<p>If you're using a 24-word BIP39 seed phrase, that encodes 256 bits of entropy. A passphrase also needs 256 bits of entropy to contribute the same level of security.</p>
<p>Estimating the entropy of a password is not straightforward, since it's not always obvious what the search space is, but if we limit ourselves to passwords generated in a well-defined way, some example password lengths can be given (rounded to nearest integer):</p>
<ul>
<li>77 random digits from 0 to 9</li>
<li>54 random lowercase English characters</li>
<li>45 random lowercase and uppercase English characters</li>
<li>19 random words from a 10,000 long wordlist</li>
</ul>
<p>If that sounds like a lot, it's because 256-bit security is very likely an overkill (see <a href="https://security.stackexchange.com/questions/6141/amount-of-simple-operations-that-is-safely-out-of-reach-for-all-humanity/6149#6149">this answer</a> on Information Security StackExchange). You might want to use a 12-word seed phrase, in which case you can cut the numbers above in half.</p>

CC BY-SA 4.0
2021-10-21T04:56:17.463Z
Pefect, thank you. Was exactly the answer I was looking for
Trevor
CC BY-SA 4.0
2021-10-21T03:09:40.307Z
2022-09-25T13:01:37.010Z
2022-09-25T13:01:37.010Z
Vojtěch Strnad
<p>I'm curious on how long this 25th word / passphrase should be to provide roughly the same level of security as the seed phrase.</p>
<p>Since the seedphrase is BIP 39 there's a set amount of words you can pick from whereas with a passphrase it's a bit different.</p>
<p>Basically, let's assume somebody got ahold of a seed phrase but not the passphrase. What would be a good password length to ensure they couldn't brute force it within reasonable amount of time</p>

<passphrase>
25th word / pasphrase security length
Trevor
# 25th word / pasphrase security length

(Asked by: username_0 on 2021-10-21)

I'm curious on how long this 25th word / passphrase should be to provide roughly the same level of security as the seed phrase.

Since the seedphrase is BIP 39 there's a set amount of words you can pick from whereas with a passphrase it's a bit different.

Basically, let's assume somebody got ahold of a seed phrase but not the passphrase. What would be a good password length to ensure they couldn't brute force it within reasonable amount of time

**Tags:** passphrase


---

## 1 answers

### Answer by username_1 on 2021-10-21. Score: 3 | Accepted answer

If you're using a 24-word BIP39 seed phrase, that encodes 256 bits of entropy. A passphrase also needs 256 bits of entropy to contribute the same level of security.

Estimating the entropy of a password is not straightforward, since it's not always obvious what the search space is, but if we limit ourselves to passwords generated in a well-defined way, some example password lengths can be given (rounded to nearest integer):

* 77 random digits from 0 to 9
* 54 random lowercase English characters
* 45 random lowercase and uppercase English characters
* 19 random words from a 10,000 long wordlist

If that sounds like a lot, it's because 256-bit security is very likely an overkill (see [this answer](https://security.stackexchange.com/questions/6141/amount-of-simple-operations-that-is-safely-out-of-reach-for-all-humanity/6149#6149) on Information Security StackExchange). You might want to use a 12-word seed phrase, in which case you can cut the numbers above in half.

> **Comments:**
> **username_0**: Pefect, thank you. Was exactly the answer I was looking for  

---

