BIP 32 (HD Wallets)

BIP 32, authored by Pieter Wuille in February 2012, is the foundational standard for hierarchical deterministic (HD) Bitcoin wallets. One seed of 128 to 512 bits (the BIP 39 seed is 512) produces a tree of keys, all reproducible from that single seed. Back up the seed, and you've backed up every key your wallet will ever derive.

The construction is straightforward. The seed is run through HMAC-SHA512 with the fixed key "Bitcoin seed", and the 512-bit result is split into a 256-bit master private key and a 256-bit chaincode, bundled together as an extended private key (xprv). To derive a child key, HMAC-SHA512 is computed over the parent key and the child index, with the chaincode as the HMAC key. The left half of the output, added to the parent key, gives the child's key; the right half is the new chaincode. Repeat at each level to walk the tree.

Two derivation modes matter:

• Non-hardened (child index < 2^31). The child public key can be derived from the parent public key plus the chaincode. This is what makes xpub useful: hand someone the xpub and they can derive every receive address without ever seeing the private side.
• Hardened (child index >= 2^31). The derivation requires the parent private key. An attacker who learns one hardened child private key cannot reconstruct the parent or its siblings. This closes a famous attack on non-hardened derivation. BIP 44 conventionally uses hardened derivation for account-level paths so a leaked account key doesn't compromise other accounts.

Why this matters in practice:

• One backup, infinite addresses. Generate a fresh address for every transaction without making more backups.
• Watch-only wallets. Import an xpub into a phone app to monitor a hardware wallet's balance without exposing any private key.
• Multi-account separation. BIP 44 uses hardened account-level paths so an exposed account doesn't bleed into siblings.
• Cross-wallet portability. Restore the seed in another wallet that uses the same derivation path and script type and you get the same addresses; BIP 32 leaves the tree layout advisory, which is why BIP 44 and output descriptors pin it down. The seed is the asset; the software is replaceable.

BIP 32 alone says only that the seed is random bytes; it doesn't specify how to back it up in a form humans can write down. That's BIP 39: mnemonic seed phrases. Together they're the foundation of modern Bitcoin self-custody.

Spec: BIP-32.