<p>(Some wallets that generate word lists for recovery also allow a user-created passphrase, so I'm using "recovery seed" to denote the word list.)</p>

<p>I'm not familiar with Mycelium specifically, but many wallets use a standard known as <a href="https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki" rel="nofollow noreferrer">BIP39</a> to generate recovery seeds. That technique draws the words randomly from a list of 2048 words, <a href="https://bitcoin.stackexchange.com/questions/59904/does-bip39-mnemonic-construction-avoid-repeating-words">with duplicates allowed</a>. The order (permutation) of the words is significant. So the number of possible recovery seeds is <a href="https://www.calculatorsoup.com/calculators/discretemathematics/permutationsreplacement.php" rel="nofollow noreferrer">2048^12</a> (^ indicates exponentiation). That is 5.44451787E+39, which is 5,444,517,870,735,015,415,413,993,718,908,291,383,296.</p>

CC BY-SA 3.0
2017-12-11T14:20:01.063Z
@NateEldredge Thanks! I've edited my answer to reflect allowing of repeated words.
brec
CC BY-SA 3.0
2017-12-11T01:10:11.513Z
2017-12-11T14:17:52.763Z
2017-12-11T14:17:52.763Z
brec
<p>The chances of someone "brute-forcing" or guessing your seed is extremely slim. There are more than <code>5 duodecillion</code> possible combinations of twelve-word seeds. Just so you get an idea of how big that number is, it's more than <code>1 thousand million million million million million million</code> possibilities.</p>

CC BY-SA 3.0
2017-12-11T03:49:55.093Z
I don't worry about hacking or guessing - I worry that my automatically generated passphrase will be also a somebody else passphrase *by accident*. It means that *in theory* I'll have access to somebody else wallet, and he/she will have access to my wallet, right?
HEKTO
CC BY-SA 3.0
2017-12-11T14:08:04.757Z
That's correct, however, the chances are the same even for the seed generation. If I were to brute-force seeds, I would run the generation function continuously until I find your seed.
Monstrum
CC BY-SA 3.0
2017-12-11T15:59:23.380Z
@HEKTO: Logically, if it's extremely difficult to make something happen on purpose, then the chances of having it happen by accident are even lower.
Nate Eldredge
CC BY-SA 3.0
2017-12-11T16:23:07.037Z
@NateEldredge - yes, I understand. I just worry about the system scale... When I create my own `ssh` private key in Linux I don't worry about its passphrase, because the number of users, which can communicate with me, is not that large. However the Bitcoin is a global system with billions of potential users and yes, some of them are hackers.
HEKTO
CC BY-SA 3.0
2017-12-11T16:56:26.180Z
Indeed.  But the number of possible keys is **overwhelmingly gigantic**.   This principle is at the root of pretty much everything in cryptography and you are going to have to come to terms with it in order to be comfortable with anything.  It is a nice exercise to do some calculations: e.g. if every person in the world had a million computers, each of which could try a billion keys per second, how long would it take to guess yours?
Nate Eldredge
CC BY-SA 3.0
2017-12-11T17:50:20.073Z
@NateEldredge - I worried (and still is) about the *limited* set of possible words in the Mycelium, so I think I'll use my own words, not wide-known, not from any popular song or book - then I'll be more comfortable. Thank you!
HEKTO
CC BY-SA 3.0
2017-12-11T18:33:09.390Z
@HEKTO: The limited set of words is compensated by the fact that there are 12 of them.  The number of possible keys grows exponentially with the number of words, and only polynomially with the length of the word list.  You have an effective key size of 132 bits, which is totally infeasible to brute force.  Sure you can get more entropy by choosing words from a larger set, but it doesn't really help much - diminishing returns.  And if you choose your own words you have to resist the temptation to just choose a phrase you like - they have to be chosen in a strongly random manner.
Nate Eldredge
CC BY-SA 3.0
2017-12-11T18:34:45.597Z
@HEKTO: I don't mean to be rude, but you really need to understand the math better - you're worrying about completely the wrong things, and I'm concerned that the solution that makes you more "comfortable" may actually be cryptographically weaker - perhaps dangerously so.
Nate Eldredge
CC BY-SA 3.0
2017-12-11T18:35:56.963Z
@NateEldredge - I've just read that the set of words is sorted before its usage. Is it still the case?
HEKTO
CC BY-SA 3.0
2017-12-11T18:39:40.383Z
@HEKTO: The words in the mnemonic phrase are not sorted; order matters here.  The wordlist is sorted, but all this means is that the numerical value associated to a word corresponds to its alphabetical order.  This association is arbitrary anyway (and doesn't need to be secret) so sorted is as good a method as any, and it's convenient to implement.
Nate Eldredge
CC BY-SA 3.0
2017-12-11T19:07:51.757Z
@HEKTO LBC, Large Bitcoin Collider, is an effort that tries to crack all private keys. The only vulnerabilities they found were in "brainwallets" where users input a password to generate a private key. Looking at their statistics gives you an idea of, despite the computing power being used, it is still extremely difficult/impossible to crack private keys even with twelve word seeds.
Monstrum
CC BY-SA 3.0
2017-12-11T19:47:01.043Z
My question was both theoretical and inquisitive... I thought: a 12-word passphrase to recover the wallet, and that's all? May be, I'm missing something, which makes the private key unique with 100% guarantee? Apparently, there is nothing like that, so we all depend on the enormity of the search space and mathematically proven randomness of keys in this space
HEKTO
CC BY-SA 3.0
2017-12-11T01:04:23.247Z
2017-12-11T01:04:23.247Z
Monstrum
<p>The Mycelium Wallet has created a Bitcoin wallet for me, then I've written down a 12-word passphrase for the wallet backup. However it looks like a set of words (in the Mycelium) to generate these phrases is limited - at least I've got a passphrase with one word repeated two times.</p>

