<p>Edit 15/3/2021: Electrum now lets you set a longer password.</p>
<p>Android is also better at keeping apps from stepping on each other's toes. The OS isolates Electrum's files and prevent other apps from accessing them.</p>

CC BY-SA 4.0
2021-03-14T12:40:10.093Z
+1 Good answer, but I would like more details. Why does rooting after wallet creation not work? Why can the files not be accessed using adb?
Brian Drake
CC BY-SA 4.0
2021-03-15T14:08:26.673Z
the answer is wrong now. they allow you to set a longer password and the wallet file can be saved to microsd card.
Abdussamad
CC BY-SA 4.0
2021-03-15T14:10:30.700Z
Please edit your answer to include this new information, as well as clarify the relevance of rooting the device either before or after creating the wallet.
Brian Drake
CC BY-SA 4.0
2021-03-15T14:14:08.577Z
@BrianDrake afaik rooting wipes app data so can't be used for this purpose
Abdussamad
CC BY-SA 4.0
2021-03-15T14:17:14.543Z
Rooting [should *not* erase data](https://android.stackexchange.com/questions/44574/does-rooting-erase-anything), according to Android SE.
Brian Drake
CC BY-SA 4.0
2019-10-31T03:39:57.517Z
2021-03-15T14:12:49.717Z
2021-03-15T14:12:49.717Z
Abdussamad
<blockquote>
  <p>The android version requires me to select a PIN but it is only 6 digits long? How does the android version of electrum ensure that this tiny keyspace (1 million) stays secure?</p>
</blockquote>

<p>The PIN is not used as a master seed in this way. It may be used as an additional source of user-supplied entropy, but the wallet's seed will be generated in a cryptographically secure way, using other sources of randomness to provide sufficient security. </p>

<p>I am unfamiliar with the specifics of Electrum's implementation, but there are generally two possibilities here:</p>

<p>1) the password / PIN is simply used to encrypt the wallet, and is not used as input for the seed </p>

<p>2) the password/ PIN is used as a '13th/25th word' that acts as a password on the mnemonic. Find <a href="https://bitcoin.stackexchange.com/questions/72016/what-is-the-25th-word-in-a-mnemonic-seed-when-used-on-a-ledger-nano-s">more info here</a>. Also, <a href="https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki" rel="nofollow noreferrer">from BIP 39:</a> </p>

<blockquote>
  <p>A user may decide to protect their mnemonic with a passphrase. If a passphrase is not present, an empty string "" is used instead.</p>
</blockquote>

CC BY-SA 4.0
2019-10-30T20:26:26.783Z
Electrum uses option 1 - it has support for option 2, but you configure that during wallet set up, and don't need to reenter it unless you are restoring a wallet (I'm not sure if that applies to the mobile version, but since the desktop works that way, I imagine it does)
Raghav Sood
CC BY-SA 4.0
2019-10-30T22:04:46.367Z
Option 1 is what I was afraid was happening, and what I meant when I asked if the private seed is secure. A 6 digit pin as an encryption key for the wallet, which contains the master private key, is not secure. I'm going to have to re evaluate using electrum on my android device because of this. If anyone ever gains access to the encrypted wallet file, it would be trivial to brute force the wallet file encryption.
user258667
CC BY-SA 4.0
2019-10-30T22:35:19.623Z
@user258667 Oh! I understand the question better now. Your comment is correct, if anyone gains access to the encrypted wallet file, the 6-digit PIN encryption is not extremely strong. Nevertheless, the security model provided by such a mobile wallet may still be useful in some situations (ie a small amount of 'daily spend' BTC, not a large amount that you want to keep extremely secure).
chytrik
CC BY-SA 4.0
2019-10-30T20:21:49.033Z
2019-10-30T20:21:49.033Z
chytrik
<p>I have used electrum for many years on my desktop pc, and have alway felt very secure in doing so because of my ability to use a very strong password to encrypt my seed phrase with. However I just started using the android version and have some concerns.</p>

<p>The android version requires me to select a PIN but it is only 6 digits long? How does the android version of electrum ensure that this tiny keyspace (1 million) stays secure?</p>

<electrum><mnemonic-seed><android>
Is the electrum android private key secure?
user258667
# Is the electrum android private key secure?

(Asked by: username_0 on 2019-10-30)

I have used electrum for many years on my desktop pc, and have alway felt very secure in doing so because of my ability to use a very strong password to encrypt my seed phrase with. However I just started using the android version and have some concerns.

The android version requires me to select a PIN but it is only 6 digits long? How does the android version of electrum ensure that this tiny keyspace (1 million) stays secure?

**Tags:** electrum, mnemonic-seed, android


---

## 2 answers

### Answer by username_1 on 2019-10-31. Score: 1 | Accepted answer

Edit 15/3/2021: Electrum now lets you set a longer password.

Android is also better at keeping apps from stepping on each other's toes. The OS isolates Electrum's files and prevent other apps from accessing them.

> **Comments:**
> **username_2**: +1 Good answer, but I would like more details. Why does rooting after wallet creation not work? Why can the files not be accessed using adb?  
> **username_1**: the answer is wrong now. they allow you to set a longer password and the wallet file can be saved to microsd card.  
> **username_2**: Please edit your answer to include this new information, as well as clarify the relevance of rooting the device either before or after creating the wallet.  
> **username_1**: @username_2 afaik rooting wipes app data so can't be used for this purpose  
> **username_2**: Rooting [should *not* erase data](https://android.stackexchange.com/questions/44574/does-rooting-erase-anything), according to Android SE.  

---

### Answer by username_3 on 2019-10-30. Score: 1

> The android version requires me to select a PIN but it is only 6 digits long? How does the android version of electrum ensure that this tiny keyspace (1 million) stays secure?

The PIN is not used as a master seed in this way. It may be used as an additional source of user-supplied entropy, but the wallet's seed will be generated in a cryptographically secure way, using other sources of randomness to provide sufficient security.

I am unfamiliar with the specifics of Electrum's implementation, but there are generally two possibilities here:

1) the password / PIN is simply used to encrypt the wallet, and is not used as input for the seed

2) the password/ PIN is used as a '13th/25th word' that acts as a password on the mnemonic. Find [more info here](https://bitcoin.stackexchange.com/questions/72016/what-is-the-25th-word-in-a-mnemonic-seed-when-used-on-a-ledger-nano-s). Also, [from BIP 39:](https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki)

> A user may decide to protect their mnemonic with a passphrase. If a passphrase is not present, an empty string "" is used instead.

> **Comments:**
> **username_4**: Electrum uses option 1 - it has support for option 2, but you configure that during wallet set up, and don't need to reenter it unless you are restoring a wallet (I'm not sure if that applies to the mobile version, but since the desktop works that way, I imagine it does)  
> **username_0**: Option 1 is what I was afraid was happening, and what I meant when I asked if the private seed is secure. A 6 digit pin as an encryption key for the wallet, which contains the master private key, is not secure. I'm going to have to re evaluate using electrum on my android device because of this. If anyone ever gains access to the encrypted wallet file, it would be trivial to brute force the wallet file encryption.  
> **username_3**: @username_0 Oh! I understand the question better now. Your comment is correct, if anyone gains access to the encrypted wallet file, the 6-digit PIN encryption is not extremely strong. Nevertheless, the security model provided by such a mobile wallet may still be useful in some situations (ie a small amount of 'daily spend' BTC, not a large amount that you want to keep extremely secure).  

---

