Is 12-word seed phrase (as used by Electrum for example) safe enough for generating an offline wallet?

My understanding is this: 2048 words pool make 11 bits of entrophy per word. 12 words in seed make total 132 bits of entrophy.

Is this considered safe enough?

I'm not talking about being quantum-computing-resistent, just being infeasible to crack using brute force given the expected computing power in the foreseeable future.


128 bits is generally considered more than enough -- 132 bits is certainly sufficient.


Is this considered safe enough?

Nothing is "safe enough" if we do not know the cost.

OK, if you have $100k in bitcoins the 12-words phrase is safe enough.

If the 12-words phrase is the seed to the "Method of destroying the Universe" I would recommend to add at least 11 bits of entropy and use 13 words.

  • So let's say I have $100k. Can you explain why this is considered safe? – shx2 Jul 10 '15 at 12:00
  • Because the attacker have to spend much more funds to bruteforce your key. Nobody will attack you. – amaclin Jul 10 '15 at 14:43
  • 13
    To put exhaustive searches into perspective, the Bitcoin network to date has done approximately 83 bits of work. This is with hundreds millions of dollars worth of investment, likely millions of ASIC chips produced, and currently over 150 megawatt of power expenditure. – Anonymous Jul 10 '15 at 17:05
  • @Bitcoin your comment is the answer I was looking for. Thanks. – shx2 Aug 9 '16 at 2:40

In short: 12-word seed has enough entropy to be safe against brute force attack.

First of all not all 132 bits are random. Seed uses some kind of control sum.

Lets talk about 128 bits of entropy.

Lets imaging the following attack:

We will take one billion (10^9) of the most powerful mining hardware in 2017 (13 TH/s each). We will make a 1000 years brute force attack to compromise any of existing billion (10^9) of wallets with coins inside.

This attack will check the following number of seed combinations:

10^9 * (13 * 10^12) * (1000 * 365 * 24 * 3600) = ~ 10^33 combinations checked

128 bits of entropy equals ~ 10^38 total combinations

It means the given attack has the following chance of breaking one of more of 10^9 wallets:

1/10^5 = 0.001%

P.S. Don't forget it is an extra complicated task to find out if this or that seed contains any money. Hash mining hardware has much more simple task. We don't have hardware to check seeds at the same rate as modern ASICs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.