(Node.js) BIP39 Compute Binary Seed from Mnemonic

See more Encryption Examples

Creates a binary seed from a mnemonic. Uses the PBKDF2 function with a mnemonic sentence (in UTF-8 NFKD) used as the password and the string "mnemonic" + passphrase (again in UTF-8 NFKD) used as the salt. The iteration count is set to 2048 and HMAC-SHA512 is used as the pseudo-random function. The length of the derived key is 512 bits (= 64 bytes).

Install Chilkat for Node.js and Electron using npm at Chilkat npm packages for Node.js Chilkat npm packages for Electron on Windows, Linux, MacOSX, and ARM

var os = require('os');
if (os.platform() == 'win32') {  
    if (os.arch() == 'ia32') {
        var chilkat = require('@chilkat/ck-node21-win-ia32');
    } else {
        var chilkat = require('@chilkat/ck-node21-win64'); 
    }
} else if (os.platform() == 'linux') {
    if (os.arch() == 'arm') {
        var chilkat = require('@chilkat/ck-node21-arm');
    } else if (os.arch() == 'x86') {
        var chilkat = require('@chilkat/ck-node21-linux32');
    } else {
        var chilkat = require('@chilkat/ck-node21-linux64');
    }
} else if (os.platform() == 'darwin') {
    if (os.arch() == 'arm64') {
        var chilkat = require('@chilkat/ck-node21-mac-m1');
    } else {
        var chilkat = require('@chilkat/ck-node21-macosx');
    }
}

function chilkatExample() {

    // This example assumes the Chilkat API to have been previously unlocked.
    // See Global Unlock Sample for sample code.

    var crypt = new chilkat.Crypt2();

    // Test with the test vectors at https://github.com/trezor/python-mnemonic/blob/master/vectors.json

    // This is the 2nd test vector..
    var mnemonic = "legal winner thank year wave sausage worth useful legal winner thank yellow";
    var passphrase = "TREZOR";
    var expectedSeed = "2e8905819b8723fe2c1d161860e5ee1830318dbf49a83bd451cfb8440c28bd6fa457fe1296106559a3c80937a1c1069be3a3a5bd381ee6260e8d9739fce1f607";
    var expectedMasterKey = "xprv9s21ZrQH143K2gA81bYFHqU68xz1cX2APaSq5tt6MFSLeXnCKV1RVUJt9FWNTbrrryem4ZckN8k4Ls1H6nwdvDTvnV7zEXs2HgPezuVccsq";

    // The mnemonic sentence (in UTF-8 NFKD) used as the password.
    // The string "mnemonic" + passphrase (again in UTF-8 NFKD) used as the salt.
    // The iteration count is set to 2048 and HMAC-SHA512 is used as the pseudo-random function.
    // The length of the derived key is 512 bits (= 64 bytes). 

    // We want the computed seed to be lowercase hex, therefore our salt must also be hex.
    // The seed is the keyword "mnemonic" + passphrase (in this case is "TREZOR") converted to hex.
    var bdSalt = new chilkat.BinData();
    bdSalt.AppendString("mnemonic","utf-8");
    bdSalt.AppendString(passphrase,"utf-8");

    var computedSeed = crypt.Pbkdf2(mnemonic,"utf-8","sha512",bdSalt.GetEncoded("hex_lower"),2048,512,"hex_lower");

    console.log("Expected: " + expectedSeed);
    console.log("Computed: " + computedSeed);

    // To compute the hd_master_key, duplicate this Python code:

    //     def to_hd_master_key(seed: bytes, testnet: bool = False) -> str:
    //         if len(seed) != 64:
    //             raise ValueError("Provided seed should have length of 64")
    // 
    //         # Compute HMAC-SHA512 of seed
    //         seed = hmac.new(b"Bitcoin seed", seed, digestmod=hashlib.sha512).digest()
    // 
    //         # Serialization format can be found at: https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki#Serialization_format
    //         xprv = b"\x04\x88\xad\xe4"  # Version for private mainnet
    //         if testnet:
    //             xprv = b"\x04\x35\x83\x94"  # Version for private testnet
    //         xprv += b"\x00" * 9  # Depth, parent fingerprint, and child number
    //         xprv += seed[32:]  # Chain code
    //         xprv += b"\x00" + seed[:32]  # Master key
    // 
    //         # Double hash using SHA256
    //         hashed_xprv = hashlib.sha256(xprv).digest()
    //         hashed_xprv = hashlib.sha256(hashed_xprv).digest()
    // 
    //         # Append 4 bytes of checksum
    //         xprv += hashed_xprv[:4]
    // 
    //         # Return base58
    //         return b58encode(xprv)

    // First compute the HMAC-SHA512 of the computedSeed
    var bdSeed = new chilkat.BinData();
    bdSeed.AppendEncoded(computedSeed,"hex_lower");
    crypt.EncodingMode = "hex_lower";
    crypt.HashAlgorithm = "sha512";
    crypt.SetMacKeyString("Bitcoin seed");
    var hmacSha512_hex = crypt.MacBdENC(bdSeed);

    var bdHmac = new chilkat.BinData();
    bdHmac.AppendEncoded(hmacSha512_hex,"hex_lower");

    var bdXprv = new chilkat.BinData();
    bdXprv.AppendEncoded("0488ade4","hex_lower");
    bdXprv.AppendEncoded("000000000000000000","hex_lower");
    bdXprv.AppendEncoded(bdHmac.GetEncodedChunk(32,32,"hex_lower"),"hex_lower");
    bdXprv.AppendByte(0);
    bdXprv.AppendEncoded(bdHmac.GetEncodedChunk(0,32,"hex_lower"),"hex_lower");

    // Double hash using SHA256
    crypt.EncodingMode = "hex_lower";
    crypt.HashAlgorithm = "sha256";

    var bdHash = new chilkat.BinData();
    bdHash.AppendEncoded(crypt.HashBdENC(bdXprv),"hex_lower");
    var secondHash = crypt.HashBdENC(bdHash);
    bdHash.Clear();
    bdHash.AppendEncoded(secondHash,"hex_lower");

    // Append the 1st 4 bytes of the bdHash to bdXprv.
    bdXprv.AppendEncoded(bdHash.GetEncodedChunk(0,4,"hex_lower"),"hex_lower");

    // Base58 encode bdXprv
    var computedMasterKey = bdXprv.GetEncoded("base58");

    console.log("Expected Master Key: " + expectedMasterKey);
    console.log("Computed Master Key: " + computedMasterKey);

}

chilkatExample();