<p>It's not to do with length, but entropy. Humans are terrible at creating randomness, even what you think is hard to guess could in all probability be guessed with enough iteration. </p>

<p>Family names for example are easy to guess, there's a finite number of them and a vast portion of names are from a set of only a few hundred. </p>

<p>What's the chance of you remembering what names are, the spelling, punctuation and ordering? Fairly low I suspect, humans are also terrible at remembering explicit data like that.  </p>

<p>As soon as people start trying to be clever, the probably shifts from theft to irrecoverable loss. Just use the cryptographic keys the way they are supposed to be used, 256 bits of entropy created with a CSRNG. </p>

CC BY-SA 3.0
2015-12-03T20:29:49.023Z
you telling me you can't name all your aunts and uncles and cousins in the order they were born? Then you add in your own password salt at the end and possibility some other random elements only you would know. i think that's much more random than 5Kb8kLf9zgWQnogidDA76MzPL6TsZZY36hWXMssSzNydYXYB9KF
Patoshi パトシ
CC BY-SA 3.0
2015-12-03T21:34:00.683Z
I definitely could not remember even all of their names, do ones that have passed count? What about name changes due to marriage? Good luck remembering something so insanely complex. There's not more entropy in your scheme than the 256bit key you posted either, 2**256 is unimaginably huge, more atoms than make up the earth.
Claris
CC BY-SA 3.0
2015-12-03T01:35:02.623Z
2015-12-03T01:35:02.623Z
Claris
<p>200 characters sounds a bit excessive to me.  What are the chances of a typo while trying to enter your password, just to generate the private key?</p>

<p>My suggestion, if you wish to use a secure enough password, is first to make sure you are not largely using actual words or phrases.  Certainly, use information only you know, organized in a way only you could reconstruct readily and consistently.  I'd keep the length under 100 characters, so as to minimize the chances of persistent typos.</p>

<p>A random private key would still be mathematically more secure, but the chances of loss may be higher if you have difficulty securing and protecting it.  How many people have "lost" Bitcoin because they forgot the password to their wallet, or the wallet was uninstalled?  How many people have had their Bitcoin stolen because copies of the keys were stored in an unsecure fashion or location?</p>

<p>You really need to find your risk tolerance on both sides.  Do you want something less cryptographically secure but more easily recoverable (lower chance of loss, higher chance of theft), or more cryptographically secure and less easily recoverable (higher chance of loss, lower chance of theft)?</p>

<p>I personally lean toward making a brainwallet password which is secure enough to protect my Bitcoin for the length of my lifetime (or longer, if possible), rather than use a piece of wallet software where I might lose the private keys if my hard drive fails, or where copies of the private keys may be more readily stolen because I couldn't keep them secure enough.</p>

CC BY-SA 3.0
2017-06-22T21:35:11.643Z
2017-06-22T21:35:11.643Z
John C.
<p>Very interesting presentation on this topic, about cracking bitcoin brainwallets:</p>

<p><a href="https://www.youtube.com/watch?v=foil0hzl4Pg" rel="nofollow noreferrer">https://www.youtube.com/watch?v=foil0hzl4Pg</a></p>

CC BY-SA 3.0
2016-12-03T23:15:19.430Z
2016-12-03T23:15:19.430Z
urza.cc
<p>Brain wallets can be secure, if you can generate and remember about 80 bits of entropy and they are processed with an an appropriate key hardening algorithm like bcrypt or scrypt. A random English word has about 12 bits, so about seven words is the bear minimum, or about 13 completely random base64 characters.</p>

<p>Since most people will chose something like 'uberSecret#wallet87' that barely has 40 bits of entropy, most such seeds are easily guessed in a few minutes on an ordinary computer so brain wallets should be used only by people who understand what they are doing. A standard step in any password hack is getting the cyphertext of the password - in Bitcoin's case that is distributed through the blockchain to a global network of people with the hardware and skills to attack it. Also, there is no salting, so you really need at least 80 bits.</p>