<p>How can I make sure this passphrase is unique in our world where more than 7 billion people live?</p>

CC BY-SA 3.0
2017-12-11T07:04:56.167Z
The lingo may be different for different wallets but passphrase is usually a set of letters, numbers and symbols to create a password. A seed is your set of words usually 12 to 24 for differing wallets.
Josh
CC BY-SA 3.0
2017-12-11T09:31:35.653Z
Related: https://bitcoin.stackexchange.com/questions/7724/what-happens-if-your-bitcoin-client-generates-an-address-identical-to-another-pe
meshcollider
CC BY-SA 3.0
2017-12-11T16:32:22.500Z
[This does a great job](https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki) at explaining how the phrases are created, may help shed some light on your question.
DjangoBlockchain
<passphrase><mycelium-wallet><key-collision>
Wallet passphrase uniqueness (noob question)
HEKTO
# Wallet passphrase uniqueness (noob question)

(Asked by: username_0 on 2017-12-11)

The Mycelium Wallet has created a Bitcoin wallet for me, then I've written down a 12-word passphrase for the wallet backup. However it looks like a set of words (in the Mycelium) to generate these phrases is limited - at least I've got a passphrase with one word repeated two times.

How can I make sure this passphrase is unique in our world where more than 7 billion people live?

**Tags:** passphrase, mycelium-wallet, key-collision

> **Comments:**
> **username_1**: The lingo may be different for different wallets but passphrase is usually a set of letters, numbers and symbols to create a password. A seed is your set of words usually 12 to 24 for differing wallets.  
> **username_2**: Related: https://bitcoin.stackexchange.com/questions/7724/what-happens-if-your-bitcoin-client-generates-an-address-identical-to-another-pe  
> **username_3**: [This does a great job](https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki) at explaining how the phrases are created, may help shed some light on your question.  

---

## 2 answers

### Answer by username_5 on 2017-12-11. Score: 5 | Accepted answer

The chances of someone "brute-forcing" or guessing your seed is extremely slim. There are more than `5 duodecillion` possible combinations of twelve-word seeds. Just so you get an idea of how big that number is, it's more than `1 thousand million million million million million million` possibilities.

