<p>128 bits is generally considered more than enough -- 132 bits is certainly sufficient.</p>

CC BY-SA 3.0
2015-07-12T10:32:25.257Z
2015-07-12T10:32:25.257Z
David Schwartz
<blockquote>
  <p>Is this considered safe enough?</p>
</blockquote>

<p>Nothing is "safe enough" if we do not know the cost. </p>

<p>OK, if you have $100k in bitcoins the 12-words phrase is safe enough.</p>

<p>If the 12-words phrase is the seed to the "Method of destroying the Universe" I would recommend to add at least 11 bits of entropy and use 13 words.</p>

CC BY-SA 3.0
2015-07-10T12:00:34.693Z
So let's say I have $100k. Can you explain why this is considered safe?
shx2
CC BY-SA 3.0
2015-07-10T14:43:39.093Z
Because the attacker have to spend much more funds to bruteforce your key. Nobody will attack you.
amaclin
CC BY-SA 3.0
2015-07-10T17:05:48.817Z
To put exhaustive searches into perspective, the Bitcoin network to date has done approximately 83 bits of work. This is with hundreds millions of dollars worth of investment, likely millions of ASIC chips produced, and currently over 150 megawatt of power expenditure.
Claris
CC BY-SA 3.0
2016-08-09T02:40:04.617Z
@Bitcoin your comment is the answer I was looking for. Thanks.
shx2
CC BY-SA 4.0
2021-03-10T20:33:04.427Z
+1 damnit, i already posted the method for destroying the universe to the Bitcoin chain at 128 bit.   we'll see.
Erik Aronesty
CC BY-SA 3.0
2015-07-10T10:27:46.680Z
2015-07-10T10:27:46.680Z
amaclin
<p><strong>In short: 12-word seed has enough entropy to be safe against brute force attack.</strong></p>
<p>First of all not all 132 bits are random. Seed uses some kind of control sum.</p>
<p>Lets talk about 128 bits of entropy.</p>
<p><strong>Lets imagine the following attack:</strong></p>
<p>We will take one billion (10^9) of the most powerful mining hardware in 2017 (ASIC with 13 TH/s each).
We will make a 1000 years brute force attack to compromise any of existing billion (10^9) of wallets with coins inside.</p>
<p>This attack will check the following number of seed combinations:</p>
<p>10^9 * (13 * 10^12) * (1000 * 365 * 24 * 3600) = ~ 10^33 combinations checked</p>
<p>128 bits of entropy equals ~ 10^38 total combinations</p>
<p>It means the attack will totally check 1/10^(38-33) = <strong>0.001%</strong> of all existing 128-bit seeds.</p>
<p>And approximately 10K of wallets would be compromised out of 10E9 existing wallets.</p>
<p>P.S. Don't forget it is an extra complicated task to find out if this or that seed contains any money. Hash mining hardware has much more simple task. We don't have hardware to check seeds at the same rate as modern ASICs checking their hash function results. And it seems impossible to build hardware with same efficiency as ASICs because each seed phrase check will need to access a huge database with all exising wallet addresses. We cannot put too many copies of this database on chip. And we cannot implement too many parallel accesses to a single memory cell.</p>
<p>P.P.S. If you are paranoid - you can use 18 or 24 work seed phrase.</p>

