<p>When generating a BIP39 mnemonic seed phrase, the user will first want to generate an entropic value <code>ENT</code> (<a href="https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki" rel="nofollow noreferrer">as referenced in the BIP39 docs</a>), which will be used to generate the mnemonic. </p>

<p><em>Note that it is <strong>very</strong> important that <code>ENT</code> be of suitably high entropy, or else the resulting mnemonic phrase will be insecure against brute force attacks. Choosing your own words is similarly insecure - always start with a proper source of <code>ENT</code>, and then derive the words from it.</em> </p>

<p>Next, we take the SHA256 hash of <code>ENT</code>, and then concatenate the first <code>ENT/32</code> bits of the result to the end of <code>ENT</code>. This works as a checksum on the mnemonic. </p>

<p>Once this is done, we split the result into groups of 11 bits, and encode each 11-bit group into a word, using the <a href="https://github.com/bitcoin/bips/blob/master/bip-0039/bip-0039-wordlists.md" rel="nofollow noreferrer">BIP-39 word list</a>.</p>

<hr>

<p>With your example, a 3-word phrase would encode 32 bits of entropy:</p>

<p><code>32 bits + (32/32) bit checksum = 33 bits
 33 bits / (11 bits/word) = 3 words</code> </p>

<p>This amount of entropy is <em>extremely insecure</em> against brute force attacks, if you store funds at a wallet generated from this mnemonic seed, you should expect them to be stolen. It is generally recommended to use at least 128 bits of entropy (12 words), with 256 bits (24 words) being a common standard.</p>

CC BY-SA 4.0
2020-01-12T23:00:14.347Z
2020-01-12T23:00:14.347Z
chytrik
<p>Is there an entropy rule that prevents this particular combination? e.g. it's not random enough?</p>

<p>Or is this just a bug on this generator tool I'm using: <a href="https://iancoleman.io/bip39/#english" rel="nofollow noreferrer">https://iancoleman.io/bip39/#english</a></p>

CC BY-SA 4.0
2020-01-12T12:20:55.283Z
nevermind i figured it out. final word needs to be checksum.
Nicole Zhu
CC BY-SA 4.0
2020-01-12T23:06:33.917Z
To nitpick your comment: each word encodes 11 bits of entropy. In the context of your question (3 word phrase), the checksum would only contribute 1 bit, not the 'whole last word' (which encodes 11 bits in total).
chytrik
<mnemonic-seed>
Why is "cancel canal can" an invalid BI39 (3 word) mnemonic phrase?
Nicole Zhu
# Why is "cancel canal can" an invalid BI39 (3 word) mnemonic phrase?

(Asked by: username_0 on 2020-01-12)

Is there an entropy rule that prevents this particular combination? e.g. it's not random enough?

Or is this just a bug on this generator tool I'm using: <https://iancoleman.io/bip39/#english>

**Tags:** mnemonic-seed

> **Comments:**
> **username_0**: nevermind i figured it out. final word needs to be checksum.  
> **username_1**: To nitpick your comment: each word encodes 11 bits of entropy. In the context of your question (3 word phrase), the checksum would only contribute 1 bit, not the 'whole last word' (which encodes 11 bits in total).  

---

## 1 answers

### Answer by username_1 on 2020-01-12. Score: 1

When generating a BIP39 mnemonic seed phrase, the user will first want to generate an entropic value `ENT` ([as referenced in the BIP39 docs](https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki)), which will be used to generate the mnemonic.

*Note that it is **very** important that `ENT` be of suitably high entropy, or else the resulting mnemonic phrase will be insecure against brute force attacks. Choosing your own words is similarly insecure - always start with a proper source of `ENT`, and then derive the words from it.*

Next, we take the SHA256 hash of `ENT`, and then concatenate the first `ENT/32` bits of the result to the end of `ENT`. This works as a checksum on the mnemonic.

Once this is done, we split the result into groups of 11 bits, and encode each 11-bit group into a word, using the [BIP-39 word list](https://github.com/bitcoin/bips/blob/master/bip-0039/bip-0039-wordlists.md).

---

With your example, a 3-word phrase would encode 32 bits of entropy:

`32 bits + (32/32) bit checksum = 33 bits
33 bits / (11 bits/word) = 3 words`

This amount of entropy is *extremely insecure* against brute force attacks, if you store funds at a wallet generated from this mnemonic seed, you should expect them to be stolen. It is generally recommended to use at least 128 bits of entropy (12 words), with 256 bits (24 words) being a common standard.


---

