Lets say you have a 24 word seed bitcoin wallet.

And then you add a password that's 96 characters long. Does that make it twice as hard to geuss?

Is this new private/public key generated completely unique to one that might be generated only via using 12/18/24 keywords? or is it possible to get the same public/private address via a 24 keyword seed & a 24 keyword seed w/ a 25th word password

2 Answers 2


Mastering Bitcoin. A highly recommended read if you want to have a deep dive.

Generating mnemonic words

  1. Create a random sequence (entropy) of 128 to 256 bits.
  2. Create a checksum of the random sequence by taking the first (entropy- length/32) bits of its SHA256 hash.
  3. Add the checksum to the end of the random sequence.
  4. Divide the sequence into sections of 11 bits.
  5. Map each 11-bit value to a word from the predefined dictionary of 2048 words.
  6. The mnemonic code is the sequence of words.

The mnemonic words represent entropy with a length of 128 to 256 bits. The entropy is then used to derive a longer (512-bit) seed through the use of the key-stretching function PBKDF2. The seed produced is then used to build a deterministic wallet and derive its keys.

The key-stretching function takes two parameters: the mnemonic and a salt. The pur. pose of a salt in a key-stretching function is to make it difficult to build a lookup table enabling a brute-force attack. In the BIP-39 standard, the salt has another purpose-it allows the introduction of a passphrase that serves as an additional security factor protecting the seed, as we will describe in more detail in "Optional passphrase in BIP-39" on page 104.

  1. The first parameter to the PBKDF2 key-stretching function is the mnemonic pro- duced from step 6.
  2. The second parameter to the PBKDF2 key-stretching function is a salt. The salt is composed of the string constant "nnemonic" concatenated with an optional user- supplied passphrase string.
  3. PBKDF2 stretches the mnemonic and salt parameters using 2048 rounds of hash- ing with the HMAC-SHA512 algorithm, producing a 512-bit value as its final output. That 512-bit value is the seed.

The key-stretching function, with its 2048 rounds of hashing, is a very effective protection against brute-force attacks against the mnemonic or the passphrase. It makes it extremely costly (in com- putation) to try more than a few thousand passphrase and mnemonic combinations, while the number of possible derived seeds is vast (2512).

Optional passphrase in BIP-39 The BIP-39 standard allows the use of an optional passphrase in the derivation of the seed. If no passphrase is used, the mnemonic is stretched with a salt consisting of the constant string "mnemonic", producing a specific 512-bit seed from any given mnemonic. If a passphrase is used, the stretching function produces a different seed from that same mnemonic. In fact, given a single mnemonic, every possible pass- phrase leads to a different seed. Essentially, there is no "wrong" passphrase. All pass- phrases are valid and they all lead to different seeds, forming a vast set of possible uninitialized wallets. The set of possible wallets is so large (2512) that there is no prac- tical possibility of brute-forcing or accidentally guessing one that is in use.

The optional passphrase creates two important features: • A second factor (something memorized) that makes a mnemonic useless on its own, protecting mnemonic backups from compromise by a thief. A form of plausible deniability or "duress wallet," where a chosen passphrase leads to a wallet with a small amount of funds used to distract an attacker from the "real" wallet that contains the majority of funds. However, it is important to note that the use of a passphrase also introduces the risk ofloss: . If the wallet owner is incapacitated or dead and no one else knows the pass- phrase, the seed is useless and all the funds stored in the wallet are lost forever. Conversely, if the owner backs up the passphrase in the same place as the seed, it defeats the purpose of a second factor. While passphrases are very useful, they should only be used in combination with a carefully planned process for backup and recovery, considering the possibility of sur- viving the owner and allowing his or her family to recover the cryptocurrency estate.

Summary: From what I understand it doesn’t make it any easier or harder to “brute-force” your wallet. The real purpose of the 25th phrase is to protect your 12/24 word seed phrase from those who get access to it.

Edit: To correct myself - whether or not 25th word (salt) makes it more difficult to brute-force your wallet depends on the technique the hackers use to do it. Practically impossible anyways. But it's a good idea to add this word if you are sure you can mitigate the risks associated with keeping it safe and accessible by you or your loved ones when needed.


Adding a passphrase to a seed phrase does make it harder to guess the combination but that isn't really relevant. The seed phrase alone is hard enough.

I think people would add a paraphrase for plausible deniability or similar reasons. For example you could create several wallets with the same seed phrase, one with no passphrase and at least one with a passphrase. Then put a plausible amount of money into the first wallet and build up some plausible history there.

The other part of your question rests on the ratio of the range of possible outputs to the bits of entropy fed to the prng. You need a mathematician to answer that with precision. I suspect that the coverage is a statistical process and so coverage will increase quickly at first and drop off. Whether the coverage converges to a set of results that is smaller in size than the full set from the expected output range is a question for a mathematician. Maybe one will answer. Maybe there's a maths stackexchange?

My mathematically worthless intuition suggests to me that the answer is yes, there is overlap in the reachable results with vs without passphrase.

  • Yeah, im no mathematician either but i assume there must be some overlap since as far as I can tell the 25th password doesn't have a limit....or if it does, it's very large. Mar 24 at 3:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.