So, we all know that seed phrases are made up of specific words and they're not just random. The BIP39 wordlist has 2048 words and each one actually means something. The last word in the seed is used to create a checksum to make sure everything checks out. And since the list of words isn't endless, that gives us a set limit to work with.
Here’s my question: is it really possible to brute-force a seed phrase if you had a ton of computing power? Like if you had access to a super or quantum computer.
I'm not talking about finding a lost wallet or figuring out missing words. I know there are Python tools like btcrecover that help with those situations. I'm more interested in the idea of picking completely random words from the BIP39 list, running some tools and algorithms, and seeing if you could create a valid existing seed (whether it has funds or not doesn't matter).
I realize this might sound like a silly question, and you might be wondering why I'm even asking. I came across videos on platforms like YouTube and Facebook that showed tools attempting to brute-force seeds, using thousands of combinations (I didn’t save the video link). I get that it could be fake, but is there any real technical reasoning behind this?
One more quick question: why does BIP39 only have 2048 words to begin with? Is there some mathematical or logical reasoning for that?
I'm not a hacker or anything sketchy, just someone who's curious and looking to learn.
Move thread to bitcoin support Board.
Here is o_e_l_e_o explanation on the topic, this means for 24 words we will probably be looking at billions of years to come.
Because it doesnt matter as long it is a 12 word seed phrase the entropy will remain 128 bits and 256 bits if it is a 24 word seed phrase and the entropy is actually what determines the security or randomness of the word not how many they seems to be. Here is also a thread explained by o_e_l_e_o on it
The checksum isn't the last word.
In a 12 word seed phrase, the checksum is the last 4 bits and in a 24 word seed phrase, the checksum is the last 8 bits.
A 12 word BIP39 seed phrase provides 128 bits of security and is secure enough.
It's possible to pick random words from the BIP39 wordlist and have a valid seed phrase, but it's not possible that the seed phrase has been already generated by someone else before.
As I said, a 12 word BIP39 seed phrase provides enough entropy.
Take note that it's not a secure way to generate a seed phrase by selecting words. The correct way is to generate a random entropy and then encode that to a seed phrase.
Moved...
I know it's not wise to choose our own seed words. Just like today, I was also curious about choosing my own seed words. That why I created a thread in the past and got that answer. Can we choose our own seed words?
If you want to scale security, forget about words and seed phrases. A seed phrase is an encoding of a 256 bit entropy. That means there can be 2^256 different seeds. Here's a great video that demonstrates how big that is: https://piped.video/watch?v=S9JGmA5_unY.
Nobody is going to randomly brute force seed phrases, unless they're nuts. In fact, a private key can be cracked more easily as the public key cryptography used in Bitcoin provides 128 bit security.
Note that he's talking about brute forcing by knowing which words are used but not the order of them. If you don't know the 24 used words, then you'll have to choose among 2048, which raises the time exponentially.
If your whole point is if someone can guess your seed phrase then it's possible so if you are afraid about your wallet you can manually add an extra word/passphrase on BIP39 wallet to encrypt your seed phrase even if they know your seed phrase they can't still able to access your wallet without the extra word/passphrase.
Here's the small answer
Because the entropy (plus checksum) where the mnemonic seed is based from is sorted per 11-bits, each of those 11-bit part corresponds to a word.
Then the reason for "2048" is because that is the limit that an 11-bit number can do, from 00000000000 (0 in decimal) to 11111111111 (2047 in decimal)
This is where your assumption takes the wrong path. It doesn't matter that the words are not random, the words are only used as a human readable interpretation of a very large random number. So, the number is random, and you use common words to avoid mistakes writing it down.
My take on brute-forcing: try it!
So those seed phrase are not real numbers, I mean, of course, they are in human readable form but in computer sight, they are in bits. Wait a second are you talking about these stream of bits.
