all three keys descend from your master seed, that master is a single secret that moves the funds. You have built a single-signature wallet wearing a costume, with more moving parts and a false sense of safety.

• Keys in a multisig must come from independently generated seeds, on separate devices, so that no one compromise reaches more than one of them.
• The same logic rules out deriving a “backup key” for someone else's multisig from your own master, and rules out using one master to stand up both sides of a shared wallet.

It is not a substitute for a passphrase, and vice versa

They solve opposite problems. A passphrase makes a discovered seed backup insufficient on its own — the words alone do not reach your money. BIP85 does the reverse: it makes one discovered seed backup sufficient for everything, because every wallet you own descends from it.

Used together they compose fine — a passphrase on the master protects the whole tree — but be clear that BIP85 by itself is a convenience feature, not a security feature. Measured against several independently generated seeds stored in several places, it concentrates risk rather than reducing it.

7The entropy ceiling

One technical detail with a practical consequence: a child can never carry more real randomness than the master it came from.

Derive twenty-four-word children from a twelve-word master and the phrases will be twenty-four words long, but their unpredictability is still bounded by the master's 128 bits — anyone attacking the system would go after the master rather than the child. The extra words are formatting, not strength.

The consequence is simple: if you intend to use BIP85 seriously, generate the master as twenty-four words, and generate it well. Rolling your own entropy is more defensible here than anywhere else on this site, because a weakness in this one seed is a weakness in every wallet you will ever derive from it.

8Support is not universal

Deriving a child requires a tool that implements BIP85. The resulting seed then works anywhere, but the derivation step does not.

Notice what that list does not divide along. It is not air-gapped against connected, and not standalone against companion-app — Jade and Passport both ship companion apps and both support it. The two without it are the large multi-asset incumbents, which is a different distinction entirely.

• Firmware changes. Confirm against the manufacturer's current documentation before you plan a setup around this, rather than trusting a list — including this one.
• Do not use a website to derive seeds. Browser-based BIP85 tools exist and will happily accept your master seed. Typing a live master seed into a browser is the single worst thing you can do with it, whatever the page promises about running offline.
• Prefer deriving on the signing device itself, where the master never leaves the hardware and the child words are only ever shown on its screen.

9Test it before it holds anything

The claim BIP85 makes is that your child wallets are reproducible from the master. That claim is worth exactly nothing until you have reproduced one on purpose.

• Derive a child at a chosen index and word count, and note its first receive address or master fingerprint.
• Wipe the device, or use a spare one, and restore the master seed from your actual backup — the plate in the safe, not the words still on screen.
• Derive the same index and word count again and confirm you land on the same wallet. This tests the backup and the derivation together, which is the pairing that matters.
• Repeat with a second index, so you have seen the indexes produce genuinely different wallets rather than assuming it.
• Have whoever would need to do this without you read your index note and tell you what they think it means.

The full procedure is in test your recovery. The BIP85 version adds one step to it — deriving the child — and that step is the one your family will not know to perform unless you have written it down.

Should you use it?

It comes down to one honest question about yourself, and it is not a question about technical skill.

• Good reason: you genuinely need several wallets, and the realistic alternative is several seed backups you will not maintain properly.
• Good reason: you already keep organised records, have tested a restore, and want to stop the backup pile growing every time you separate some funds.
• Good reason: you are standing up short-lived or low-value wallets that would otherwise go entirely unbacked.
• Bad reason: it sounds more secure. It is not — it concentrates every wallet you own behind one seed.
• Bad reason: to simplify a multisig. That is the one place it must never go.
• Bad reason: you have one wallet and no plans for a second. There is nothing here to gain and a new way to get confused.

If you hold a single wallet, BIP85 solves a problem you do not have. If you hold five and can name each one's backup location from memory, you are already doing the hard version well and may not want to change it. It is the middle case — several wallets, backups you know are not all up to standard — where this genuinely helps.