user135339: Im referencing https://iancoleman.io/bip39/
I understand how the words are generated ("bip39 mnemonic" at the link).  But Im not quite clear on how the words give rise to "bip39 seed" two sections later.
Ive followed a variety of youtubers who demonstrate the calculation in python, but my computations are not coming out the same.  Im not sure why.  Clearly Im missing something about how certain strings/values are being constructed prior to the sha512.

user47827: To complement Vojtěch's answer James Chiang explained how the seed is derived from the mnemonic during his TeachBitcoin class in 2019:

When I generate the seed for my HD wallet I do not go back to the secret entropy. I don’t decode my mnemonic word phrase to obtain the entropy. Instead I join all my words into a sentence, I concatenate a string mnemonic, there is an optional passphrase that you can introduce. Then through the password-based key derivation function 2. What is that? That is basically many (2048) rounds of HMAC-SHA512. That takes as an argument the sentence and as a salt, the mnemonic and the passphrase concatenated. The many rounds are equivalent to a length extension. It makes it more expensive to brute force. Adding more rounds is the equivalent to adding key length if you will. Then we finally end up with a 512 bit seed. This is the seed that we use to derive the rest of our wallet.



user121614: From BIP39:

To create a binary seed from the mnemonic, we use the PBKDF2 function
with a mnemonic sentence (in UTF-8 NFKD) used as the password and the
string "mnemonic" + passphrase (again in UTF-8 NFKD) used as the salt.
The iteration count is set to 2048 and HMAC-SHA512 is used as the
pseudo-random function. The length of the derived key is 512 bits (=
64 bytes).
If a passphrase is not present, an empty string "" is used instead.

When I try to generate a random mnemonic on https://iancoleman.io/bip39/, the derived BIP39 seed is the same as when I manually calculate it with https://stuff.birkenstab.de/pbkdf2/ using the steps above.

user101040: These pictures are from Mastering bitcoin and were so insightful for me.
How the mnemonic words are generated:

How they are used to generates master seed of your wallet:


135339: <p>Im referencing <a href="https://iancoleman.io/bip39/" rel="nofollow noreferrer">https://iancoleman.io/bip39/</a></p>
<p>I understand how the words are generated (&quot;bip39 mnemonic&quot; at the link).  But Im not quite clear on how the words give rise to &quot;bip39 seed&quot; two sections later.</p>
<p>Ive followed a variety of youtubers who demonstrate the calculation in python, but my computations are not coming out the same.  Im not sure why.  Clearly Im missing something about how certain strings/values are being constructed prior to the sha512.</p>
 47827: <p>To complement Vojtěch's answer James Chiang explained how the seed is derived from the mnemonic during his TeachBitcoin <a href="https://github.com/teachbitcoin/code-demos" rel="nofollow noreferrer">class</a> in 2019:</p>
<blockquote>
<p>When I generate the seed for my HD wallet I do not go back to the secret entropy. I don’t decode my mnemonic word phrase to obtain the entropy. Instead I join all my words into a sentence, I concatenate a string mnemonic, there is an optional passphrase that you can introduce. Then through the password-based key derivation function 2. What is that? That is basically many (2048) rounds of HMAC-SHA512. That takes as an argument the sentence and as a salt, the mnemonic and the passphrase concatenated. The many rounds are equivalent to a length extension. It makes it more expensive to brute force. Adding more rounds is the equivalent to adding key length if you will. Then we finally end up with a 512 bit seed. This is the seed that we use to derive the rest of our wallet.</p>
</blockquote>
<p><a href="https://i.stack.imgur.com/bVTOw.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/bVTOw.png" alt="james chiang image" /></a></p>
 121614: <p>From <a href="https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki" rel="nofollow noreferrer">BIP39</a>:</p>
<blockquote>
<p>To create a binary seed from the mnemonic, we use the PBKDF2 function
with a mnemonic sentence (in UTF-8 NFKD) used as the password and the
string &quot;mnemonic&quot; + passphrase (again in UTF-8 NFKD) used as the salt.
The iteration count is set to 2048 and HMAC-SHA512 is used as the
pseudo-random function. The length of the derived key is 512 bits (=
64 bytes).</p>
<p>If a passphrase is not present, an empty string &quot;&quot; is used instead.</p>
</blockquote>
<p>When I try to generate a random mnemonic on <a href="https://iancoleman.io/bip39/" rel="nofollow noreferrer">https://iancoleman.io/bip39/</a>, the derived BIP39 seed is the same as when I manually calculate it with <a href="https://stuff.birkenstab.de/pbkdf2/" rel="nofollow noreferrer">https://stuff.birkenstab.de/pbkdf2/</a> using the steps above.</p>
 101040: <p>These pictures are from <a href="https://rads.stackoverflow.com/amzn/click/com/1491954388" rel="noreferrer" rel="nofollow noreferrer">Mastering bitcoin</a> and were so insightful for me.</p>
<p>How the mnemonic words are generated:
<a href="https://i.stack.imgur.com/pII4g.png" rel="noreferrer"><img src="https://i.stack.imgur.com/pII4g.png" alt="enter image description here" /></a>
How they are used to generates master seed of your wallet:
<a href="https://i.stack.imgur.com/oyZP4.png" rel="noreferrer"><img src="https://i.stack.imgur.com/oyZP4.png" alt="enter image description here" /></a></p>
