<p>It would be trivially brute forceable.</p>
<p>There are 2048 BIP 39 words. If you change two words AND the position is known, it's simply a matter of computing all possible combinations of what those two words can be replaced with - 2048*2048. That's only 4194304 - A smartwatch could do that in a few minutes without breaking a sweat. It would take you longer to write a script to run through all of those than it would take for the script to run.</p>
<p>If the positions of the changed words aren't known, it is slightly harder, but not extensively so - the first words can be placed in any one of 12 slots, and the second in any one of 11 - that gives you 2048 * 2048 * 12 * 11, or 553648128 possible combinations - slightly better - the attacker might now have time to make some coffee while he steals your coins.</p>
<p>If you genuinely want to security your mnemonic, you should consider one or more of:</p>
<ol>
<li>Encrypt it with AES, store the encrypted version and the password in two separate places</li>
<li>Split it into M parts using Shamir Secret Key sharing, store each part in a different, secure location</li>
<li>Write it down and store it in a secure vault or deposit box.</li>
</ol>
<p>You can combine the above to protect against various threat models.</p>

CC BY-SA 4.0
2020-07-11T08:09:08.600Z
2020-07-11T08:09:08.600Z
Raghav Sood
<p>Theoretically yes BUT the answer varies by the type of attacker and your threat model. Let's say that writing this type of thing online, helps the attacker a lot to narrow the search field.
I personally believe that saving the seed (or part of it) on an email or cloud drive is one of the most wrong things to do.</p>
<p><strong>But let's talk about the technical aspect, which is the most interesting part (assuming that the attacker knows the words and the correct position of the &quot;real&quot; words):</strong></p>
<p>A BIP-39 mnemonic is generated using words from a fixed list of 2048 potential words. Each word is represented by an integer from 0 to 2047 corresponding to its position in the list. In binary you need 11 bits to represent a number up to 2047. Therefore to represent a 12-word mnemonic you would need 12*11 or 132 bits.</p>
<p>It turns out BIP-39 uses 128 bits of randomness and then uses SHA-256 to generate a 4-bit checksum that is appended to the end of the original 128-bits to get you the required 132 bits for 12 words.</p>
<p>This means if we wanted to iterate all possible 12-word mnemonics we need to count from 0 to 2¹²⁸-1, where each number can be interpreted as a single mnemonic.</p>
<p>Luckily, the attacker do not need to actually check all 2¹²⁸ possibilities because he already knows 10 seed words. Each seed word collected reduces the possibilities  by a factor of 2¹¹ or 2048.</p>
<p>With 10 words that means we know 10*11 or 110 bits of the 128 bits we are trying to figure out. It means there are only 2^(128–110) or 2^18 possible mnemonics we would have to check. This is 262144 possible mnemonics.</p>

CC BY-SA 4.0
2020-07-11T08:34:52.337Z
2020-07-11T08:34:52.337Z
Riccardo Masutti
<p>If I store 12 word seed in the email like gmail and my phone as well but change 3rd and 7th words in the seed for example with other bip-39 words and remember it, would that be safe? I can't think of a way for someone to be able to efficiently brute-force it.</p>

<security>
Is it safe to store mnemonic seed in the email if I change random 2 words?
good_evening
# Is it safe to store mnemonic seed in the email if I change random 2 words?

(Asked by: username_0 on 2020-07-11)

If I store 12 word seed in the email like gmail and my phone as well but change 3rd and 7th words in the seed for example with other bip-39 words and remember it, would that be safe? I can't think of a way for someone to be able to efficiently brute-force it.

**Tags:** security


---

## 2 answers

### Answer by username_1 on 2020-07-11. Score: 3

It would be trivially brute forceable.

There are 2048 BIP 39 words. If you change two words AND the position is known, it's simply a matter of computing all possible combinations of what those two words can be replaced with - 2048\*2048. That's only 4194304 - A smartwatch could do that in a few minutes without breaking a sweat. It would take you longer to write a script to run through all of those than it would take for the script to run.

If the positions of the changed words aren't known, it is slightly harder, but not extensively so - the first words can be placed in any one of 12 slots, and the second in any one of 11 - that gives you 2048 \* 2048 \* 12 \* 11, or 553648128 possible combinations - slightly better - the attacker might now have time to make some coffee while he steals your coins.

If you genuinely want to security your mnemonic, you should consider one or more of:

1. Encrypt it with AES, store the encrypted version and the password in two separate places
2. Split it into M parts using Shamir Secret Key sharing, store each part in a different, secure location
3. Write it down and store it in a secure vault or deposit box.

You can combine the above to protect against various threat models.


---

### Answer by username_2 on 2020-07-11. Score: 0

Theoretically yes BUT the answer varies by the type of attacker and your threat model. Let's say that writing this type of thing online, helps the attacker a lot to narrow the search field.
I personally believe that saving the seed (or part of it) on an email or cloud drive is one of the most wrong things to do.

**But let's talk about the technical aspect, which is the most interesting part (assuming that the attacker knows the words and the correct position of the "real" words):**

A BIP-39 mnemonic is generated using words from a fixed list of 2048 potential words. Each word is represented by an integer from 0 to 2047 corresponding to its position in the list. In binary you need 11 bits to represent a number up to 2047. Therefore to represent a 12-word mnemonic you would need 12\*11 or 132 bits.

It turns out BIP-39 uses 128 bits of randomness and then uses SHA-256 to generate a 4-bit checksum that is appended to the end of the original 128-bits to get you the required 132 bits for 12 words.

This means if we wanted to iterate all possible 12-word mnemonics we need to count from 0 to 2¹²⁸-1, where each number can be interpreted as a single mnemonic.

Luckily, the attacker do not need to actually check all 2¹²⁸ possibilities because he already knows 10 seed words. Each seed word collected reduces the possibilities by a factor of 2¹¹ or 2048.

With 10 words that means we know 10\*11 or 110 bits of the 128 bits we are trying to figure out. It means there are only 2^(128–110) or 2^18 possible mnemonics we would have to check. This is 262144 possible mnemonics.


---

