<p>The BIP32 standard, which is used almost universally for key/address derivation, permits up to <em>2<sup>31</sup></em> (roughly 2.1 billion) keys to be derived within a single chain.</p>
<p>Typically wallets only use one or two chains (one for addresses to give out externally, and one for keys used internally for change), or one or two per address type. Nothing prevents wallets from using more chains than that, but there is no real need as billions of addresses ought to be more than sufficient for any individual user (there have only been almost 880 million transaction in Bitcoin's history in total). Where multiple chains are used, it is for organizational purposes (e.g. keys used for distinct purposes).</p>
<p>Hypothetically, if you kept creating new chains (from the same seed even), and kept computing all addresses in each chain, you would eventually generate every valid key. You won't see anything loop; each generated key will look indistinguishable from random (to anyone not knowing the seed/chain it is derived from).</p>
<p>Due to this random nature, you need to generate some multiple of the number of valid keys before you have a reasonable chance of hitting them all. As an analogy, think of throwing balls at a number of bins, such that each ball lands in a random bin. If there are 10 bins, you will need significantly more than 10 throws before all bins are likely to have at least one ball in it (on average ~29.3), because some will randomly end up in already-hit bins.</p>
<p>After ~<em>2<sup>264</sup></em> addresses you are very likely to have all keys. For 160-bit addresses like P2PKH and P2WPKH, ~<em>2<sup>167</sup></em> should suffice. Note that these are extremely large numbers that are unattainable by current computing power, not even all computers in the world together could compute this many addresses in billions of years.</p>

CC BY-SA 4.0
2023-08-15T17:30:35.887Z
2023-08-15T18:02:12.723Z
2023-08-15T18:02:12.723Z
Pieter Wuille
<p>Since you can generate multiple addresses from a single seed, I'm wondering what would happen if you continued to generate addresses forever? Would you eventually derive every possible address? Or would you only be able to generate some subset of addresses? Would you get repeat addresses before all the possible addresses were used up?</p>
<p>I expect such a thing would be infeasible but I'm curious as to what would happen hypothetically.</p>

<address-generation>
Can any one seed potentially generate every single Bitcoin address?
dashingdove
# Can any one seed potentially generate every single Bitcoin address?

(Asked by: username_0 on 2023-08-15)

Since you can generate multiple addresses from a single seed, I'm wondering what would happen if you continued to generate addresses forever? Would you eventually derive every possible address? Or would you only be able to generate some subset of addresses? Would you get repeat addresses before all the possible addresses were used up?

I expect such a thing would be infeasible but I'm curious as to what would happen hypothetically.

**Tags:** address-generation


---

## 1 answers

### Answer by username_1 on 2023-08-15. Score: 4 | Accepted answer

The BIP32 standard, which is used almost universally for key/address derivation, permits up to *231* (roughly 2.1 billion) keys to be derived within a single chain.

Typically wallets only use one or two chains (one for addresses to give out externally, and one for keys used internally for change), or one or two per address type. Nothing prevents wallets from using more chains than that, but there is no real need as billions of addresses ought to be more than sufficient for any individual user (there have only been almost 880 million transaction in Bitcoin's history in total). Where multiple chains are used, it is for organizational purposes (e.g. keys used for distinct purposes).

Hypothetically, if you kept creating new chains (from the same seed even), and kept computing all addresses in each chain, you would eventually generate every valid key. You won't see anything loop; each generated key will look indistinguishable from random (to anyone not knowing the seed/chain it is derived from).

Due to this random nature, you need to generate some multiple of the number of valid keys before you have a reasonable chance of hitting them all. As an analogy, think of throwing balls at a number of bins, such that each ball lands in a random bin. If there are 10 bins, you will need significantly more than 10 throws before all bins are likely to have at least one ball in it (on average ~29.3), because some will randomly end up in already-hit bins.

After ~*2264* addresses you are very likely to have all keys. For 160-bit addresses like P2PKH and P2WPKH, ~*2167* should suffice. Note that these are extremely large numbers that are unattainable by current computing power, not even all computers in the world together could compute this many addresses in billions of years.


---

