<p>They can be made a heck-of-a-lot safer with simple key-stretching.  The WarpWallet runs Scrypt on your passphrase, and outputs a string in the full 256-bit keyspace.  It's at least 1000x more expensive to guess a WarpWallet address than a standard brainwallet address.  And if you had access to high-end scrypt-computing hardware, you're probably better off using it to mine litecoins rather than go after WarpWallets.  See <a href="https://keybase.io/warp" rel="nofollow">https://keybase.io/warp</a>.  There's a 20BTC challenge to solve an 8-letter WarpWallet passphrase that's been open for almost a month.</p>

CC BY-SA 3.0
2014-02-17T10:11:18.907Z
As of today, it's still there.
Murch
CC BY-SA 3.0
2014-02-26T04:31:37.713Z
98 days and still safe so far (note that half the reward is held separately): https://blockchain.info/address/1AdU3EcimMFN7JLJtceSyrmFYE3gF5ZnGj
Will Bickford
CC BY-SA 3.0
2015-11-05T08:09:50.817Z
1000x safer doesn't sound like a lot. It's just a few more character or one more word.
Omar Abid
CC BY-SA 4.0
2019-02-24T04:10:46.520Z
It is worth noting that if the brain wallet generates BIP 39 seed words (see https://github.com/libbitcoin/libbitcoin-explorer/wiki/bx-mnemonic-new), the BIP 39 synthesis process natively uses PBKDF2 using 2048 rounds of HMAC-SHA512 which adds computational stretching that supports and additional passphrase. However, the base brainwallet phrase needs adequate entropy (~128 bits), and should not exist elsewhere on the Internet.
skaht
CC BY-SA 3.0
2013-12-12T13:24:35.163Z
2013-12-12T13:24:35.163Z
Max Krohn
<p>If anything, then the contest just proved that brainwallets is more secure than one would think. After a few hours the "<a href="https://en.wikipedia.org/wiki/Lorem_ipsum" rel="nofollow noreferrer">lorem ipsum dolor sit amet</a>" address was "cracked", after two weeks the rest wasn't cracked.</p>

<p>The author of the contest (linjaaho) gave A LOT of hints, but even though that, it took around two days for the rest of the addresses to be cracked (and seriously 4 * "fuck", 3 * "testing", 3 * "aurinko" (sun), 3 * "goatse" is very easy passwords especially for someone knowing the hints).</p>

<p>So in the end, I would say that the contest just showed that brainwallets is way more safe that I would have thought. However, if you use a weak password then of course it would be better to use random. Also note that the default behaviour of bitcoin-qt (send charge to a new address) has some privacy and security advantages: <a href="https://bitcoin.stackexchange.com/a/8192/2785">https://bitcoin.stackexchange.com/a/8192/2785</a></p>

CC BY-SA 3.0
2013-03-18T00:27:50.077Z
2013-03-18T00:27:50.077Z
2017-04-13T12:47:36.647Z
Nicolai
<blockquote>
  <p>There are no warnings given on the site about the safety of this. How secure are brain wallets?</p>
</blockquote>

<p>As secure as you make them, in my opinion. Let's say you use all 92 characters in your password, and it's 30 letters long. That gives you an entropy of 92^30, or 195 bits. It would take more energy than can possibly be produced on earth to brute force it.</p>

<p><a href="https://crypto.stackexchange.com/a/1160">https://crypto.stackexchange.com/a/1160</a></p>

<blockquote>
  <p>These numbers have nothing to do with the technology of the devices; they are the maximums that thermodynamics will allow. And they strongly imply that brute-force attacks against 256-bit keys will be infeasible until computers are built from something other than matter and occupy something other than space.</p>
</blockquote>

<p>Of course, there are probably side-channel attacks against it. However, I don't know enough about the implementation he's using to say.</p>

<blockquote>
  <p>With a well indexed database of the existing Bitcoin addresses that hold a positive balance</p>
</blockquote>

<p>You don't need one. You just need a bloom filter with every bitcoin address ever seen in the blockchain, which can actually fit in 50 MB or so.</p>

