How Ledger device generates 24-word recovery phrase

The recovery phrase is the key to managing your crypto assets. As such, the recovery phrase should be something that is long and nearly impossible for anyone to guess. Your recovery phrase isn’t like a password or a PIN (Ledger devices already have PINs to protect access to them), instead, it’s the root of all of your cryptographic secrets. Once your device randomly generates it for the first time and you write it down on paper, you will only need to access it if you have to recover your device.

Ledger uses a standard called BIP 39 for the generation and interpretation of the recovery phrase on all of our devices. BIP 39 is an industry-standard used by many other hierarchical deterministic wallets. The exact type of BIP 39 seed used by Ledger devices by default is a 24-word mnemonic that consists of only the 2048 words from the BIP 39 English wordlist. Here’s how a BIP 39 24-word mnemonic seed is generated:

1. The device generates a sequence of 256 random bits using the True Random Number Generator (TRNG) built into the device’s Secure Element.
2. The first 8 bits of the SHA-256 hash of the initial 256 bits are appended to the end, giving us 264 bits
3. All 264 bits are split into 24 groups of 11 bits
4. Each group of 11 bits is interpreted as a number in the range 0 - 2047, which serves as an index to the BIP 39 wordlist, giving us 24 words

The result of this process is that your device will generate a single mnemonic seed out of 2²⁵⁶ possible mnemonic seeds (That’s one of 115 792 089 237 316 195 423 570 985 008 687 907 853 269 984 665 640 564 039 457 584 007 913 129 639 936 possible mnemonic seeds). 

Note that while the first 23 words are completely random, the final word is derived from 3 random bits and 8 calculated bits from the SHA-256 hash. This means that the final word can act as a checksum - if you input an incorrect seed into the device while recovering it, it is possible for the device to detect that the inputted seed is invalid.