> **Comments:**
> **username_0**: I don't worry about hacking or guessing - I worry that my automatically generated passphrase will be also a somebody else passphrase *by accident*. It means that *in theory* I'll have access to somebody else wallet, and he/she will have access to my wallet, right?  
> **username_5**: That's correct, however, the chances are the same even for the seed generation. If I were to brute-force seeds, I would run the generation function continuously until I find your seed.  
> **username_6**: @username_0: Logically, if it's extremely difficult to make something happen on purpose, then the chances of having it happen by accident are even lower.  
> **username_0**: @username_6 - yes, I understand. I just worry about the system scale... When I create my own `ssh` private key in Linux I don't worry about its passphrase, because the number of users, which can communicate with me, is not that large. However the Bitcoin is a global system with billions of potential users and yes, some of them are hackers.  
> **username_6**: Indeed.  But the number of possible keys is **overwhelmingly gigantic**.   This principle is at the root of pretty much everything in cryptography and you are going to have to come to terms with it in order to be comfortable with anything.  It is a nice exercise to do some calculations: e.g. if every person in the world had a million computers, each of which could try a billion keys per second, how long would it take to guess yours?  
> **username_0**: @username_6 - I worried (and still is) about the *limited* set of possible words in the Mycelium, so I think I'll use my own words, not wide-known, not from any popular song or book - then I'll be more comfortable. Thank you!  
> **username_6**: @username_0: The limited set of words is compensated by the fact that there are 12 of them.  The number of possible keys grows exponentially with the number of words, and only polynomially with the length of the word list.  You have an effective key size of 132 bits, which is totally infeasible to brute force.  Sure you can get more entropy by choosing words from a larger set, but it doesn't really help much - diminishing returns.  And if you choose your own words you have to resist the temptation to just choose a phrase you like - they have to be chosen in a strongly random manner.  
> **username_6**: @username_0: I don't mean to be rude, but you really need to understand the math better - you're worrying about completely the wrong things, and I'm concerned that the solution that makes you more "comfortable" may actually be cryptographically weaker - perhaps dangerously so.  
> **username_0**: @username_6 - I've just read that the set of words is sorted before its usage. Is it still the case?  
> **username_6**: @username_0: The words in the mnemonic phrase are not sorted; order matters here.  The wordlist is sorted, but all this means is that the numerical value associated to a word corresponds to its alphabetical order.  This association is arbitrary anyway (and doesn't need to be secret) so sorted is as good a method as any, and it's convenient to implement.  
> **username_5**: @username_0 LBC, Large Bitcoin Collider, is an effort that tries to crack all private keys. The only vulnerabilities they found were in "brainwallets" where users input a password to generate a private key. Looking at their statistics gives you an idea of, despite the computing power being used, it is still extremely difficult/impossible to crack private keys even with twelve word seeds.  
> **username_0**: My question was both theoretical and inquisitive... I thought: a 12-word passphrase to recover the wallet, and that's all? May be, I'm missing something, which makes the private key unique with 100% guarantee? Apparently, there is nothing like that, so we all depend on the enormity of the search space and mathematically proven randomness of keys in this space  

---

### Answer by username_4 on 2017-12-11. Score: 2

(Some wallets that generate word lists for recovery also allow a user-created passphrase, so I'm using "recovery seed" to denote the word list.)

I'm not familiar with Mycelium specifically, but many wallets use a standard known as [BIP39](https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki) to generate recovery seeds. That technique draws the words randomly from a list of 2048 words, [with duplicates allowed](https://bitcoin.stackexchange.com/questions/59904/does-bip39-mnemonic-construction-avoid-repeating-words). The order (permutation) of the words is significant. So the number of possible recovery seeds is [2048^12](https://www.calculatorsoup.com/calculators/discretemathematics/permutationsreplacement.php) (^ indicates exponentiation). That is 5.44451787E+39, which is 5,444,517,870,735,015,415,413,993,718,908,291,383,296.

> **Comments:**
> **username_4**: @username_6 Thanks! I've edited my answer to reflect allowing of repeated words.  

---