CC BY-SA 3.0
2013-03-18T05:36:36.600Z
What do you mean by 92 characters in the password, especially in relation to bits?  26 letters in the alphabet * 2 (uppercase/lowercase) * symbols doesn't equal this (AFAIK - unless you're speaking of chars that aren't typical ASCII)
makerofthings7
CC BY-SA 3.0
2013-03-18T06:33:27.787Z
@makerofthings7 You're forgetting numbers, and `><?:"{}|_+-=[]\;',./` Speaking of which, I forgot three more: `\`~` and space.
Nick ODell
CC BY-SA 3.0
2013-03-18T06:58:49.373Z
92 characters is nice and all but as hotly debated as the [XKCD password theory](http://xkcd.com/936/) is, I have to admit there is some truth in saying that a long password you can remember is much better than a short one you can't.
David Perry
CC BY-SA 3.0
2013-03-18T07:05:05.783Z
@DavidPerry My point is merely that you could create a very secure brainwallet. This doesn't mean that a password of 'asdfasdfasdfasdf' is secure.
Nick ODell
CC BY-SA 3.0
2015-07-06T03:57:02.673Z
what if you made a brain wallet with chinese characters? or ascii codes that aren't on the keyboard?
Patoshi パトシ
CC BY-SA 3.0
2013-03-18T00:37:08.623Z
2013-03-18T00:37:08.623Z
2017-04-13T12:48:25.933Z
Nick ODell
<p>Bit-for-bit, a human-generated password/passphrase will be lower entropy than a randomly generated one.  This means that you will need to come up with a pretty long string (minimum of 30 characters, preferably longer than 40) and truly use your brain to create one.  You need to minimize the use of full words, avoid sentences and common phrase structure, mix information (don't just use one piece of information to encode, use three or more), and generally make the string as random-looking as you can.  The trade-off is that the closer you make it appear to a random one, the less likely you will be able to commit it to memory.</p>

<p>Ideally, you want to construct your password/passphrase offline, just in case.</p>

<p>As an example of the kind of password you are looking to construct, consider this:</p>

<p>cyFtlt9nuLeet$dyKtyt0tuWtec#iaGiab9maEnaE(ejnnbsyscaaa</p>

<p>This was created with 3 pieces of information related to three formerly popular songs, by three different artists.  It is not random, and it is constructed from information I already have committed to memory.  If I forget this password, I can always reconstruct it from the same base info.</p>

<p>If you can create a long password in a similar vein (using information only you have intimate familiarity with), and your computer is not compromised in some way, then you can create a secure brainwallet.  If you can't, then I wouldn't recommend it.  Memorizing a 12 word BIP39 recovery seed might be more up your alley.</p>

CC BY-SA 4.0
2019-02-25T05:27:33.690Z
2019-02-25T05:27:33.690Z
John C.
<p>This question is marked as answered, but it was answered back in 2013.  The answer has changed since then.  Here's a reply from 2015.</p>

<p>Brainwallets are hideously insecure.  Don't use them.  EVER!</p>

<p>Don't take my word for it.  Here are some references:</p>

<p><a href="http://www.coindesk.com/new-cracking-tool-exposes-major-flaw-in-bitcoin-brainwallets/" rel="noreferrer">http://www.coindesk.com/new-cracking-tool-exposes-major-flaw-in-bitcoin-brainwallets/</a></p>

<p><a href="https://en.bitcoin.it/wiki/Brainwallet#Low_Entropy_from_Human-Generated_Passphrases" rel="noreferrer">https://en.bitcoin.it/wiki/Brainwallet#Low_Entropy_from_Human-Generated_Passphrases</a></p>

<p>If you want an easy-to-memorize phrase, use Electrum or BIP0039.  Don't use a brainwallet.</p>

CC BY-SA 3.0
2016-02-15T19:13:05.823Z
The flaw has been exploited: http://arstechnica.com/security/2016/02/password-cracking-attacks-on-bitcoin-wallets-net-103000/
Highly Irregular
CC BY-SA 3.0
2017-11-07T04:20:35.160Z
Yes its inseucre if your using the **old method** of generating brain wallets. Using the warp wallet generator for brain wallets has proven secure with an unclaimed 20BTC reward. See Max Krohn's answer below. https://keybase.io/warp
Patoshi パトシ
CC BY-SA 3.0
2015-12-29T06:48:16.607Z
2015-12-29T06:48:16.607Z
Jonathan
<p>Edit: The answer is that they are unsafe and <a href="http://arstechnica.com/security/2016/02/password-cracking-attacks-on-bitcoin-wallets-net-103000/" rel="noreferrer">have been attacked</a>. Please don't use them!</p>

<p>Brain wallets can be created with a (minimum 15 character) pass phrase at <a href="https://www.bitaddress.org" rel="noreferrer">https://www.bitaddress.org</a></p>

<p>There are no warnings given on the site about the safety of this. How secure are brain wallets?</p>