Well, I just watched the video preferred by the BlackHatCoiner and it was really awesome and convincing, although, I am getting used to forget things, but I did knew about bits before. Just your statement reminds me of it. Thanks for it.
Overall, I am also having similar thoughts, and wanted to ask about it, but did not had the time to search about it on my own, but due to this thread, I don't have to spend time. But nobody gave the answer to the question of why the number of words are limited to 2048, or anyone have already gave!
Saw that video. Man, that's a lot of numbers. Not just lots, a lot!!! I imagine there is no word in this world to quantify this amount of numbers. I get it. Basically the point is that, it will take forever.
They are 2048, because that is 2^11. This means that for every 11 bits you can represent a word. Say that a seed phrase is 128 bits long, which is 12 words long. If you extend these 128 bits to something divisible by 11 (i.e., 132 which is the point of 4 bits checksum), you can represent any seed in a sequence of 132 / 11 = 12 words.
As the video demonstrates, there are just not that many resources to begin with. But, note that the 128-bit security is much less than the 256-bit.
It's a pretty close example for the maximum combinations that a 2048 words can do but that images is mostly used to explain the Bitcoin private key range of 256bits.
My post is mostly about the reason for having only 2048 words.
Just two posts above yours.
I think I did a pretty good explanation and example to make 2^11 which represents each word understandable even for beginners.
Was it because of the last possible number is 2047, Yes?
If you count "00000000000" in which is counted, that'll be a total of 2048 words.
As pointed out by BHC above, these calculations are for unscrambling known words. While this is possible for a 12 word seed phrase, unscrambling a 24 word seed phrase even when you know all 24 words is impossible. Brute forcing a 24 word seed phrase from scratch is several trillion trillion trillion trillion times harder than that.
Passphrases do not encrypt seed phrases. They are used as a salt in the HMAC-SHA512 function which turns your seed phrase in to your master keys.
Additionally, to differentiate the two and for others to better understand of the term "encrypt":
With encryption, the original data can be recreated from the secret and the encrypted data.PBKDF2 functions like HMAC, however is a "one-way" function, there's no going back from 'seed' to 'seed phrase'.
Think about it this way, why can't we brute force a base58 encoded private key aka a WIF? After all each character in a WIF is selected from a list of only 58 characters which is smaller than 2048! That's because we don't select chars from the 58 char long list, base58 is just an encoding and the security comes from the size of the data or the entropy it is encoding.
BIP39 is exactly the same. We don't select works from a small list of 2048 words, we are encoding a much bigger data/entropy that is not possible to brute force.
Checksums in most algorithms including BIP39 are there to ensure data integrity not validation. In other words it ensures that the words you entered don't contain a mistake like wrong word or wrong order.
Yes.
For a simple explanation of how seed phrases and passphrases are combined in your wallet, take a look at the following links:
https://github.com/bitcoinbook/bitcoinbook/blob/develop/ch05.asciidoc#from-mnemonic-to-seed
https://learnmeabitcoin.com/technical/mnemonic#mnemonic-to-seed
If you want a more complex explanation of how PBKDF2 works and the role of the salt in the calculation, then see here:
https://datatracker.ietf.org/doc/html/rfc2898#section-5.2
Why not have a seed with a passphrase.
MNEMONIC SEED = WALLET A
MNEMONIC SEED AND PASSPHRASE= WALLET B
Wallet A would be the bitcoin addresses that would show if ever brute forced.
I would place a few Sats in it so in case Wallet A is ever brute forced open and swept
then I would have ample enough time to remove any BTC from wallet B...HOPEFULLY.
The question is, Wallet B is a hidden wallet...so even if someone stole your seed they
will not be aware of Wallet B.
Got it! I have been reading a lot lately. Not that I understood all of it, but I'm digesting in bit by bit.
Hey, that's a good idea. I actually never though it like that. It might be worth the try. I'll try to keep that in mind.
I never knew that. All I though was those words were selected randomly to complete 2048 word list. Who knew they were something like a disguise of large numbers.