<p>Other answers correctly state that leaking 16 words of a 24 word key significantly compromises security. I would add that you have an alternative option which wouldn't compromise security.</p>
<p>Using <a href="https://en.wikipedia.org/wiki/Shamir%27s_Secret_Sharing" rel="nofollow noreferrer">Shamir's Secret Sharing</a>, you can encode your key on three separate pieces of paper such that:</p>
<ul>
<li>You need at least two pieces of paper to recover the original key</li>
<li>If someone gets just one piece of paper, they can't learn <em>anything</em> (not even with unlimited resources) about your key from it</li>
</ul>
<p>It looks like there's at least one easy to use command line implementation of the algorithm for encoding strings, <a href="https://github.com/dsprenkels/sss-cli" rel="nofollow noreferrer">sss-cli</a>. Note that I have not verified its implementation.</p>

CC BY-SA 4.0
2020-08-06T22:26:35.617Z
2020-08-07T12:06:14.283Z
2020-08-07T12:06:14.283Z
Vaelus
<p>Andreas Antonpoulos answers this question <a href="https://www.youtube.com/watch?v=p5nSibpfHYE" rel="noreferrer">here</a>. He calls this reduction from 256 bit entropy to 80 bit entropy a &quot;catastrophic reduction in security&quot;. He estimates that it would take a cluster of machines up to a decade to brute force the remaining 8 words. It is certainly not an effective long term wealth storage solution. Perhaps it could work as a short term solution whilst you prepared a more robust solution. But most certainly, use at your own risk.</p>

CC BY-SA 4.0
2020-08-07T13:48:36.663Z
Oh wow this is exactly what I am looking for. I would have marked your answer as accepted but the other answer provides a more concrete calculation of the problem.
user3082537
CC BY-SA 4.0
2022-06-29T16:50:55.500Z
Antonpoulos' math doesn't make sense.  There are 2048^8 combinations and PDKDF2 requires hashing 2048 times.  So you have to hash up to 2048^9 times.  Assuming a super powerful ASIC can hash at 100 trillion times a second, you find that it would take 100 million years on average.  But maybe he's imagining some entirely new technology emerging in the future.
pandichef
CC BY-SA 4.0
2020-08-06T19:56:09.920Z
2020-08-06T19:56:09.920Z
Michael Folkson
<p><strong>It is equally secure as an 8-word passphrase would be.</strong></p>
<p>The actual entropy depends on your dictionary size. To achieve 256 bit entropy, each of the 8 words would have to be chosen out of a dictionary of 2^(256/8) = 4 billion words. English language only has about 200 000 words.</p>
<hr />
<p>There is, however, a different approach you can use to store your passphrase with 2-out-of-3 recovery ratio:</p>
<ol>
<li>For each paper, generate <a href="https://en.wikipedia.org/wiki/One-time_pad" rel="nofollow noreferrer">one-time pad</a> with the same length as the passphrase. On computer, you would use XOR with random binary value for this. If you want to compute it on paper, this can be a list of random numbers, which you then add to each letter of the passphrase (A + 1 = B, Z + 1 = A etc.). Be sure to encrypt or remove the spaces to avoid giving away the length of each word.</li>
<li>Print on each paper the one-time pad encrypted passphrase, and the one-time pads of the two other papers.</li>
</ol>
<p>Now anyone who gets only a single paper only has the encrypted passphrase and two random keys. But anyone who has two papers can decrypt the passphrase.</p>

CC BY-SA 4.0
2020-08-07T11:08:14.923Z
2020-08-07T11:08:14.923Z
jpa
<p>I use a 24 word seed for my private key. I split the 24 words into 16 words in three pieces of paper, so one needs to have at least two pieces of paper to recover the wallet. However my question is, if someone gets one piece of paper, can they easily brute force the remaining 8 words?</p>

<mnemonic-seed>
Am I safe if 16 words in my 24 word seed are leaked?
user3082537
# Am I safe if 16 words in my 24 word seed are leaked?

(Asked by: username_0 on 2020-08-06)

I use a 24 word seed for my private key. I split the 24 words into 16 words in three pieces of paper, so one needs to have at least two pieces of paper to recover the wallet. However my question is, if someone gets one piece of paper, can they easily brute force the remaining 8 words?

**Tags:** mnemonic-seed


---

## 3 answers

### Answer by username_1 on 2020-08-06. Score: 5

Other answers correctly state that leaking 16 words of a 24 word key significantly compromises security. I would add that you have an alternative option which wouldn't compromise security.

Using [Shamir's Secret Sharing](https://en.wikipedia.org/wiki/Shamir%27s_Secret_Sharing), you can encode your key on three separate pieces of paper such that:

* You need at least two pieces of paper to recover the original key
* If someone gets just one piece of paper, they can't learn *anything* (not even with unlimited resources) about your key from it

It looks like there's at least one easy to use command line implementation of the algorithm for encoding strings, [sss-cli](https://github.com/dsprenkels/sss-cli). Note that I have not verified its implementation.


---

### Answer by username_2 on 2020-08-06. Score: 5

Andreas Antonpoulos answers this question [here](https://www.youtube.com/watch?v=p5nSibpfHYE). He calls this reduction from 256 bit entropy to 80 bit entropy a "catastrophic reduction in security". He estimates that it would take a cluster of machines up to a decade to brute force the remaining 8 words. It is certainly not an effective long term wealth storage solution. Perhaps it could work as a short term solution whilst you prepared a more robust solution. But most certainly, use at your own risk.

> **Comments:**
> **username_0**: Oh wow this is exactly what I am looking for. I would have marked your answer as accepted but the other answer provides a more concrete calculation of the problem.  
> **username_3**: Antonpoulos' math doesn't make sense.  There are 2048^8 combinations and PDKDF2 requires hashing 2048 times.  So you have to hash up to 2048^9 times.  Assuming a super powerful ASIC can hash at 100 trillion times a second, you find that it would take 100 million years on average.  But maybe he's imagining some entirely new technology emerging in the future.  

---

### Answer by username_4 on 2020-08-07. Score: 0

**It is equally secure as an 8-word passphrase would be.**

The actual entropy depends on your dictionary size. To achieve 256 bit entropy, each of the 8 words would have to be chosen out of a dictionary of 2^(256/8) = 4 billion words. English language only has about 200 000 words.

---

There is, however, a different approach you can use to store your passphrase with 2-out-of-3 recovery ratio:

1. For each paper, generate [one-time pad](https://en.wikipedia.org/wiki/One-time_pad) with the same length as the passphrase. On computer, you would use XOR with random binary value for this. If you want to compute it on paper, this can be a list of random numbers, which you then add to each letter of the passphrase (A + 1 = B, Z + 1 = A etc.). Be sure to encrypt or remove the spaces to avoid giving away the length of each word.
2. Print on each paper the one-time pad encrypted passphrase, and the one-time pads of the two other papers.

Now anyone who gets only a single paper only has the encrypted passphrase and two random keys. But anyone who has two papers can decrypt the passphrase.


---