CC BY-SA 3.0
2016-02-13T10:25:23.733Z
2016-02-13T10:25:23.733Z
Brainwallet
<p>Assuming that there are ~2000 possible names and in total 20 members of the family you could name like that, you'd have <code>2000^20 ~ 2^245</code> possible combinations, so it wouldn't be awful in comparison to a CSPRNG. And yes, if you happened upon a combination of characters no other human being considers plausible that would be secure. However, the chances of that given that we're tuned to producing sequences that others can relate to are not as good as you'd think.</p>

<p>The biggest flaw is that you'd be using public information. Given a birth registry, one could generate all possible passwords with the family name scheme quite quickly. There are only <code>n_population</code> combinations which is nothing for a password cracker. You run into a similar problem if you decide to use a poem, the SHA256 of the PNG of your favourite meme, a StackOverflow answer or anything else that seems obscure but is inherently in the public sphere. SHA256 of a baby photo only you have? Maybe. But then again, its probably just as much trouble to store the SHA256 itself, and a CSPRNG will give you that.</p>

<p>Also you can do this exactly once. If someone finds your scheme and lands on your combination then what? Adding a few characters and numbers to spice things up after that will create a key that isn't all that different from the perspective of a password cracker since then you'll effectively be using a password of maybe 8 characters once someone knows your original one. Sure, you could go wild here, but you step into territory where you might as well just use a CSPRNG since it'll be just as hard to remember. Its not impossible that this could happen with a CSPRNG but all you do then is spin it up and use the next combination it gives.</p>

<p>Its all about risk really. If you and your friends decide to put the Poker pot into a wallet secured by the SHA256 of an image of the party sitting around the table? Maybe that's enough if the wallet is only used for the night. But if you want to do anything longer term with a more significant amount of money, then I say go with the recommendations of people that have studied this problem purely from the security perspective.</p>

CC BY-SA 3.0
2016-02-13T07:06:31.523Z
2016-02-13T07:06:31.523Z
jeteon
<p>Someone else already mentioned entropy.  Humans are really bad at creating randomness.  But that's only one part of it.  The other part is time, and how it's on the attacker's side.</p>

<p>An attacker can generate a lot of brainwallets with a lot of different words and phrases.  Then they watch the blockchain to see if any of those addresses receive coins.  If they do, the attacker swoops in and steals the coins.  What does the attacker do while he's waiting?  Generate more brainwallets!  Every dictionary word.  Every l33tspeak variant of every dictionary word.  All short phrases.  All phrases in every book, ever.  <a href="https://www.reddit.com/r/Bitcoin/comments/1ptuf3/brain_wallet_disaster/" rel="noreferrer">Obscure foreign-language poems.</a>  Bitcoin addresses don't take up much storage space, so the attacker can keep them all and watch them.  He has all the time in the world.</p>

<p>Maybe you'll be lucky and find a passphrase that no one else has generated.  But it's risky.  On the other hand, you can easily generate a secure and memorable wallet with <a href="http://electrum.org/" rel="noreferrer">Electrum</a>, which translates a 128-bit random key into twelve words.  There are also other mnemonic systems you can use.  So why risk getting your coins stolen from your brainwallet when it's so easy to store them securely?</p>

CC BY-SA 3.0
2015-12-29T07:02:54.133Z
what is the difference of of those 12 words when you can use a brain wallet of 5 different addresses you lived in previously combined as one really long string which involves punctuation too. electrum's dictionary is limited to at most 1000 words or so? but full addresses are at least 100,000+ in the world or just in the USA. thoughts?
Patoshi パトシ
CC BY-SA 3.0
2016-01-09T22:57:09.520Z
One difference is that a brainwallet is one single address.  An Electrum seed is used to deterministically generate a wallet with an unlimited number of addresses.  For privacy's sake, it's best to never reuse an address.  So once you've used your brainwallet once, you risk compromising your privacy if you use it again.
Jonathan
CC BY-SA 3.0
2016-01-09T22:59:35.747Z
If you really want to use a brainwallet, and you think you have a really secure passphrase, go ahead.  Your idea of using past addresses would probably work.  But many, many people come up with passphrases that they *think* are secure but really aren't.  It's just safest to avoid brainwallets altogether.
Jonathan
CC BY-SA 3.0
2015-12-29T06:40:42.607Z
2015-12-29T06:40:42.607Z
Jonathan
<p>Everyone keeps saying brain wallets are insecure. Can someone explain to me WHY? </p>

