<p>Regardless of whether you have a passphrase or not 12 words is just as secure as 24 words because the resulting public key will still require 2^128 iterations to compute its private key using the most efficient algorithm.
That is relevant because the most efficient algorithm to crack secp256k1 keys &quot;Pollard's rho algorithm&quot; does not try to guess your password or seed words but instead tries to reverse a public key to its private key.</p>
<p><code>It should probably be noted that properly generated Bitcoin keys cant be cracked efficiently with modern hardware even with Pollards rho, improperly generated or purposefully weaker keys may be cracked</code></p>
<p>So no it is not recommended to use 24 words it is completely optional, it may theoretically help against attacks in which someone guesses / brute-forces your seed phrase (assuming your seed phrase was generated in a securely random fashion) but brute-force is still highly inefficient compared to Pollard's rho algorithm. This is more or less  covered here:</p>
<p><a href="https://bitcoin.stackexchange.com/questions/117348/12-or-24-words-for-menomonic/117366#117366">12 or 24 words for mnemonic?</a>.</p>
<blockquote>
<p>In fact, cryptographically speaking, there is no benefit to private keys having more than 128 bits of entropy, as long as there is no pattern in them (e.g. don't use just 128 bit numbers as private keys, that's broken, but using the hash of 128 bit numbers appears to be just fine). The reason for suggesting more is just defense in depth. –
Pieter Wuille
Feb 25 at 6:00</p>
</blockquote>
<blockquote>
<p>24 words = 256 bits, 12 words = 128 bits. But finding a private key given the public key already costs only 2^128 operations (using e.g. Pollard's rho algorithm, not using brute force of course). So if an attacker can just attack the private key keys that come out directly, there is no reason to try to find the seed. –
Pieter Wuille
Feb 25 at 19:28</p>
</blockquote>

CC BY-SA 4.0
2023-06-07T04:59:49.100Z
@drivenuts yes thanks, sorry I typed it pretty fast
Poseidon
CC BY-SA 4.0
2023-06-07T09:53:46.977Z
My colleagues argue that in Bitcoin the "Pollard's rho algorithm" does not apply. The master key's public key should never be exposed and therefore brute forcing it will only depend on the input entropy. Therefore 24 words > 12 words.
drivenuts
CC BY-SA 4.0
2023-06-07T11:23:14.147Z
@Poseidon Entropy is the wrong term. 24-word based private/public keys do have 256 bits of entropy, but it still only takes on the order of 2^128 iterations to compute the private key from a public key.
Pieter Wuille
CC BY-SA 4.0
2023-06-07T11:25:37.143Z
@drivenuts It is indeed often the case that the master public key is not revealed, so it is true that a hypothetical 2^128 attacker can break individual keys (because those get their pubkey revealed), without being able to break the master key. I'm not sure how much that distinction matters, but it is correct.
Pieter Wuille
CC BY-SA 4.0
2023-06-07T17:30:45.320Z
@PieterWuille Thank you I edited the post to include your correction.
Poseidon
CC BY-SA 4.0
2023-06-07T17:44:43.123Z
@drivenuts If you never spend from your master public key (which is normal as far as I know) then yes, the input entropy is what is important for the master public key. However there are still child keys which are commonly spent from in which case Pollards rho becomes relevant to those keys. If it is an HD wallet an attack on a child key would not reveal its parent key but if it was not HD then it would be trivial to reveal from an attacked child key. Brute forcing 12 or 24 word seed phrases when picked in a securely random fashion is incredibly unlikely / inefficient.
Poseidon
CC BY-SA 4.0
2023-06-08T08:36:46.690Z
@Poseidon in your last update you start mentioning "password", this is slightly confusing me now, are you referring to mnemonic passphrase (infamously called 25th word)?
drivenuts
CC BY-SA 4.0
2023-06-08T19:15:24.763Z
@drivenuts I brought up passwords because of the first link you provided, I was just suggesting the passphrase would not increase number of rounds to crack in Pollards rho. It may increase input entropy though.
Poseidon
CC BY-SA 4.0
2023-06-09T07:50:22.213Z
makes sense to me, thanks for clarifying.
drivenuts
CC BY-SA 4.0
2023-06-07T04:31:45.167Z
2024-06-19T23:49:10.000Z
2024-06-19T23:49:10.000Z
Poseidon
<p>Both a 12 and 24 word seed should be secure.</p>
<p>2048^12 = 5.44x10^39 and 2048^24 = 2.96x10^79 are both insanely high numbers of possibilities that will protect you from brute force attempts. <strong>Note</strong> given the checksum these numbers are smaller, but very high none the less.</p>
<p>The amount of starting entropy is going to be larger with a 24 word seed, but yes they will result in the same sized keys.</p>
<p>Given a sufficiently random process or wallet software, both a 12 or 24 word seed will be safe.</p>

CC BY-SA 4.0
2023-06-07T04:28:41.353Z
yes both are safe, but I explicitly want to know if 24 is safer. You say: "they will result in the same sized keys" does that mean they are equally safe in terms of brute-forcing the private key?

https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki#master-key-generation says: "the produced keys are only 256 bits long, and offer about half of that in terms of security."

