<p>BIP38 wallets are significantly more secure and are resistant to brute-force attacks when a decent passphrase is used.</p>

<p>Generally the term "Brain Wallet" refers to one in which the private key is derived from a phrase you make up.  These have been shown to be <a href="http://insecurety.net/?p=866" rel="nofollow noreferrer">insecure</a> because humans are bad at entropy and generally anything easy enough to remember is <a href="http://www.reddit.com/r/Bitcoin/comments/1ptuf3/" rel="nofollow noreferrer">not safe</a>.</p>

<p>Note: modern BIP39 wallets will generate a 12, 18 or 24 word "seed" phrase from which unlimited keys can be derived.  These may <strong>look</strong> like a brain wallet, but are completely safe as long as they were created securely. Remembering these words can be challenging though, so generally better to write them somewhere and store securely.</p>

CC BY-SA 3.0
2015-02-15T02:11:55.893Z
2017-11-01T20:37:00.280Z
2017-11-01T20:37:00.280Z
Jonathan Cross
<p>Brain wallets use your secret phrase to deterministically generate keys for you, meaning that you can never lose your wallet and there is no need to print it (except for extra-safe keeping). Hence the name, "brain" wallet (not paper wallet). But they have the downside that human chosen, and memorable, passphrases are usually easier to break. So in this sense, brain wallets are likely not as secure.</p>

<p>BIP38 wallets are password encrypted private keys stored on paper, and you can store the secret random password in a separate place. You can also do multisig with these wallets, I believe, so this has the potential to be much more secure. For example, if you made a 2 of 3 multisig address that you could send funds to, then even if an attacker got ahold of one key somehow, they still wouldn't be able to spend your funds. </p>

<p>Thus, you can see here the age-old compromise between <strong>convenience and security</strong>. Brain wallets are more convenient, but BIP38 paper wallets are more secure. </p>

CC BY-SA 3.0
2014-10-27T02:36:51.730Z
2014-10-27T02:36:51.730Z
morsecoder
<p>BIP38 allows you to hide your private key in plain sight.  Nobody knows what the private key is until they decrypt it with the password.</p>

<p>A brainwallet is essentially generating a private key by hashing a password or passphrase.</p>

<p>You can generate a private key using random or pseudorandom sources, or you can hash a password or passphrase.  You can then, if you choose, create a paper wallet from that key, and conceal the key with a BIP38 password.</p>

<p>You could conceivably generate a brainwallet and print it out with BIP38 concealment.  The caveat is that BIP38 will not protect a private key that was generated with a weak password/passphrase, regardless of how strong the BIP38 password is.  BIP38 only protects the paper wallet from prying eyes.  If someone already knows what the private key is, BIP38 provides no protection.</p>

CC BY-SA 4.0
2019-01-22T23:40:52.960Z
I think this is the most accurate answer. Brainwallets do not conflict with BIP38 or seeds; it's just one extra step in order to make it easier to remember (and unfortunately in most cases easier to crack by an attacker).
Gendarme
CC BY-SA 4.0
2019-09-24T07:18:40.057Z
"If someone already knows what the private key is" - and this will only possible *(for BIP38 protected key)* if an attacker manages to reverse the public key.
Neeraj
CC BY-SA 4.0
2019-01-22T14:41:55.170Z
2019-01-22T14:41:55.170Z
John C.
<p>Why limit yourself and have the best of all worlds when you have all the power of <a href="https://github.com/libbitcoin/libbitcoin-explorer/wiki" rel="nofollow noreferrer"><strong>bitcoin-explorer</strong></a> command line interface at your fingertips?  The following examples should clearly answer your question with really short and sweet working examples.</p>

<p>Nothing says a 256-bit brain wallet private key has to be the result of a single hash.  Besides picking a high entropy brain wallet phrase not published anywhere, cascading different hashing functions makes it harder to crack and discover a brain wallet's private seed.  </p>

<p>%  echo -n "This is a crappy brain wallet example that supports both BIP 38 and BIP 39" | bx base16-encode | bx sha512 | bx sha256 | bx sha256
<strong><code>6227e1e5a65d5791af2e433f42825b00ef30311439798f9f558c6066dfbb8362</code></strong></p>

<p>% echo -n "This is a crappy brain wallet example that supports both BIP 38 and BIP 39" | bx base16-encode | bx sha512 | bx sha256 | bx sha256 | bx ec-to-ek --version 0 "My BIP 38 Passphrase"
<strong><code>6PYT2EZPT1AWDiPtRU19q9GJPABowwkM7s5WReTUhpgZW5KVyXG2G5FuhK</code></strong></p>

<p>% echo -n "This is a crappy brain wallet example that supports both BIP 38 and BIP 39" | bx base16-encode | bx sha512 | bx sha256 | bx sha256 | bx ec-to-ek --version 0 "My BIP 38 Passphrase" | bx ek-to-ec "My BIP 38 Passphrase"</p>

<p><strong><code>6227e1e5a65d5791af2e433f42825b00ef30311439798f9f558c6066dfbb8362</code></strong></p>

<p>% echo -n "This is a crappy brain wallet example that supports both BIP 38 and BIP 39" | bx base16-encode | bx sha512 | bx sha256 | bx sha256 | bx ec-to-ek --version 0 "My BIP 38 Passphrase" | bx ek-to-ec "My BIP 38 Passphrase" | bx mnemonic-new</p>

<p><strong><code>giraffe disease just erosion step silver royal silent dismiss beef nothing achieve vessel blush extend connect moon wide glide school hospital tape assault eagle</code></strong></p>

<p>Additionally, be sure your BIP 39 wallet takes advantage an additional seed phrase of your choosing, also colloquially  referred to as the 25th BIP 39 seed word. This ensures if an untrusted person gets access to your seed words, you have one more layer of defense.</p>

<p>Finally, to round out the examples, here is how to convert a 256-bit hex encoded key into  an uncompressed Wallet Input Format (WIF) encoded key.</p>

<p>% echo 6227e1e5a65d5791af2e433f42825b00ef30311439798f9f558c6066dfbb8362 | bx base58check-encode --version 128</p>

<p><strong><code>5JZWqe925xSFP9qC1XLVNm35JFKBts4bnQhjEg45b7czsJTpB2v</code></strong></p>

<p>% echo 5JZWqe925xSFP9qC1XLVNm35JFKBts4bnQhjEg45b7czsJTpB2v | bx base58check-decode
<strong><code>wrapper
{
    checksum 1863987882
    payload 6227e1e5a65d5791af2e433f42825b00ef30311439798f9f558c6066dfbb8362
    version 128
}</code></strong></p>

CC BY-SA 4.0
2019-01-22T22:47:52.327Z
2019-01-22T22:47:52.327Z
skaht
<p><a href="https://github.com/bitcoin/bips/blob/master/bip-0038.mediawiki" rel="nofollow noreferrer">BIP38</a> is a method for encrypting and encoding a private key. It says nothing about the private key itself.</p>

<p>Private keys are usually generated randomly, because <a href="http://www.loper-os.org/bad-at-entropy/manmach.html" rel="nofollow noreferrer">Man is not a Particularly Good Source of Entropy</a> and too many people are bad at creating strong phrases—which is why <a href="https://en.wikipedia.org/wiki/Dictionary_attack" rel="nofollow noreferrer">dictionary attacks</a> are a thing. However, there is nothing that states that a private key must be generated randomly. A private key is simply a number between 0 and 2^256 (almost). </p>

<p>What a brainwallet does is to generate a private key from a phrase by converting it into a number between 0 and 2^256—usually by computing its SHA-256 hash. This way, even if you lose your private key, you can always regenerate it as long as you still remember the phrase. Unfortunately, this also means that if someone finds out your phrase, your private key is exposed. This is why brainwallets are not recommended; keeping a phrase secure is actually far more difficult than it first seems.</p>

<p>You <em>can</em>  still encrypt your deterministically generated private key (i.e. brainwallet) with BIP38 and store it in case you ever forget your brainwallet phrase. Brainwallets and BIP38 are two separate things. Although it is not common to see them combined, it is very much possible.</p>

CC BY-SA 4.0
2019-01-23T00:03:40.587Z
2019-01-23T00:03:40.587Z
Gendarme
<p>I have seen many videos about paper wallets and different ways to store BTC. And I have choose to store using a cold wallet (paper wallet). But I am not sure what option I should choose: a normal BIP38 encrypted paper wallet, or a brain wallet printed in paper.</p>

<p>And plz tell me the differens with BIP38 and brain wallet.Thanks for your answer :D</p>

<p>P.S: Which one is securest?</p>

<encryption><paper-wallet><coldstorage><brain-wallet><bip38>
BIP38 or Brain wallet?
Tor
# BIP38 or Brain wallet?

(Asked by: username_0 on 2014-10-26)

I have seen many videos about paper wallets and different ways to store BTC. And I have choose to store using a cold wallet (paper wallet). But I am not sure what option I should choose: a normal BIP38 encrypted paper wallet, or a brain wallet printed in paper.

And plz tell me the differens with BIP38 and brain wallet.Thanks for your answer :D

P.S: Which one is securest?

**Tags:** encryption, paper-wallet, coldstorage, brain-wallet, bip38


---

## 5 answers

### Answer by username_1 on 2015-02-15. Score: 4

BIP38 wallets are significantly more secure and are resistant to brute-force attacks when a decent passphrase is used.

Generally the term "Brain Wallet" refers to one in which the private key is derived from a phrase you make up. These have been shown to be [insecure](http://insecurety.net/?p=866) because humans are bad at entropy and generally anything easy enough to remember is [not safe](http://www.reddit.com/r/Bitcoin/comments/1ptuf3/).

Note: modern BIP39 wallets will generate a 12, 18 or 24 word "seed" phrase from which unlimited keys can be derived. These may **look** like a brain wallet, but are completely safe as long as they were created securely. Remembering these words can be challenging though, so generally better to write them somewhere and store securely.


---

### Answer by username_2 on 2014-10-27. Score: 2

Brain wallets use your secret phrase to deterministically generate keys for you, meaning that you can never lose your wallet and there is no need to print it (except for extra-safe keeping). Hence the name, "brain" wallet (not paper wallet). But they have the downside that human chosen, and memorable, passphrases are usually easier to break. So in this sense, brain wallets are likely not as secure.

BIP38 wallets are password encrypted private keys stored on paper, and you can store the secret random password in a separate place. You can also do multisig with these wallets, I believe, so this has the potential to be much more secure. For example, if you made a 2 of 3 multisig address that you could send funds to, then even if an attacker got ahold of one key somehow, they still wouldn't be able to spend your funds.

Thus, you can see here the age-old compromise between **convenience and security**. Brain wallets are more convenient, but BIP38 paper wallets are more secure.


---

### Answer by username_3 on 2019-01-22. Score: 2

BIP38 allows you to hide your private key in plain sight. Nobody knows what the private key is until they decrypt it with the password.

A brainwallet is essentially generating a private key by hashing a password or passphrase.

You can generate a private key using random or pseudorandom sources, or you can hash a password or passphrase. You can then, if you choose, create a paper wallet from that key, and conceal the key with a BIP38 password.

You could conceivably generate a brainwallet and print it out with BIP38 concealment. The caveat is that BIP38 will not protect a private key that was generated with a weak password/passphrase, regardless of how strong the BIP38 password is. BIP38 only protects the paper wallet from prying eyes. If someone already knows what the private key is, BIP38 provides no protection.

> **Comments:**
> **username_4**: I think this is the most accurate answer. Brainwallets do not conflict with BIP38 or seeds; it's just one extra step in order to make it easier to remember (and unfortunately in most cases easier to crack by an attacker).  
> **username_5**: "If someone already knows what the private key is" - and this will only possible *(for BIP38 protected key)* if an attacker manages to reverse the public key.  

---

### Answer by username_6 on 2019-01-22. Score: 0

Why limit yourself and have the best of all worlds when you have all the power of [**bitcoin-explorer**](https://github.com/libbitcoin/libbitcoin-explorer/wiki) command line interface at your fingertips? The following examples should clearly answer your question with really short and sweet working examples.

Nothing says a 256-bit brain wallet private key has to be the result of a single hash. Besides picking a high entropy brain wallet phrase not published anywhere, cascading different hashing functions makes it harder to crack and discover a brain wallet's private seed.

% echo -n "This is a crappy brain wallet example that supports both BIP 38 and BIP 39" | bx base16-encode | bx sha512 | bx sha256 | bx sha256
**`6227e1e5a65d5791af2e433f42825b00ef30311439798f9f558c6066dfbb8362`**

% echo -n "This is a crappy brain wallet example that supports both BIP 38 and BIP 39" | bx base16-encode | bx sha512 | bx sha256 | bx sha256 | bx ec-to-ek --version 0 "My BIP 38 Passphrase"
**`6PYT2EZPT1AWDiPtRU19q9GJPABowwkM7s5WReTUhpgZW5KVyXG2G5FuhK`**

% echo -n "This is a crappy brain wallet example that supports both BIP 38 and BIP 39" | bx base16-encode | bx sha512 | bx sha256 | bx sha256 | bx ec-to-ek --version 0 "My BIP 38 Passphrase" | bx ek-to-ec "My BIP 38 Passphrase"

**`6227e1e5a65d5791af2e433f42825b00ef30311439798f9f558c6066dfbb8362`**

% echo -n "This is a crappy brain wallet example that supports both BIP 38 and BIP 39" | bx base16-encode | bx sha512 | bx sha256 | bx sha256 | bx ec-to-ek --version 0 "My BIP 38 Passphrase" | bx ek-to-ec "My BIP 38 Passphrase" | bx mnemonic-new

**`giraffe disease just erosion step silver royal silent dismiss beef nothing achieve vessel blush extend connect moon wide glide school hospital tape assault eagle`**

Additionally, be sure your BIP 39 wallet takes advantage an additional seed phrase of your choosing, also colloquially referred to as the 25th BIP 39 seed word. This ensures if an untrusted person gets access to your seed words, you have one more layer of defense.

Finally, to round out the examples, here is how to convert a 256-bit hex encoded key into an uncompressed Wallet Input Format (WIF) encoded key.

% echo 6227e1e5a65d5791af2e433f42825b00ef30311439798f9f558c6066dfbb8362 | bx base58check-encode --version 128

**`5JZWqe925xSFP9qC1XLVNm35JFKBts4bnQhjEg45b7czsJTpB2v`**

% echo 5JZWqe925xSFP9qC1XLVNm35JFKBts4bnQhjEg45b7czsJTpB2v | bx base58check-decode
**`wrapper
{
checksum 1863987882
payload 6227e1e5a65d5791af2e433f42825b00ef30311439798f9f558c6066dfbb8362
version 128
}`**


---

### Answer by username_4 on 2019-01-23. Score: 0

[BIP38](https://github.com/bitcoin/bips/blob/master/bip-0038.mediawiki) is a method for encrypting and encoding a private key. It says nothing about the private key itself.

Private keys are usually generated randomly, because [Man is not a Particularly Good Source of Entropy](http://www.loper-os.org/bad-at-entropy/manmach.html) and too many people are bad at creating strong phrases—which is why [dictionary attacks](https://en.wikipedia.org/wiki/Dictionary_attack) are a thing. However, there is nothing that states that a private key must be generated randomly. A private key is simply a number between 0 and 2^256 (almost).

What a brainwallet does is to generate a private key from a phrase by converting it into a number between 0 and 2^256—usually by computing its SHA-256 hash. This way, even if you lose your private key, you can always regenerate it as long as you still remember the phrase. Unfortunately, this also means that if someone finds out your phrase, your private key is exposed. This is why brainwallets are not recommended; keeping a phrase secure is actually far more difficult than it first seems.

You *can* still encrypt your deterministically generated private key (i.e. brainwallet) with BIP38 and store it in case you ever forget your brainwallet phrase. Brainwallets and BIP38 are two separate things. Although it is not common to see them combined, it is very much possible.


---

