<p>To answer your question: bitaddress.org uses the SHA-256 hash of the password you provided as the private key. Therefore, you can always derive that private key from your password. If you can write a few lines of code, you can test this yourself (I just did).</p>

<p>However, if you generated your passphrase using dice then you are unlikely to memorize it. Therefore, it's not really a brain wallet. The SHA-256 step is really unnecessary, you might as well use the numbers from the dice rolls as a private key (you'd have to convert it to binary, encode it as 32 bytes and then convert it into the wallet import format).</p>

<p>The only reason to do what you just did is if you don't trust the random number generator in your browser. Now that you have a private key, you might as well write that down and forget the input to the SHA-256 hash.</p>

CC BY-SA 3.0
2014-02-17T21:52:16.907Z
2014-02-17T22:26:37.227Z
2014-02-17T22:26:37.227Z
Diego Basch
<p>You can tell if the address is deterministic - you can create a "second" private key with the same password. If the algorithm is deterministic, you will get the same answer!</p>

<p>Beware, however, that if they change their algorithm, or if the website disappears, and you don't have your private key, your bitcoin are gone forever!</p>

<p>I would not take the risk.</p>

CC BY-SA 3.0
2014-02-17T22:12:51.840Z
Unless you already have a copy downloaded and safe for that purpose.
Murch
CC BY-SA 3.0
2014-02-18T00:38:47.890Z
I specifically put in "and you dont have your key".
AMADANON Inc.
CC BY-SA 3.0
2014-02-18T00:48:33.453Z
Sorry, I should have been clearer. I meant a copy of the bitaddress.org website.
Murch
CC BY-SA 3.0
2014-02-18T01:05:03.230Z
Ah I see what you mean :)
AMADANON Inc.
CC BY-SA 3.0
2014-02-18T15:54:25.830Z
Yes, there clearly is a risk as you would have to guard both your passphrase AND your downloaded version of bitaddress.org. I withdraw the suggestion. (My earlier thinking was that it would be easier, and just as effective, to write down the passphrase which you already had rather than relying on copying down the private key which appears on screen.)
Peter
CC BY-SA 3.0
2014-02-17T21:02:21.747Z
2014-02-17T21:02:21.747Z
AMADANON Inc.
<p>That may sound like a silly question, but if I have created my keys using a passphrase in “brain wallet” at bitaddress.org, why do I need to record the private key, if I can recreate it at any time by using my downloaded version of bitaddress.org?</p>

<p>To be sure that I can do that safely, I need to know whether the algorithm to generate a private key from a passphrase with a downloaded copy of bitaddress.org is deterministic.</p>

CC BY-SA 3.0
2014-02-17T10:07:13.073Z
possible duplicate of [How safe is a brain wallet?](http://bitcoin.stackexchange.com/questions/8449/how-safe-is-a-brain-wallet)
Murch
CC BY-SA 3.0
2014-02-17T10:40:47.650Z
NO DUPLICATE: The question above does not ask about the entropy of the brain wallet passphrase. The question asks whether it is safe only to retain the passphrase so that the private key can be re-created at a later date.
Peter
CC BY-SA 3.0
2014-02-17T10:49:25.783Z
Alright, I retracted my close vote. However, I am still not quite sure I understand your intent: Is your question *"Is the algorithm to generate a private key with bitaddress.org deterministic?"* i.e. does it always give the same result for the same input? Or is it *"Is there only one way to generate private keys from a passphrase?"*, i.e. can I use any tool to re-generate the private-key and don't have to retain a copy of Bitaddress.org?
Murch
CC BY-SA 3.0
2014-02-17T11:00:07.663Z
Let me explain. I use dice to create a 160 bit passphrase. I enter the 62 digits into my offline copy of bitaddress.org “brain wallet” and get my keys, which I copy onto a sheet of paper.

My question is this: why can’t I just keep my passphrase and not bother recording the keys, as I can always create these electronically with my passphrase and bitaddress.org when I want them?
Peter
CC BY-SA 3.0
2014-02-17T11:05:16.940Z
Thanks. Perhaps you should replace the last sentence of your question with something along the lines of `"Is the algorithm to generate a private key from a passphrase with bitaddress.org deterministic?"`, as it seems that is what you wanted to ask. I'd say that your approach is viable, if a) you make sure that a copy of bitaddress.org remains available to you, and b) the algorithm used by bitaddress.org is in fact deterministic, which I don't know for sure.
Murch
CC BY-SA 3.0
2014-02-17T11:12:09.880Z
I am not sure whether the algorithm used by bitaddress.org is deterministic or not, which is why I won't rely on merely noting down the passphrase. But if it were, it would make working with paper wallets much simpler, hence my (even if badly worded) question
Peter
CC BY-SA 3.0
2014-02-17T11:19:45.607Z
Well, you can always edit your question to improve it, and I think the phrasing I suggested would help convey your underlying intent. – Then we might find out for sure. ;) You might also add the tag "bitaddress.org" which is very appropriate in this case. – I mean of course I can edit it, but I'd rather "teach the man to fish than give him a fish." ;)
Murch
<private-key><paper-wallet><bitaddress.org>
Is it safe not to record private keys for paper wallets?
Peter
# Is it safe not to record private keys for paper wallets?

