<p>What you are describing has been done before, and is known as a "brain wallet".</p>

<p>In earlier days, some wallets and online website did use this system. However, it has proven quite insecure, as humans are terrible at picking secure random data for the "password", and computers are great at guessing them. Many BTC have been stolen from insecure brainwallets, and at this point we have much better and safer means of easily accessing wallets, namely BIP39 seeds.</p>

CC BY-SA 4.0
2018-09-28T10:00:50.607Z
So you're saying that it is feasible for a computer to brute-force a strong 20 characters alphanumerical/symbol password that I sha256 a million rounds?
Tedy S.
CC BY-SA 4.0
2018-09-28T10:49:18.227Z
@TedyS. yes. see [here](https://bitcointalk.org/index.php?topic=311000.msg3345309#msg3345309)
Abdussamad
CC BY-SA 4.0
2018-09-28T12:55:20.010Z
I think what the folks at bitcointalk were advising against is using a simple dictionary word that is susceptible to rainbow table-like attacks. I would imagine an attacker's chances drop substantially if the hashing is done multiple times, like I said earlier maybe a million.
Tedy S.
CC BY-SA 4.0
2018-09-28T14:34:29.250Z
https://en.bitcoin.it/wiki/Brainwallet
JBaczuk
CC BY-SA 4.0
2018-09-28T14:59:09.920Z
@TedyS. to be fair to Raghav, your original question did not mention a million rounds of hashing (so implicitly one only) and your example passphrase is composed only of simple dictionary words and commonplace abbreviations in all lower-case ASCII letters. Answerers can only answer the question you actually post, they can't anticipate how you might subsequently move the goalposts.
RedGrittyBrick
CC BY-SA 4.0
2018-09-28T15:19:53.000Z
@RedGrittyBrick that is indeed correct. And I assume one cannot simply standardise an algorithm for generating the private key from the "password" because then it would be well known for attackers as well, right? But that still does not mean I cannot generate an extremely secure one (against bruteforcing) with a custom algorithm involving multiple hashing, right?
Tedy S.
CC BY-SA 4.0
2018-09-28T15:29:02.223Z
@TedyS. In security critical code it is virtually always considered incredibly foolhardy to go against long-established and long-proven experience such as that given in the [link](https://en.bitcoin.it/wiki/Brainwallet) in JBaczuk's comment and, for example, [here](https://en.wikipedia.org/wiki/Security_through_obscurity) or [here](https://www.schneier.com/blog/archives/2011/04/schneiers_law.html). You might be right but I am not going to endorse an approach that seems long discredited. I know my limits (or think I do) - Sorry.
RedGrittyBrick
CC BY-SA 4.0
2018-09-28T15:38:53.533Z
@TedyS re *"one cannot simply standardise an algorithm for generating the private key from the 'password'"* - See https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki. A broadly accepted principle in the field of information-security is that using well-known or standardised algorithms is usually the safest, even if your enemies know which algorithm you use.
RedGrittyBrick
CC BY-SA 4.0
2018-09-28T20:02:44.247Z
@TedyS. Adding a million rounds of hashing does not actually add much entropy, and is trivial for an attacker to compute. Please heed the warnings of others here, and use well-established cryptographic techniques for generating a private key. Brainwallets are very well known as being insecure.
chytrik
CC BY-SA 4.0
2018-09-28T08:36:32.267Z
2018-09-28T08:36:32.267Z
Raghav Sood
<p>Since the private key is basically a random large number, would I be able to pick a password and have that converted into an address?</p>

<p>For example: pick "mysecretpwd". Have it sha256ed, obtain a large integer that is the private key from which I can easily derive the public key and the bitcoin address.</p>

<p>Then for spending any funds received at that address I only need to remember "mysecretpwd", no private key storage on paper, mnemonics or anything, basically the funds are stored in my brain.</p>

<p>What are the security/privacy implications?</p>

<address-generation>
Generating private key/bitcoin address based on a "password"
Tedy S.
# Generating private key/bitcoin address based on a "password"

(Asked by: username_0 on 2018-09-28)

Since the private key is basically a random large number, would I be able to pick a password and have that converted into an address?

For example: pick "mysecretpwd". Have it sha256ed, obtain a large integer that is the private key from which I can easily derive the public key and the bitcoin address.

Then for spending any funds received at that address I only need to remember "mysecretpwd", no private key storage on paper, mnemonics or anything, basically the funds are stored in my brain.

What are the security/privacy implications?

**Tags:** address-generation


---

## 1 answers

### Answer by username_1 on 2018-09-28. Score: 4 | Accepted answer

What you are describing has been done before, and is known as a "brain wallet".

In earlier days, some wallets and online website did use this system. However, it has proven quite insecure, as humans are terrible at picking secure random data for the "password", and computers are great at guessing them. Many BTC have been stolen from insecure brainwallets, and at this point we have much better and safer means of easily accessing wallets, namely BIP39 seeds.

> **Comments:**
> **username_0**: So you're saying that it is feasible for a computer to brute-force a strong 20 characters alphanumerical/symbol password that I sha256 a million rounds?  
> **username_2**: @TedyS. yes. see [here](https://bitcointalk.org/index.php?topic=311000.msg3345309#msg3345309)  
> **username_0**: I think what the folks at bitcointalk were advising against is using a simple dictionary word that is susceptible to rainbow table-like attacks. I would imagine an attacker's chances drop substantially if the hashing is done multiple times, like I said earlier maybe a million.  
> **username_3**: https://en.bitcoin.it/wiki/Brainwallet  
> **username_4**: @TedyS. to be fair to username_1, your original question did not mention a million rounds of hashing (so implicitly one only) and your example passphrase is composed only of simple dictionary words and commonplace abbreviations in all lower-case ASCII letters. Answerers can only answer the question you actually post, they can't anticipate how you might subsequently move the goalposts.  
> **username_0**: @username_4 that is indeed correct. And I assume one cannot simply standardise an algorithm for generating the private key from the "password" because then it would be well known for attackers as well, right? But that still does not mean I cannot generate an extremely secure one (against bruteforcing) with a custom algorithm involving multiple hashing, right?  
> **username_4**: @TedyS. In security critical code it is virtually always considered incredibly foolhardy to go against long-established and long-proven experience such as that given in the [link](https://en.bitcoin.it/wiki/Brainwallet) in username_3's comment and, for example, [here](https://en.wikipedia.org/wiki/Security_through_obscurity) or [here](https://www.schneier.com/blog/archives/2011/04/schneiers_law.html). You might be right but I am not going to endorse an approach that seems long discredited. I know my limits (or think I do) - Sorry.  
> **username_4**: @TedyS re *"one cannot simply standardise an algorithm for generating the private key from the 'password'"* - See https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki. A broadly accepted principle in the field of information-security is that using well-known or standardised algorithms is usually the safest, even if your enemies know which algorithm you use.  
> **username_5**: @TedyS. Adding a million rounds of hashing does not actually add much entropy, and is trivial for an attacker to compute. Please heed the warnings of others here, and use well-established cryptographic techniques for generating a private key. Brainwallets are very well known as being insecure.  

---

