A Secret Master Key to all your Bitcoin Wallets (BIP-85 In Action)

An underrated and rarely talked about option for managing, travelling with and recovering complex collections of bitcoin wallets using nothing but your memory

Ok, this won’t be for everyone - but have you ever wished there was a way you could have a single secret master key that you could use to unlock any of your many bitcoin wallets?

What if you already have the ability to recreate literally a dozen or more bitcoin wallets, even if you don’t have access to all your physical backups?

Restoring hundreds of words in exactly the correct order for many, many wallets, some singlesig, some multisig, sounds like an impossible task and especially given how frail our human memories can be, it is super likely we will make a mistake too, right?

Thanks to the power of BIP-85, you can actually do this mostly by having access to a single set of 12 words.

So what is BIP-85 and how does it enable us to unlock this self custody super power?

Put simply, BIP-85 makes it possible for a bitcoin hardware signing device to take any “parent” seed of 12 or 24 words and generate 10,000 (or more) “child” seed words.

It does this using “deterministic entropy” a term that means that every child seed you generate from a parent seed will appear to be completely random. However, every time you use this function, and regardless of which hardware signing device you use, the child seed for a given parent will always be the same.

Let’s see how it works on my favourite open source signing device, the SeedSigner:

If you’re already familiar with SeedSigner, then you’d recognise that the image above shows us the seed menu for a seed we have entered.

You may not have seen the highlighted “BIP-85 Child Seed” option before though. That’s because you need to enable this option in the settings before it will become available. Here’s how:

Remember that the SeedSigner is stateless. Unless you choose to persist your settings on your SD Card you use to load the SeedSigner software, you’ll need to enable this feature each time you power on the SeedSigner.

Ok, with this is place, how do we set up our secret master key? Well, there is a catch. The only way this works is if we setup and create the master key BEFORE each of the wallets we want that master key to unlock.

Let’s assume you’re willing to recreate your wallets using new seeds.

First we need to pick the 12 words for our master key in a completely random way. The best tool I’ve seen and used to do this in an intuitively random way is with Entropia from SeedSigner and BTC Hardware Solutions.

If that’s not available, you can also use the open source randomised seed generator within your SeedSigner by taking a random picture with the device’s camera:

Tthis set of seed words will make up our secret master key.

Importantly, I am not advocating for you to store any funds in the wallet that could be created using this Master Key, we’ll see why later.

Once your Master Key has been generated and loaded onto the SeedSigner, we’re ready to go and can now generate “child” seeds.

Here’s how we do it on the SeedSigner:

The key part of the process is selecting our Index. This is a number you can pick entirely at random from 1 to 10,000. It does appear though that the SeedSigner can also support larger numbers than 10,000 but perhaps avoid going beyond 10,000 in case you ever need to recover using a different type of signing device that doesn’t support indexes larger than the standard.

Depending on the purpose of this child key and wallet we are creating, we may have a number we know well and is easy to memorise. Let’s say for example that we’re making this wallet for our daughter Alice. In this case, we could use an index that is based on Alice’s birthday - it’s a number we’re also unlikely to forget.

Note that SeedSigner only generates the child key words - it does not, for your safety, have a one tap function for loading the child words up as a working seed. You’ll need to write the generated child words down and then re-enter them into SeedSigner using the load seed function in order to start working with your new child wallet on the SeedSigner.

Alice will have no idea that her wallet was generated from our secret master key using BIP-85. As we intend to send funds to this wallet, it’s a good idea to backup this child key. My preference for this is to use SeedHammer as our ideal air gapped metal engraving tool:

Now let’s extend this concept further. Let’s say we have 3 children, Alice, Bob and Carol. We’d like to setup a series of singlesig wallets for each of them. Here’s how we could do it:

Now Alice, Bob and Carol each have their own wallet, nicely backed up onto seperate unique steel plates. None of them have any idea that each of their wallets are actually generated from our secret master key. In this case, if one of our children lost their key, it would be possible for us to recover their bitcoin simply by remembering the 12 words that make up the Master Key plus that child’s birthday.

In this example, we have a single parent key, generating multiple child keys on the same level - we’re expanding the number of wallets we can manage horizontally.

