How a Ledger Generates Your Recovery Phrase and Where the Words Come From

05 September 2026

The process starts inside the Secure Element. This is a dedicated chip, physically distinct from the main processor, designed to resist physical tampering and side-channel attacks. When you initialize a new ledger-guide/ledger-genuine-check-how-it-works/">Ledger device, the Secure Element generates randomness. That randomness is the foundation of everything that follows.

The source of that randomness matters. The Secure Element contains a true random number generator, or TRNG, which harvests entropy from physical phenomena - thermal noise, for example. No software algorithm is involved. This means the seed cannot be predicted, even theoretically, by someone who knows the exact moment you pressed the button. The entropy is hardware-derived.

That raw entropy is a long string of bits. It is not yet a recovery phrase. The translation happens through a standard called BIP39, which defines a fixed list of 2048 words. The entropy bits are hashed, then split into chunks; each chunk maps directly to one word on that list. The words were chosen for clear pronunciation and distinct spelling. "Abandon" and "ability" are hard to confuse. The mapping is deterministic: the same entropy always produces the same phrase.

You can choose between 12 words and 24 words. Both start from the same kind of entropy; the difference is the amount. A 12-word phrase represents 128 bits of entropy. A 24-word phrase represents 256 bits. The security difference is real - 256 bits is stronger than 128 bits - but both exceed any practical brute-force threshold. A computer that could try one trillion guesses per second would still need billions of years to crack 128 bits. The 24-word phrase is overkill for any threat model that does not involve quantum computers or nation-state adversaries. The real tradeoff is inconvenience. 24 words are harder to write down and easier to mis-record. Most users lose their crypto through poor storage, not brute force.

There is a fourth word count. 18-word phrases exist but are uncommon. Ledger does not offer them. Stick with 12 or 24.

The genuine check process is the part you cannot skip. A tampered device could generate a predictable phrase - an attacker could replace the Secure Element with a chip that returns the same entropy every time, or a chip that leaks the entropy over USB. The genuine check is a cryptographic attestation: the Secure Element signs a challenge with a private key embedded at manufacture, and Ledger's server verifies that signature. If the device is genuine, the server confirms it. If the signature is missing or invalid, the device cannot be trusted. You should never generate a recovery phrase on a device that fails the genuine check.

The words are never transmitted off the device. They remain inside the Secure Element. When you confirm the phrase during setup, the device shows each word on its screen and you confirm by selecting it from a scrambled list. The device never sends the phrase over USB. It never sends it to Ledger's servers. The only copy is the one you write down.

The recovery phrase is the single point of failure. The Secure Element protects it during use; the paper you write it on protects it during storage. The BIP39 wordlist is public. The entropy that selects the words is private. That entropy, properly generated and properly stored, is what makes a hardware wallet secure. The rest is just math.

Back to ledger