<p>What if I had a brain wallet that is 200 characters long which is the concatenation of all of my family members names along with punctuation's and numbers? How about that?</p>

<p>And how long is a private key? I don't see how a brain wallet is insecure if you come up with something <strong>ONLY</strong> you can know. </p>

CC BY-SA 3.0
2015-12-04T07:32:05.280Z
possible duplicate of [How safe is a brain wallet?](http://bitcoin.stackexchange.com/q/8449/5406)
Murch
<security><brain-wallet>
Why are brain wallets not secure? People keep saying it, but explain to me why?
Patoshi パトシ
# Why are brain wallets not secure? People keep saying it, but explain to me why?

(Asked by: username_0 on 2015-12-02)

Everyone keeps saying brain wallets are insecure. Can someone explain to me WHY?

What if I had a brain wallet that is 200 characters long which is the concatenation of all of my family members names along with punctuation's and numbers? How about that?

And how long is a private key? I don't see how a brain wallet is insecure if you come up with something **ONLY** you can know.

**Tags:** security, brain-wallet

> **Comments:**
> **username_1**: possible duplicate of [How safe is a brain wallet?](http://bitcoin.stackexchange.com/q/8449/5406)  

---

## 6 answers

### Answer by username_7 on 2015-12-29. Score: 5 | Accepted answer

Someone else already mentioned entropy. Humans are really bad at creating randomness. But that's only one part of it. The other part is time, and how it's on the attacker's side.

An attacker can generate a lot of brainwallets with a lot of different words and phrases. Then they watch the blockchain to see if any of those addresses receive coins. If they do, the attacker swoops in and steals the coins. What does the attacker do while he's waiting? Generate more brainwallets! Every dictionary word. Every l33tspeak variant of every dictionary word. All short phrases. All phrases in every book, ever. [Obscure foreign-language poems.](https://www.reddit.com/r/Bitcoin/comments/1ptuf3/brain_wallet_disaster/) Bitcoin addresses don't take up much storage space, so the attacker can keep them all and watch them. He has all the time in the world.

Maybe you'll be lucky and find a passphrase that no one else has generated. But it's risky. On the other hand, you can easily generate a secure and memorable wallet with [Electrum](http://electrum.org/), which translates a 128-bit random key into twelve words. There are also other mnemonic systems you can use. So why risk getting your coins stolen from your username_5 when it's so easy to store them securely?

> **Comments:**
> **username_0**: what is the difference of of those 12 words when you can use a brain wallet of 5 different addresses you lived in previously combined as one really long string which involves punctuation too. electrum's dictionary is limited to at most 1000 words or so? but full addresses are at least 100,000+ in the world or just in the USA. thoughts?  
> **username_7**: One difference is that a username_5 is one single address.  An Electrum seed is used to deterministically generate a wallet with an unlimited number of addresses.  For privacy's sake, it's best to never reuse an address.  So once you've used your username_5 once, you risk compromising your privacy if you use it again.  
> **username_7**: If you really want to use a username_5, and you think you have a really secure passphrase, go ahead.  Your idea of using past addresses would probably work.  But many, many people come up with passphrases that they *think* are secure but really aren't.  It's just safest to avoid brainwallets altogether.  

---

### Answer by username_2 on 2015-12-03. Score: 5

It's not to do with length, but entropy. Humans are terrible at creating randomness, even what you think is hard to guess could in all probability be guessed with enough iteration.

Family names for example are easy to guess, there's a finite number of them and a vast portion of names are from a set of only a few hundred.

What's the chance of you remembering what names are, the spelling, punctuation and ordering? Fairly low I suspect, humans are also terrible at remembering explicit data like that.

As soon as people start trying to be clever, the probably shifts from theft to irrecoverable loss. Just use the cryptographic keys the way they are supposed to be used, 256 bits of entropy created with a CSRNG.

