BIP-138 encrypts the part of a wallet backup that is not the seed
Victoria Shinder2 min readBIP-138, "Compact Encryption Scheme for Non-seed Wallet Data", was merged into the BIPs repository on 21 September 2026 as a Draft. It is authored by Pyth of Wizardsardine, runs to 1,931 added lines across 11 files, and is licensed BSD-2-Clause.
The scheme covers output script descriptors (BIP-380), wallet policies (BIP-388) and other wallet metadata. It builds on BIPs 32, 340, 380, 388 and 389, and ships test vectors — including a descriptor with a change descriptor and a BIP-389 multipath descriptor, each carrying a version, descriptor_sets, an archived flag, a birth_time and a derivation range.
One line in the abstract does most of the work:
"The payload must not contain any private key material."
The part worth noticing
The seed was never the whole backup, and this is the BIP that says so out loud. Twelve words restore the keys. They do not restore which addresses are yours — that lives in the descriptor: the script type, the derivation paths, the fingerprints, the multipath ranges, the birth time that tells a wallet how far back to scan. Lose that and the funds are not gone, but finding them is a research project.
Which is why the exclusion of key material is a design decision rather than a caveat. It gives the encrypted blob a different risk profile from a seed backup: compromise leaks your transaction graph, not your coins. That is a genuinely bad outcome and a survivable one, and separating the two lets people store descriptor backups in places they would never put a seed — a cloud drive, a co-signer, an inheritance package.
The birth time and range fields are the quiet practical win. Recovery from a descriptor with no birth time means scanning the chain from genesis; with one, a wallet knows where to start. That is the difference between a restore measured in minutes and one measured in hours.
📌 Status is Draft. There is no implementation commitment here and no deployment: a number has been assigned, a specification and test vectors exist, and the discussion continues on the bitcoin-dev list and Delving Bitcoin.