<p><a href="http://www.reddit.com/r/Bitcoin/comments/19rnge/security_test_hack_my_brain_wallets_with_simple/" rel="noreferrer">A recent contest</a> provided 5 bitcoin (receiving) addresses generated with a brain wallet pass phrase, with each address holding 1BTC as a prize.</p>

<p>The challenger did give some hints along the way, but within 7 hours, the first prize was taken, and after around 18 days, all of them were taken.</p>

<p>The author of the blog summarises that brain wallets are generally safe, but is this really the case?</p>

<p>With a well indexed database of the existing Bitcoin addresses that hold a positive balance and a well-tuned script for trying out likely pass phrases, surely there's some quite long phrases that would still be easy to guess?</p>

CC BY-SA 3.0
2013-11-22T01:01:11.267Z
just memorize your private key then delete all traces of it. it doesn't get any more secure than that does it?
mulllhausen
CC BY-SA 3.0
2014-04-12T20:14:33.800Z
This article was written recently: http://bitcoinblog.de/2014/03/28/brainwallets-a-cautionary-tale/
Highly Irregular
<security><brain-wallet>
How safe is a brain wallet?
Highly Irregular
# How safe is a brain wallet?

(Asked by: username_0 on 2013-03-17)

Edit: The answer is that they are unsafe and [have been attacked](http://arstechnica.com/security/2016/02/password-cracking-attacks-on-bitcoin-wallets-net-103000/). Please don't use them!

Brain wallets can be created with a (minimum 15 character) pass phrase at <https://www.bitaddress.org>

There are no warnings given on the site about the safety of this. How secure are brain wallets?

[A recent contest](http://www.reddit.com/r/Bitcoin/comments/19rnge/security_test_hack_my_brain_wallets_with_simple/) provided 5 bitcoin (receiving) addresses generated with a brain wallet pass phrase, with each address holding 1BTC as a prize.

The challenger did give some hints along the way, but within 7 hours, the first prize was taken, and after around 18 days, all of them were taken.

The author of the blog summarises that brain wallets are generally safe, but is this really the case?

With a well indexed database of the existing Bitcoin addresses that hold a positive balance and a well-tuned script for trying out likely pass phrases, surely there's some quite long phrases that would still be easy to guess?

**Tags:** security, brain-wallet

> **Comments:**
> **username_1**: just memorize your private key then delete all traces of it. it doesn't get any more secure than that does it?  
> **username_0**: This article was written recently: http://bitcoinblog.de/2014/03/28/brainwallets-a-cautionary-tale/  

---

## 5 answers

### Answer by username_13 on 2015-12-29. Score: 5 | Accepted answer

This question is marked as answered, but it was answered back in 2013. The answer has changed since then. Here's a reply from 2015.

Brainwallets are hideously insecure. Don't use them. EVER!

Don't take my word for it. Here are some references:

<http://www.coindesk.com/new-cracking-tool-exposes-major-flaw-in-bitcoin-brainwallets/>

<https://en.bitcoin.it/wiki/Brainwallet#Low_Entropy_from_Human-Generated_Passphrases>

If you want an easy-to-memorize phrase, use Electrum or BIP0039. Don't use a brainwallet.

> **Comments:**
> **username_0**: The flaw has been exploited: http://arstechnica.com/security/2016/02/password-cracking-attacks-on-bitcoin-wallets-net-103000/  
> **username_11**: Yes its inseucre if your using the **old method** of generating brain wallets. Using the warp wallet generator for brain wallets has proven secure with an unclaimed 20BTC reward. See username_2's answer below. https://keybase.io/warp  

---

### Answer by username_2 on 2013-12-12. Score: 4

They can be made a heck-of-a-lot safer with simple key-stretching. The WarpWallet runs Scrypt on your passphrase, and outputs a string in the full 256-bit keyspace. It's at least 1000x more expensive to guess a WarpWallet address than a standard brainwallet address. And if you had access to high-end scrypt-computing hardware, you're probably better off using it to mine litecoins rather than go after WarpWallets. See <https://keybase.io/warp>. There's a 20BTC challenge to solve an 8-letter WarpWallet passphrase that's been open for almost a month.