(Asked by: username_0 on 2014-02-17)

That may sound like a silly question, but if I have created my keys using a passphrase in “brain wallet” at bitaddress.org, why do I need to record the private key, if I can recreate it at any time by using my downloaded version of bitaddress.org?

To be sure that I can do that safely, I need to know whether the algorithm to generate a private key from a passphrase with a downloaded copy of bitaddress.org is deterministic.

**Tags:** private-key, paper-wallet, bitaddress.org

> **Comments:**
> **username_1**: possible duplicate of [How safe is a brain wallet?](http://bitcoin.stackexchange.com/questions/8449/how-safe-is-a-brain-wallet)  
> **username_0**: NO DUPLICATE: The question above does not ask about the entropy of the brain wallet passphrase. The question asks whether it is safe only to retain the passphrase so that the private key can be re-created at a later date.  
> **username_1**: Alright, I retracted my close vote. However, I am still not quite sure I understand your intent: Is your question *"Is the algorithm to generate a private key with bitaddress.org deterministic?"* i.e. does it always give the same result for the same input? Or is it *"Is there only one way to generate private keys from a passphrase?"*, i.e. can I use any tool to re-generate the private-key and don't have to retain a copy of Bitaddress.org?  
> **username_0**: Let me explain. I use dice to create a 160 bit passphrase. I enter the 62 digits into my offline copy of bitaddress.org “brain wallet” and get my keys, which I copy onto a sheet of paper.  My question is this: why can’t I just keep my passphrase and not bother recording the keys, as I can always create these electronically with my passphrase and bitaddress.org when I want them?  
> **username_1**: Thanks. Perhaps you should replace the last sentence of your question with something along the lines of `"Is the algorithm to generate a private key from a passphrase with bitaddress.org deterministic?"`, as it seems that is what you wanted to ask. I'd say that your approach is viable, if a) you make sure that a copy of bitaddress.org remains available to you, and b) the algorithm used by bitaddress.org is in fact deterministic, which I don't know for sure.  
> **username_0**: I am not sure whether the algorithm used by bitaddress.org is deterministic or not, which is why I won't rely on merely noting down the passphrase. But if it were, it would make working with paper wallets much simpler, hence my (even if badly worded) question  
> **username_1**: Well, you can always edit your question to improve it, and I think the phrasing I suggested would help convey your underlying intent. – Then we might find out for sure. ;) You might also add the tag "bitaddress.org" which is very appropriate in this case. – I mean of course I can edit it, but I'd rather "teach the man to fish than give him a fish." ;)  

---

## 2 answers

### Answer by username_2 on 2014-02-17. Score: 2

To answer your question: bitaddress.org uses the SHA-256 hash of the password you provided as the private key. Therefore, you can always derive that private key from your password. If you can write a few lines of code, you can test this yourself (I just did).

However, if you generated your passphrase using dice then you are unlikely to memorize it. Therefore, it's not really a brain wallet. The SHA-256 step is really unnecessary, you might as well use the numbers from the dice rolls as a private key (you'd have to convert it to binary, encode it as 32 bytes and then convert it into the wallet import format).

The only reason to do what you just did is if you don't trust the random number generator in your browser. Now that you have a private key, you might as well write that down and forget the input to the SHA-256 hash.


---

### Answer by username_3 on 2014-02-17. Score: 0

You can tell if the address is deterministic - you can create a "second" private key with the same password. If the algorithm is deterministic, you will get the same answer!

Beware, however, that if they change their algorithm, or if the website disappears, and you don't have your private key, your bitcoin are gone forever!

I would not take the risk.

> **Comments:**
> **username_1**: Unless you already have a copy downloaded and safe for that purpose.  
> **username_3**: I specifically put in "and you dont have your key".  
> **username_1**: Sorry, I should have been clearer. I meant a copy of the bitaddress.org website.  
> **username_3**: Ah I see what you mean :)  
> **username_0**: Yes, there clearly is a risk as you would have to guard both your passphrase AND your downloaded version of bitaddress.org. I withdraw the suggestion. (My earlier thinking was that it would be easier, and just as effective, to write down the passphrase which you already had rather than relying on copying down the private key which appears on screen.)  

---