There’s another incredible property of BIP-85 though. We can take a child seed that was generated from our master key and generate another child seed of that seed - in other words, we can also create a “grandchild” seed, and even a “great grand child” seed of the “grandchild” seed. This enables us to expand the number of wallets we can generate vertically as well, like so:

As we progress along our bitcoin self custody journey, we gradually get more and more interested in eliminating single points of failure in our setups. Inevitably, this can lead us to exploring multisig wallets. Can BIP-85 be extended to helping us manage and later recreate multisig wallets as well?

Yes, and here’s an example:

In this example, we want to create a 2-of-3 multisig wallet. To do this, we need to generate 3 keys. We can use BIP-85 to derive the 3 keys we need using, for example, Key 1 being generated from the day of component of Alice’s birthday, Key 2, the month number and Key 3 the Year component.

Using the SeedHammer, we can backup each of these keys onto seperate metal plates and then distribute those plates to 3 geographically seperate secure storage locations.

This is already a very safe setup - there is no single point of failure. Loosing access to a single key storage location or having one of the keys lost, compromised or destroyed will not result in any loss of Alice’s funds.

In an unanticipated scenario where Alice lost not just 1, but 2 of her 3 keys, it would still be possible to recovery her wallet through our knowledge of both the memorised Master Key, her Birthday and remembering that this is how we configured and setup her wallet.

What if all of our wallets need this same level of protection, not just Alice’s? Well, this concept can extend out to encompass multiple multisig wallets as well, like this:

With distributed backups in place, we can safely move funds onto Alice, Bob or Carols multisig wallets. Even if we were to one day forget our master key, no funds are lost provided we can still access at least 2 of the 3 physical backups made for each wallet.

No one other than ourself knows of the master key’s existence - to Alice Bob or Carol, their wallets look like they have each been generated entirely randomly.

So if today you are used to using a Ledger, Trezor or ColdCard, you are probably already familiar with the idea of splitting your wallet up into sub accounts (technically known as BIP-44).

Here’s how a wallet with a single set of 12 or 24 words can be split up into accounts and even child and grand child accounts using this feature:

If Sub Accounts can be used to carve up our bitcoin into multiple stacks, why not just use that instead of BIP-85?

BIP-44 creates multiple accounts within a single wallet structure, while BIP-85 generates entirely separate wallet seeds, each capable of functioning as an independent wallet.

BIP-85 offers a higher level of separation and segregation between wallets, which adds to our security and allows us to split apart the backups to just the people or entities that the wallet is destined to.

What practical use is there for structuring our wallets using BIP-85 and having our Secret Master Key?

Let’s imagine for moment that we could very reliably memorise the 12 words that make up our Master Key.

By committing your secret master key to memory only, you are ensuring that you and only you can ever make use of your key. It also means that you’re able to recreate any of the child wallets you created from this master key, even when you are overseas.

With this super power, you could also cross an international border with nothing on you at all, simply knowledge in your head, and upon arrival, you could sit down at any internet connected computer, and control your bitcoin across dozens of singlesig and mutisig wallets within minutes.

Scared that you can’t memorise the 12 words? My fellow bitcoiner TATWD has you covered here on how to use a memory palace and some regular practice.

Worried that you could make your setup of wallets so complicated that you end up forgetting how you set it up? Maybe check out a service like SatsKeeper.com which can help you manage your own encrypted “treasure map” that you can securely access online but that can also be released to your loved ones under certain conditions you specify.

Is this a practical solution for you and your use case? For most people, especially those in the early part of their bitcoin self custody journey, the answer is probably not.

The fact that it is possible to leverage BIP-85 in this way does benefit every user of bitcoin though, even if you never intend to use any of these techniques.

Because there are so many ways to store and custody bitcoin, no one could ever know which technique(s) it is that you have used to store your bitcoin, and that alone is a huge security benefit for everyone.

Want to learn more about bitcoin self custody?

Please visit mineracks.com/training to book a 1-on-1 consultation on the ideal bitcoin custody setup for your needs.

Missing any tools for generating and backing up your self custody setup?

Please visit mineracks.com/shop for everything you need to get serious about bitcoin.

Subscribe to our SubStack for more articles like this: