<p>According to my calculator ...</p>
<ul>
<li>2<sup>128</sup> is around 3.4e+38.</li>
<li>2048<sup>12</sup> is around 5.4e+39</li>
</ul>
<p>So I guess Andreas is right (unsurprisingly). A randomly chosen 12 word phrase from a 2048-word dictionary has enough entropy to generate any 128-bit seed.</p>
<p>However, I am not a mathematician nor a cryptographer, so there may well be some other important factors I am unaware of.</p>
<p>The fact that the phrase incorporates a checksum must slightly reduce the number of random bits in the generated seed.</p>
<hr />
<p><a href="https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki" rel="nofollow noreferrer">BIP39</a> says this:</p>
<blockquote>
<p>We refer to the initial entropy length as ENT. The allowed size of ENT is 128-256 bits.</p>
</blockquote>
<p>So BIP39 allows for much greater entropy.</p>
<p>...</p>
<blockquote>
<p>The following table describes the relation between the initial entropy length (ENT), the checksum length (CS), and the length of the generated mnemonic sentence (MS) in words.</p>
<p>CS = ENT / 32<br />
MS = (ENT + CS) / 11</p>
<div class="s-table-container">
<table class="s-table">
<thead>
<tr>
<th>ENT</th>
<th>CS</th>
<th>ENT+CS</th>
<th>MS</th>
</tr>
</thead>
<tbody>
<tr>
<td>128</td>
<td>4</td>
<td>132</td>
<td>12</td>
</tr>
<tr>
<td>160</td>
<td>5</td>
<td>165</td>
<td>15</td>
</tr>
<tr>
<td>192</td>
<td>6</td>
<td>198</td>
<td>18</td>
</tr>
<tr>
<td>224</td>
<td>7</td>
<td>231</td>
<td>21</td>
</tr>
<tr>
<td>256</td>
<td>8</td>
<td>264</td>
<td>24</td>
</tr>
</tbody>
</table>
</div></blockquote>
<p>So the checksum is accounted for.</p>
<p>I didn't see much other relevant discusssion of this aspect in the BIP.</p>

CC BY-SA 4.0
2022-07-03T17:33:04.510Z
The checksum is 4 bits for 12 words, which makes it 2048^12 / 2^4 = 2^132 / 2^4 = 2^128. Typically when a seed phrase is generated, it is done by generating 128 entropy bits, and then transforming that to the phrase with a checksum. The words represent the entropy original entropy. Checksum is for error checking.
miketery
CC BY-SA 4.0
2022-01-31T10:27:28.530Z
2022-01-31T10:44:02.713Z
2022-01-31T10:44:02.713Z
RedGrittyBrick
<p>My guess at this point is that it is much more difficult to brute force 24 words than 12.  The resulting seed is no stronger, so actually brute forcing the seed would be more effective than guessing the 24 words.</p>

CC BY-SA 4.0
2022-07-02T07:57:30.850Z
2022-07-02T07:57:30.850Z
John C.
<p>Watching <a href="https://www.youtube.com/watch?app=desktop&amp;v=U0T49duRt74&amp;t=841s" rel="nofollow noreferrer">this Q&amp;A with andreas</a> he states that a 12 word recovery phrase offers the same amount of security as a 24 word seed phrase as the output is 128 bits either way.</p>
<p>If this is the case, why do wallets use 24 word recovery phrases which adds extra user complexity for no, or a marginal at best, security improvement?</p>

<security><wallet-recovery><wallet-security><usability>
Does a 12 word recovery phrase offer the same security as 24 words?
bosch-0
# Does a 12 word recovery phrase offer the same security as 24 words?

(Asked by: username_0 on 2022-01-31)

Watching [this Q&A with andreas](https://www.youtube.com/watch?app=desktop&v=U0T49duRt74&t=841s) he states that a 12 word recovery phrase offers the same amount of security as a 24 word seed phrase as the output is 128 bits either way.

If this is the case, why do wallets use 24 word recovery phrases which adds extra user complexity for no, or a marginal at best, security improvement?

**Tags:** security, wallet-recovery, wallet-security, usability


---

## 2 answers

### Answer by username_1 on 2022-01-31. Score: 1

According to my calculator ...

* 2128 is around 3.4e+38.
* 204812 is around 5.4e+39

So I guess Andreas is right (unsurprisingly). A randomly chosen 12 word phrase from a 2048-word dictionary has enough entropy to generate any 128-bit seed.

However, I am not a mathematician nor a cryptographer, so there may well be some other important factors I am unaware of.

The fact that the phrase incorporates a checksum must slightly reduce the number of random bits in the generated seed.

---

[BIP39](https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki) says this:

> We refer to the initial entropy length as ENT. The allowed size of ENT is 128-256 bits.

So BIP39 allows for much greater entropy.

...

> The following table describes the relation between the initial entropy length (ENT), the checksum length (CS), and the length of the generated mnemonic sentence (MS) in words.
>
> CS = ENT / 32  
> MS = (ENT + CS) / 11
>
> | ENT | CS | ENT+CS | MS |
> | --- | --- | --- | --- |
> | 128 | 4 | 132 | 12 |
> | 160 | 5 | 165 | 15 |
> | 192 | 6 | 198 | 18 |
> | 224 | 7 | 231 | 21 |
> | 256 | 8 | 264 | 24 |

So the checksum is accounted for.

I didn't see much other relevant discusssion of this aspect in the BIP.

> **Comments:**
> **username_2**: The checksum is 4 bits for 12 words, which makes it 2048^12 / 2^4 = 2^132 / 2^4 = 2^128. Typically when a seed phrase is generated, it is done by generating 128 entropy bits, and then transforming that to the phrase with a checksum. The words represent the entropy original entropy. Checksum is for error checking.  

---

### Answer by username_3 on 2022-07-02. Score: 0

My guess at this point is that it is much more difficult to brute force 24 words than 12. The resulting seed is no stronger, so actually brute forcing the seed would be more effective than guessing the 24 words.


---