Does it matter if the "starting entropy" is higher if it is reduced later to 128bit anyway?
drivenuts
CC BY-SA 4.0
2023-06-07T04:39:16.430Z
and in my first link Pieter Wullie writes: "a private key is always just 128bit even when derived from 24 words." so is it the same security regardless of starting entropy?
drivenuts
CC BY-SA 4.0
2023-06-07T02:28:45.567Z
2023-06-07T02:28:45.567Z
Michael Tidwell
<p>What if they aren’t generate properly?  Wouldn’t a 24 word seed then still provide good security while the 12 word would not ?  Again assuming both were generated improperly</p>

CC BY-SA 4.0
2024-08-04T04:42:27.467Z
2024-08-04T04:42:27.467Z
Bill
<p>In terms of brute-forcing the private key, both a <code>12-word</code> seed phrase and a <code>24-word</code> seed phrase offer the same level of security if they are generated using a strong random number generator.</p>
<p>The reason for this is that the private key derived from the seed phrase is essentially a <code>256-bit</code> number in the case of the Bitcoin protocol (specifically, the <code>secp256k1 elliptic curve</code> used in Bitcoin). The seed phrase is used to deterministically generate the private key, but the private key itself has a fixed length of 256 bits.</p>
<p><strong>When using a 12-word seed phrase, the seed phrase is used to generate the private key through a series of cryptographic operations.</strong> <strong>Similarly, when using a 24-word seed phrase, the same process is followed to generate the private key.</strong></p>
<p>The extra words in a 24-word seed phrase are used to provide additional entropy and increase the number of possible seed phrases. This helps in protecting against the possibility of collisions <em>(two different seed phrases generating the same private key)</em>, but it does not directly impact the security of the private key itself.</p>
<p><strong>In summary</strong>, the security of the private key is determined by the length and randomness of the underlying bits used to generate it, rather than the number of words in the seed phrase. Both a <code>12-word</code> seed phrase and a <code>24-word</code> seed phrase can <strong>provide strong security if generated properly.</strong></p>

CC BY-SA 4.0
2023-06-07T17:36:56.077Z
2023-06-07T17:36:56.077Z
Mmdrza
<p>Is a 24 words seed more secure than 12 words in terms of brute forcing the private key?</p>
<p>From the following answer I read that a private key is always &quot;just&quot; 128bit even when derived from 24 words. So it doesn't matter is that correct?</p>
<p><a href="https://bitcoin.stackexchange.com/questions/110145/using-more-than-a-12-word-mnemonic-phrase#comment124997_110147">Using more than a 12 word mnemonic phrase</a></p>
<p>here it says &quot;ECDSA secp256k1 only have 128 bit strength&quot; but the question linked is about if passphrase improves security.</p>
<p><a href="https://bitcoin.stackexchange.com/questions/117348/12-or-24-words-for-menomonic/117366#">12 or 24 words for menomonic?</a></p>
<p>Or is it recommended to use 24 words over 12 words in regards to brute forcing?</p>

<security><private-key><mnemonic-seed>
Is 24 words seed safer than 12 words in terms of bruteforcing the private key
drivenuts
# Is 24 words seed safer than 12 words in terms of bruteforcing the private key

(Asked by: username_0 on 2023-06-06)

Is a 24 words seed more secure than 12 words in terms of brute forcing the private key?

From the following answer I read that a private key is always "just" 128bit even when derived from 24 words. So it doesn't matter is that correct?

[Using more than a 12 word mnemonic phrase](https://bitcoin.stackexchange.com/questions/110145/using-more-than-a-12-word-mnemonic-phrase#comment124997_110147)

here it says "ECDSA secp256k1 only have 128 bit strength" but the question linked is about if passphrase improves security.

[12 or 24 words for menomonic?](https://bitcoin.stackexchange.com/questions/117348/12-or-24-words-for-menomonic/117366#)

Or is it recommended to use 24 words over 12 words in regards to brute forcing?

**Tags:** security, private-key, mnemonic-seed


---

## 4 answers

### Answer by username_1 on 2023-06-07. Score: 2 | Accepted answer

Regardless of whether you have a passphrase or not 12 words is just as secure as 24 words because the resulting public key will still require 2^128 iterations to compute its private key using the most efficient algorithm.
That is relevant because the most efficient algorithm to crack secp256k1 keys "Pollard's rho algorithm" does not try to guess your password or seed words but instead tries to reverse a public key to its private key.

`It should probably be noted that properly generated Bitcoin keys cant be cracked efficiently with modern hardware even with Pollards rho, improperly generated or purposefully weaker keys may be cracked`

So no it is not recommended to use 24 words it is completely optional, it may theoretically help against attacks in which someone guesses / brute-forces your seed phrase (assuming your seed phrase was generated in a securely random fashion) but brute-force is still highly inefficient compared to Pollard's rho algorithm. This is more or less covered here:

[12 or 24 words for mnemonic?](https://bitcoin.stackexchange.com/questions/117348/12-or-24-words-for-menomonic/117366#117366).