> **Comments:**
> **username_0**: you telling me you can't name all your aunts and uncles and cousins in the order they were born? Then you add in your own password salt at the end and possibility some other random elements only you would know. i think that's much more random than 5Kb8kLf9zgWQnogidDA76MzPL6TsZZY36hWXMssSzNydYXYB9KF  
> **username_2**: I definitely could not remember even all of their names, do ones that have passed count? What about name changes due to marriage? Good luck remembering something so insanely complex. There's not more entropy in your scheme than the 256bit key you posted either, 2**256 is unimaginably huge, more atoms than make up the earth.  

---

### Answer by username_3 on 2017-06-22. Score: 3

200 characters sounds a bit excessive to me. What are the chances of a typo while trying to enter your password, just to generate the private key?

My suggestion, if you wish to use a secure enough password, is first to make sure you are not largely using actual words or phrases. Certainly, use information only you know, organized in a way only you could reconstruct readily and consistently. I'd keep the length under 100 characters, so as to minimize the chances of persistent typos.

A random private key would still be mathematically more secure, but the chances of loss may be higher if you have difficulty securing and protecting it. How many people have "lost" Bitcoin because they forgot the password to their wallet, or the wallet was uninstalled? How many people have had their Bitcoin stolen because copies of the keys were stored in an unsecure fashion or location?

You really need to find your risk tolerance on both sides. Do you want something less cryptographically secure but more easily recoverable (lower chance of loss, higher chance of theft), or more cryptographically secure and less easily recoverable (higher chance of loss, lower chance of theft)?

I personally lean toward making a username_5 password which is secure enough to protect my Bitcoin for the length of my lifetime (or longer, if possible), rather than use a piece of wallet software where I might lose the private keys if my hard drive fails, or where copies of the private keys may be more readily stolen because I couldn't keep them secure enough.


---

### Answer by username_4 on 2016-12-03. Score: 2

Very interesting presentation on this topic, about cracking bitcoin brainwallets:

<https://www.youtube.com/watch?v=foil0hzl4Pg>


---

### Answer by username_5 on 2016-02-13. Score: 1

Brain wallets can be secure, if you can generate and remember about 80 bits of entropy and they are processed with an an appropriate key hardening algorithm like bcrypt or scrypt. A random English word has about 12 bits, so about seven words is the bear minimum, or about 13 completely random base64 characters.

Since most people will chose something like 'uberSecret#wallet87' that barely has 40 bits of entropy, most such seeds are easily guessed in a few minutes on an ordinary computer so brain wallets should be used only by people who understand what they are doing. A standard step in any password hack is getting the cyphertext of the password - in Bitcoin's case that is distributed through the blockchain to a global network of people with the hardware and skills to attack it. Also, there is no salting, so you really need at least 80 bits.


---

### Answer by username_6 on 2016-02-13. Score: 0

Assuming that there are ~2000 possible names and in total 20 members of the family you could name like that, you'd have `2000^20 ~ 2^245` possible combinations, so it wouldn't be awful in comparison to a CSPRNG. And yes, if you happened upon a combination of characters no other human being considers plausible that would be secure. However, the chances of that given that we're tuned to producing sequences that others can relate to are not as good as you'd think.

The biggest flaw is that you'd be using public information. Given a birth registry, one could generate all possible passwords with the family name scheme quite quickly. There are only `n_population` combinations which is nothing for a password cracker. You run into a similar problem if you decide to use a poem, the SHA256 of the PNG of your favourite meme, a StackOverflow answer or anything else that seems obscure but is inherently in the public sphere. SHA256 of a baby photo only you have? Maybe. But then again, its probably just as much trouble to store the SHA256 itself, and a CSPRNG will give you that.

Also you can do this exactly once. If someone finds your scheme and lands on your combination then what? Adding a few characters and numbers to spice things up after that will create a key that isn't all that different from the perspective of a password cracker since then you'll effectively be using a password of maybe 8 characters once someone knows your original one. Sure, you could go wild here, but you step into territory where you might as well just use a CSPRNG since it'll be just as hard to remember. Its not impossible that this could happen with a CSPRNG but all you do then is spin it up and use the next combination it gives.

Its all about risk really. If you and your friends decide to put the Poker pot into a wallet secured by the SHA256 of an image of the party sitting around the table? Maybe that's enough if the wallet is only used for the night. But if you want to do anything longer term with a more significant amount of money, then I say go with the recommendations of people that have studied this problem purely from the security perspective.


---