> **Comments:**
> **username_3**: As of today, it's still there.  
> **username_4**: 98 days and still safe so far (note that half the reward is held separately): https://blockchain.info/address/1AdU3EcimMFN7JLJtceSyrmFYE3gF5ZnGj  
> **username_5**: 1000x safer doesn't sound like a lot. It's just a few more character or one more word.  
> **username_6**: It is worth noting that if the brain wallet generates BIP 39 seed words (see https://github.com/libbitcoin/libbitcoin-explorer/wiki/bx-mnemonic-new), the BIP 39 synthesis process natively uses PBKDF2 using 2048 rounds of HMAC-SHA512 which adds computational stretching that supports and additional passphrase. However, the base brainwallet phrase needs adequate entropy (~128 bits), and should not exist elsewhere on the Internet.  

---

### Answer by username_7 on 2013-03-18. Score: 3

If anything, then the contest just proved that brainwallets is more secure than one would think. After a few hours the "[lorem ipsum dolor sit amet](https://en.wikipedia.org/wiki/Lorem_ipsum)" address was "cracked", after two weeks the rest wasn't cracked.

The author of the contest (linjaaho) gave A LOT of hints, but even though that, it took around two days for the rest of the addresses to be cracked (and seriously 4 \* "fuck", 3 \* "testing", 3 \* "aurinko" (sun), 3 \* "goatse" is very easy passwords especially for someone knowing the hints).

So in the end, I would say that the contest just showed that brainwallets is way more safe that I would have thought. However, if you use a weak password then of course it would be better to use random. Also note that the default behaviour of bitcoin-qt (send charge to a new address) has some privacy and security advantages: <https://bitcoin.stackexchange.com/a/8192/2785>


---

### Answer by username_8 on 2013-03-18. Score: 3

> There are no warnings given on the site about the safety of this. How secure are brain wallets?

As secure as you make them, in my opinion. Let's say you use all 92 characters in your password, and it's 30 letters long. That gives you an entropy of 92^30, or 195 bits. It would take more energy than can possibly be produced on earth to brute force it.

<https://crypto.stackexchange.com/a/1160>

> These numbers have nothing to do with the technology of the devices; they are the maximums that thermodynamics username_4 allow. And they strongly imply that brute-force attacks against 256-bit keys username_4 be infeasible until computers are built from something other than matter and occupy something other than space.

Of course, there are probably side-channel attacks against it. However, I don't know enough about the implementation he's using to say.

> With a well indexed database of the existing Bitcoin addresses that hold a positive balance

You don't need one. You just need a bloom filter with every bitcoin address ever seen in the blockchain, which can actually fit in 50 MB or so.

> **Comments:**
> **username_9**: What do you mean by 92 characters in the password, especially in relation to bits?  26 letters in the alphabet * 2 (uppercase/lowercase) * symbols doesn't equal this (AFAIK - unless you're speaking of chars that aren't typical ASCII)  
> **username_8**: @username_9 You're forgetting numbers, and `><?:"{}|_+-=[]\;',./` Speaking of which, I forgot three more: `\`~` and space.  
> **username_10**: 92 characters is nice and all but as hotly debated as the [XKCD password theory](http://xkcd.com/936/) is, I have to admit there is some truth in saying that a long password you can remember is much better than a short one you can't.  
> **username_8**: @username_10 My point is merely that you could create a very secure brainwallet. This doesn't mean that a password of 'asdfasdfasdfasdf' is secure.  
> **username_11**: what if you made a brain wallet with chinese characters? or ascii codes that aren't on the keyboard?  

---

### Answer by username_12 on 2019-02-25. Score: 1

Bit-for-bit, a human-generated password/passphrase username_4 be lower entropy than a randomly generated one. This means that you username_4 need to come up with a pretty long string (minimum of 30 characters, preferably longer than 40) and truly use your brain to create one. You need to minimize the use of full words, avoid sentences and common phrase structure, mix information (don't just use one piece of information to encode, use three or more), and generally make the string as random-looking as you can. The trade-off is that the closer you make it appear to a random one, the less likely you username_4 be able to commit it to memory.

Ideally, you want to construct your password/passphrase offline, just in case.

As an example of the kind of password you are looking to construct, consider this:

cyFtlt9nuLeet$dyKtyt0tuWtec#iaGiab9maEnaE(ejnnbsyscaaa

This was created with 3 pieces of information related to three formerly popular songs, by three different artists. It is not random, and it is constructed from information I already have committed to memory. If I forget this password, I can always reconstruct it from the same base info.

If you can create a long password in a similar vein (using information only you have intimate familiarity with), and your computer is not compromised in some way, then you can create a secure brainwallet. If you can't, then I wouldn't recommend it. Memorizing a 12 word BIP39 recovery seed might be more up your alley.


---

