ENTROPÍA

My backup has 20 or 33 words per share: is it SLIP-39?

You wrote down your backup and found that each share has 20 or 33 words, and you're not sure if that's a valid seed or if you messed up.

If your backup has shares with 20 or 33 words, it's SLIP-39: a different way to split your seed, not an error.

What is SLIP-39 and why do my shares have 20 or 33 words?

SLIP-39 is a standard that splits your seed into multiple shares using Shamir's scheme. Instead of storing a single phrase, you store several shares, and each share has its own list of words.

The number of words per share depends on the seed's entropy: for 128 bits, each share has 20 words; for 256 bits, each share has 33 words.

This is not a mistake: if your wallet gave you a backup with shares of 20 or 33 words, it's because it uses SLIP-39.

Why doesn't my backup look like a common seed?

Most wallets use BIP-39, where you write down a single phrase. SLIP-39 instead gives you several phrases, one per share, and each of those phrases has 20 or 33 words.

Seeing multiple sheets with those numbers, it's normal to think you made a mistake or the backup is incomplete. But it's the design of SLIP-39: you need a minimum number of shares to reconstruct the seed, not all of them.

What do I need to recover my bitcoin?

Having one share of 20 or 33 words is not enough. You need to gather the minimum number of shares you configured when creating the backup (the threshold).

Also, the wallet you use to restore must support SLIP-39. If it doesn't, it won't accept those phrases, even if you have all the shares.

If your current wallet doesn't understand SLIP-39, you can use another one that does to reconstruct the seed and then move the funds if you want.

Where this comes from

The exact quote from SLIP-0039 is: "This SLIP describes a standard and interoperable implementation of Shamir's secret-sharing (SSS) and a specification for its use in backing up Hierarchical Deterministic Wallets".

That means SLIP-39 is an interoperable standard for backing up HD wallets using Shamir shares. The word count per share (20 for 128 bits, 33 for 256 bits) is defined in the specification.

Having 20 or 33 words per share doesn't mean you can restore in any wallet

SLIP-39 is a standard, but not all wallets support it. You also need to gather the minimum number of shares you configured (the threshold), not just one share. The word count per share (20 for 128 bits, 33 for 256 bits) doesn't tell you the threshold or which wallet you originally used.

Source: SLIP-0039