CC BY-SA 4.0
2021-03-10T20:34:50.567Z
well, the attack would actually have to attack private/public keys, which is at least 1000x slower than hashing.   but close.
Erik Aronesty
CC BY-SA 4.0
2023-05-04T15:23:09.157Z
Well worded answer.  I think you are missing an additional point which would produce even more entropy, please correct me if I am wrong.  Even with a seed phrase, you still need the derivation path to determine wallet addresses AND there can be different schemas, 4294967296 accounts, and 4294967296 addresses in each account.
Scott
CC BY-SA 4.0
2023-05-04T15:24:37.403Z
Said another way... even if you got "lucky" matching with someone else's seed phrase, you still wouldn't know if that seed phrase could lead to a wallet address with coins on it.
Scott
CC BY-SA 4.0
2023-05-06T06:23:50.770Z
You are generally right. But most of the software support only one single derivation path. And people rarely change it if it is possible.
Sergey
CC BY-SA 4.0
2023-05-06T06:29:45.330Z
Afaik 4.29E9 different account inside of the schema does protect you from finding your actual wallets when someone got your seed phrase and derivation path, but they allow you to use multi-address wallet for very long period without reusing addresses to increase anonymity.
Sergey
CC BY-SA 4.0
2023-05-06T06:33:20.580Z
P.S. The standard allows using additional text password as addition to a seed to increase randomness and security. However most of the software and users don't use it.
Sergey
CC BY-SA 4.0
2017-12-03T18:13:12.283Z
2023-09-03T15:00:45.787Z
2023-09-03T15:00:45.787Z
Sergey
<p>The security in bits of a 12-word mnemonic that has a valid checksum as per BIP39 is not 132 bits, but rather 128 bits, as the last 4 bits are determined based on the first 128 bits - the initial &quot;entropy&quot;.</p>
<ul>
<li>Even though the range of 2^132 of all possible mnemonics is 16 times
larger than 2^128 (where <code>(2^128)*16 = 2^132)</code>, the checksum cannot
be predicted unless an attacker can break SHA256, as the checksum is
computed based on the hash digest of the leading 128 bits formatted
as a byte array.</li>
</ul>
<p>So the idea with the checksum was to slow an attacker from searching through all possible 12-word mnemonics of which there are 2^132 of them, even though the number of valid ones is 2^128 in terms of a valid checksum (as if reducing the strength from 12 words to  11.6363636364 words, since the checksum completes part of the last word), as an attacker would have to run the SHA256 algorithm each time which will slow their brute-force search.</p>
<ul>
<li>Therefore, while 2048^12 = 2^132, the checksum means that the range
of checksum-valid mnemonics is 2048^11.6363636364 == 2^128.</li>
</ul>
<p>In summary, I think a mnemonic with a valid checksum would be more safe than one without a checksum, on the basis that it's probably less likely for SHA256 to be cracked anytime soon which would otherwise speed a potential brute-force search of all mnemonics.</p>
<ul>
<li>This means an attacker still needs to search in the range of 2^132
in order to find one of the 2^128 valid ones (i.e. there is no way
to only search the range of valid ones, unless SHA256 is broken).</li>
</ul>
<p><strong>Note:</strong> If you wanted to square your security (i.e. raise it to the power of 2), a 24-word mnemonic which represents 264 bits (minus an 8-bit checksum) would be the square of two 12-word mnemonics in terms of bit security as 2^128*2^128 == 2^256.</p>
<p>Such a huge leap in security could help protect a user later from Grover's algorithm running on a fast-enough quantum computer which could perform such an n-time brute-force search in the &quot;square of n-time&quot;, compared classical computers requiring n-time.</p>
<p>From: <a href="https://en.wikipedia.org/wiki/Grover%27s_algorithm" rel="nofollow noreferrer">https://en.wikipedia.org/wiki/Grover%27s_algorithm</a>:</p>
<blockquote>
<p><a href="https://en.wikipedia.org/wiki/Grover%27s_algorithm" rel="nofollow noreferrer">Grover's algorithm</a> could brute-force a 128-bit symmetric cryptographic key in roughly 2^64 iterations or a 256-bit key in roughly 2^128 iterations.`</p>
</blockquote>
<p>In other words, a 12-word mnemonic would have its security reduced to 64 bits (considered unsafe) in terms of classical computer security, while a 24-word mnemonic would only reduce to 128 bits in the same scenario.</p>

CC BY-SA 4.0
2019-07-31T22:02:46.607Z
2022-06-17T13:38:57.047Z
2022-06-17T13:38:57.047Z
Steven Hatzakis
<p>Is 12-word seed phrase (as used by Electrum for example) safe enough for generating an offline wallet?</p>

<p>My understanding is this: 2048 words pool make 11 bits of entrophy per word. 12 words in seed make total 132 bits of entrophy.</p>

<p>Is this considered safe enough?</p>

<p>I'm not talking about being quantum-computing-resistent, just being infeasible to crack using brute force given the expected computing power in the foreseeable future.</p>

<wallet><electrum><passphrase><safety><seed>
Is 12-word seed phrase safe enough?
shx2
# Is 12-word seed phrase safe enough?

(Asked by: username_0 on 2015-07-10)

Is 12-word seed phrase (as used by Electrum for example) safe enough for generating an offline wallet?

My understanding is this: 2048 words pool make 11 bits of entrophy per word. 12 words in seed make total 132 bits of entrophy.

Is this considered safe enough?

I'm not talking about being quantum-computing-resistent, just being infeasible to crack using brute force given the expected computing power in the foreseeable future.

**Tags:** wallet, electrum, passphrase, safety, seed


---

## 4 answers

### Answer by username_1 on 2015-07-12. Score: 0 | Accepted answer

128 bits is generally considered more than enough -- 132 bits is certainly sufficient.


---

### Answer by username_2 on 2015-07-10. Score: 13

> Is this considered safe enough?

Nothing is "safe enough" if we do not know the cost.

OK, if you have $100k in bitcoins the 12-words phrase is safe enough.

If the 12-words phrase is the seed to the "Method of destroying the Universe" I would recommend to add at least 11 bits of entropy and use 13 words.

> **Comments:**
> **username_0**: So let's say I have $100k. Can you explain why this is considered safe?  
> **username_2**: Because the attacker have to spend much more funds to bruteforce your key. Nobody will attack you.  
> **username_3**: To put exhaustive searches into perspective, the Bitcoin network to date has done approximately 83 bits of work. This is with hundreds millions of dollars worth of investment, likely millions of ASIC chips produced, and currently over 150 megawatt of power expenditure.  
> **username_0**: @Bitcoin your comment is the answer I was looking for. Thanks.  
> **username_4**: +1 damnit, i already posted the method for destroying the universe to the Bitcoin chain at 128 bit.   we'll see.  