> In fact, cryptographically speaking, there is no benefit to private keys having more than 128 bits of entropy, as long as there is no pattern in them (e.g. don't use just 128 bit numbers as private keys, that's broken, but using the hash of 128 bit numbers appears to be just fine). The reason for suggesting more is just defense in depth. –
> username_2 username_2
> Feb 25 at 6:00

> 24 words = 256 bits, 12 words = 128 bits. But finding a private key given the public key already costs only 2^128 operations (using e.g. Pollard's rho algorithm, not using brute force of course). So if an attacker can just attack the private key keys that come out directly, there is no reason to try to find the seed. –
> username_2 username_2
> Feb 25 at 19:28

> **Comments:**
> **username_1**: @username_0 yes thanks, sorry I typed it pretty fast  
> **username_0**: My colleagues argue that in Bitcoin the "Pollard's rho algorithm" does not apply. The master key's public key should never be exposed and therefore brute forcing it will only depend on the input entropy. Therefore 24 words > 12 words.  
> **username_2**: @username_1 Entropy is the wrong term. 24-word based private/public keys do have 256 bits of entropy, but it still only takes on the order of 2^128 iterations to compute the private key from a public key.  
> **username_2**: @username_0 It is indeed often the case that the master public key is not revealed, so it is true that a hypothetical 2^128 attacker can break individual keys (because those get their pubkey revealed), without being able to break the master key. I'm not sure how much that distinction matters, but it is correct.  
> **username_1**: @username_2 Thank you I edited the post to include your correction.  
> **username_1**: @username_0 If you never spend from your master public key (which is normal as far as I know) then yes, the input entropy is what is important for the master public key. However there are still child keys which are commonly spent from in which case Pollards rho becomes relevant to those keys. If it is an HD wallet an attack on a child key would not reveal its parent key but if it was not HD then it would be trivial to reveal from an attacked child key. Brute forcing 12 or 24 word seed phrases when picked in a securely random fashion is incredibly unlikely / inefficient.  
> **username_0**: @username_1 in your last update you start mentioning "password", this is slightly confusing me now, are you referring to mnemonic passphrase (infamously called 25th word)?  
> **username_1**: @username_0 I brought up passwords because of the first link you provided, I was just suggesting the passphrase would not increase number of rounds to crack in Pollards rho. It may increase input entropy though.  
> **username_0**: makes sense to me, thanks for clarifying.  

---

### Answer by username_3 on 2023-06-07. Score: 1

Both a 12 and 24 word seed should be secure.

2048^12 = 5.44x10^39 and 2048^24 = 2.96x10^79 are both insanely high numbers of possibilities that will protect you from brute force attempts. **Note** given the checksum these numbers are smaller, but very high none the less.

The amount of starting entropy is going to be larger with a 24 word seed, but yes they will result in the same sized keys.

Given a sufficiently random process or wallet software, both a 12 or 24 word seed will be safe.

> **Comments:**
> **username_0**: yes both are safe, but I explicitly want to know if 24 is safer. You say: "they will result in the same sized keys" does that mean they are equally safe in terms of brute-forcing the private key?  https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki#master-key-generation says: "the produced keys are only 256 bits long, and offer about half of that in terms of security."  Does it matter if the "starting entropy" is higher if it is reduced later to 128bit anyway?  
> **username_0**: and in my first link username_2 Wullie writes: "a private key is always just 128bit even when derived from 24 words." so is it the same security regardless of starting entropy?  

---

### Answer by username_4 on 2024-08-04. Score: 0

What if they aren’t generate properly? Wouldn’t a 24 word seed then still provide good security while the 12 word would not ? Again assuming both were generated improperly


---

### Answer by username_5 on 2023-06-07. Score: -3

In terms of brute-forcing the private key, both a `12-word` seed phrase and a `24-word` seed phrase offer the same level of security if they are generated using a strong random number generator.

The reason for this is that the private key derived from the seed phrase is essentially a `256-bit` number in the case of the Bitcoin protocol (specifically, the `secp256k1 elliptic curve` used in Bitcoin). The seed phrase is used to deterministically generate the private key, but the private key itself has a fixed length of 256 bits.

**When using a 12-word seed phrase, the seed phrase is used to generate the private key through a series of cryptographic operations.** **Similarly, when using a 24-word seed phrase, the same process is followed to generate the private key.**

The extra words in a 24-word seed phrase are used to provide additional entropy and increase the number of possible seed phrases. This helps in protecting against the possibility of collisions *(two different seed phrases generating the same private key)*, but it does not directly impact the security of the private key itself.

**In summary**, the security of the private key is determined by the length and randomness of the underlying bits used to generate it, rather than the number of words in the seed phrase. Both a `12-word` seed phrase and a `24-word` seed phrase can **provide strong security if generated properly.**


---

