Electrum Seed Length I noticed that Electrum seeds are 13 words long if the wallet has been created by Electrum but if I used a random hex string to create the wallet it always was 24 words long.

So before I wrote this question, I wasn't quite sure that I remembered the number of words when using a random hex string correctly. I typed down some 32 hex digits and created the wallet. Note that for this I didn't use a source of randomness. Instead, I just thought of hex digits and typed them in. To my surprise, the seed only was 12 words long. I then sha256summed my desktop wallpaper to get a more random 32 digit hex number and was back to 24 words as a seed just like when I did a few experiments some days ago using xxd in combination with /dev/urandom.

So why the different lengths? Clearly, I'm a very poor source of entropy. So Electrum might have compressed the hex number I gave it down. But why are seeds of wallets generated by Electrum only 13 words long whereas wallets created using random 32 digit hex numbers are 24 words long? Shouldn't Electrum use a good source of entropy? Maybe even /dev/random instead of /dev/urandom xored with some stuff it finds itself and therefore create wallets with a 24 words seed?

I don't even see how 13 words are enough to encode a 32 digit hex number. You'd need to encode 256 bit / 13 = 19.69 bit in every word, so you'd need at least 2^19.69 words = 847'180 words. (If you get a different result, use the exact intermediate result.) The English language has 1'025'110 words which would be enough but that's counting words like "pneumonoultramicroscopicsilicovolcanoconiosis". Electrum only uses very basic English words of which there aren't nearly as many as 847'180.

How does Electrum even create several addresses from a single 32 digit hex number? The wallet import format this website generates if I enter the hash of my wallpaper doesn't match any of the private keys in the Electrum wallet. I'd expect the first private key to be the one generated from the 32 digit hex number I entered and all others to be generated using a deterministic key derivation algorithm.
The 13-word mnemonic is just a way to encode a 128bit number into something human-readable and memorable. The 13th word is a checksum, and 12 words would suffice to recover the number encoded. You should always generate it by truly random means to reduce likelihood of someone generating the same as you and running away with your coins.
Some more info can be found here.

The wordlist consists of 2048 words since circa Aug 2014.
If you want to know how many words you need to encode a 128bit number, you can calculate yourself.

Log_2048(2^128) = 11.63636364


The 128bit number is actually a 32 digit base16 ("hex") number (2^128 = 16^32).

I tried to replicate what you did, and used electrum wallet recovery function. When inputting a 32 digit hex number, I get a 12 words mnemonic. It would also accept a 64 digit base16 number, and then I'd get a 24 words mnemonic, which makes sense considering how it's generated. However, I'm having trouble replicating what you experienced, to get a 24 word mnemonic from a 32 digit base16 number.

Now, what is that 128number used for? It's used to generate your master private key, master public key and all the keypairs in your wallet. It's nicely detailed here.


  The total number of possible extended keypairs is almost 2^512, but the
  produced keys are only 256 bits long, and offer about half of that in
  terms of security. Therefore, master keys are not generated directly,
  but instead from a potentially short seed value.
  
  
  Generate a seed byte sequence S of a chosen length (between 128 and
  512 bits; 256 bits is advised) from a (P)RNG.
  Calculate I =
  HMAC-SHA512(Key = "Bitcoin seed", Data = S)
  Split I into two 32-byte
  sequences, I_L and I_R.
  Use parse_256(I_L) as master secret key, and I_R as
  master chain code.
  
  
  In case I_L is 0 or ≥n, the master key is invalid.