---

### Answer by username_5 on 2017-12-03. Score: 8

**In short: 12-word seed has enough entropy to be safe against brute force attack.**

First of all not all 132 bits are random. Seed uses some kind of control sum.

Lets talk about 128 bits of entropy.

**Lets imagine the following attack:**

We will take one billion (10^9) of the most powerful mining hardware in 2017 (ASIC with 13 TH/s each).
We will make a 1000 years brute force attack to compromise any of existing billion (10^9) of wallets with coins inside.

This attack will check the following number of seed combinations:

10^9 \* (13 \* 10^12) \* (1000 \* 365 \* 24 \* 3600) = ~ 10^33 combinations checked

128 bits of entropy equals ~ 10^38 total combinations

It means the attack will totally check 1/10^(38-33) = **0.001%** of all existing 128-bit seeds.

And approximately 10K of wallets would be compromised out of 10E9 existing wallets.

P.S. Don't forget it is an extra complicated task to find out if this or that seed contains any money. Hash mining hardware has much more simple task. We don't have hardware to check seeds at the same rate as modern ASICs checking their hash function results. And it seems impossible to build hardware with same efficiency as ASICs because each seed phrase check will need to access a huge database with all exising wallet addresses. We cannot put too many copies of this database on chip. And we cannot implement too many parallel accesses to a single memory cell.

P.P.S. If you are paranoid - you can use 18 or 24 work seed phrase.

> **Comments:**
> **username_4**: well, the attack would actually have to attack private/public keys, which is at least 1000x slower than hashing.   but close.  
> **username_6**: Well worded answer.  I think you are missing an additional point which would produce even more entropy, please correct me if I am wrong.  Even with a seed phrase, you still need the derivation path to determine wallet addresses AND there can be different schemas, 4294967296 accounts, and 4294967296 addresses in each account.  
> **username_6**: Said another way... even if you got "lucky" matching with someone else's seed phrase, you still wouldn't know if that seed phrase could lead to a wallet address with coins on it.  
> **username_5**: You are generally right. But most of the software support only one single derivation path. And people rarely change it if it is possible.  
> **username_5**: Afaik 4.29E9 different account inside of the schema does protect you from finding your actual wallets when someone got your seed phrase and derivation path, but they allow you to use multi-address wallet for very long period without reusing addresses to increase anonymity.  
> **username_5**: P.S. The standard allows using additional text password as addition to a seed to increase randomness and security. However most of the software and users don't use it.  

---

### Answer by username_7 on 2019-07-31. Score: 2

The security in bits of a 12-word mnemonic that has a valid checksum as per BIP39 is not 132 bits, but rather 128 bits, as the last 4 bits are determined based on the first 128 bits - the initial "entropy".

* Even though the range of 2^132 of all possible mnemonics is 16 times
  larger than 2^128 (where `(2^128)*16 = 2^132)`, the checksum cannot
  be predicted unless an attacker can break SHA256, as the checksum is
  computed based on the hash digest of the leading 128 bits formatted
  as a byte array.

So the idea with the checksum was to slow an attacker from searching through all possible 12-word mnemonics of which there are 2^132 of them, even though the number of valid ones is 2^128 in terms of a valid checksum (as if reducing the strength from 12 words to 11.6363636364 words, since the checksum completes part of the last word), as an attacker would have to run the SHA256 algorithm each time which will slow their brute-force search.

* Therefore, while 2048^12 = 2^132, the checksum means that the range
  of checksum-valid mnemonics is 2048^11.6363636364 == 2^128.

In summary, I think a mnemonic with a valid checksum would be more safe than one without a checksum, on the basis that it's probably less likely for SHA256 to be cracked anytime soon which would otherwise speed a potential brute-force search of all mnemonics.

* This means an attacker still needs to search in the range of 2^132
  in order to find one of the 2^128 valid ones (i.e. there is no way
  to only search the range of valid ones, unless SHA256 is broken).

**Note:** If you wanted to square your security (i.e. raise it to the power of 2), a 24-word mnemonic which represents 264 bits (minus an 8-bit checksum) would be the square of two 12-word mnemonics in terms of bit security as 2^128\*2^128 == 2^256.

Such a huge leap in security could help protect a user later from Grover's algorithm running on a fast-enough quantum computer which could perform such an n-time brute-force search in the "square of n-time", compared classical computers requiring n-time.

From: <https://en.wikipedia.org/wiki/Grover%27s_algorithm>:

> [Grover's algorithm](https://en.wikipedia.org/wiki/Grover%27s_algorithm) could brute-force a 128-bit symmetric cryptographic key in roughly 2^64 iterations or a 256-bit key in roughly 2^128 iterations.`

In other words, a 12-word mnemonic would have its security reduced to 64 bits (considered unsafe) in terms of classical computer security, while a 24-word mnemonic would only reduce to 128 bits in the same scenario.


---

