Is 12-word seed phrase (as used by Electrum for example) safe enough for generating an offline wallet?

My understanding is this: 2048 words pool make 11 bits of entrophy per word. 12 words in seed make total 132 bits of entrophy.

Is this considered safe enough?

I'm not talking about being quantum-computing-resistent, just being infeasible to crack using brute force given the expected computing power in the foreseeable future.

4 Answers 4


128 bits is generally considered more than enough -- 132 bits is certainly sufficient.


Is this considered safe enough?

Nothing is "safe enough" if we do not know the cost.

OK, if you have $100k in bitcoins the 12-words phrase is safe enough.

If the 12-words phrase is the seed to the "Method of destroying the Universe" I would recommend to add at least 11 bits of entropy and use 13 words.

  • 1
    So let's say I have $100k. Can you explain why this is considered safe?
    – shx2
    Commented Jul 10, 2015 at 12:00
  • 4
    Because the attacker have to spend much more funds to bruteforce your key. Nobody will attack you.
    – amaclin
    Commented Jul 10, 2015 at 14:43
  • 23
    To put exhaustive searches into perspective, the Bitcoin network to date has done approximately 83 bits of work. This is with hundreds millions of dollars worth of investment, likely millions of ASIC chips produced, and currently over 150 megawatt of power expenditure.
    – Claris
    Commented Jul 10, 2015 at 17:05
  • 1
    @Bitcoin your comment is the answer I was looking for. Thanks.
    – shx2
    Commented Aug 9, 2016 at 2:40
  • 1
    +1 damnit, i already posted the method for destroying the universe to the Bitcoin chain at 128 bit. we'll see. Commented Mar 10, 2021 at 20:33

In short: 12-word seed has enough entropy to be safe against brute force attack.

First of all not all 132 bits are random. Seed uses some kind of control sum.

Lets talk about 128 bits of entropy.

Lets imagine the following attack:

We will take one billion (10^9) of the most powerful mining hardware in 2017 (ASIC with 13 TH/s each). We will make a 1000 years brute force attack to compromise any of existing billion (10^9) of wallets with coins inside.

This attack will check the following number of seed combinations:

10^9 * (13 * 10^12) * (1000 * 365 * 24 * 3600) = ~ 10^33 combinations checked

128 bits of entropy equals ~ 10^38 total combinations

It means the attack will totally check 1/10^(38-33) = 0.001% of all existing 128-bit seeds.

And approximately 10K of wallets would be compromised out of 10E9 existing wallets.

P.S. Don't forget it is an extra complicated task to find out if this or that seed contains any money. Hash mining hardware has much more simple task. We don't have hardware to check seeds at the same rate as modern ASICs checking their hash function results. And it seems impossible to build hardware with same efficiency as ASICs because each seed phrase check will need to access a huge database with all exising wallet addresses. We cannot put too many copies of this database on chip. And we cannot implement too many parallel accesses to a single memory cell.

P.P.S. If you are paranoid - you can use 18 or 24 work seed phrase.

  • well, the attack would actually have to attack private/public keys, which is at least 1000x slower than hashing. but close. Commented Mar 10, 2021 at 20:34
  • 1
    Well worded answer. I think you are missing an additional point which would produce even more entropy, please correct me if I am wrong. Even with a seed phrase, you still need the derivation path to determine wallet addresses AND there can be different schemas, 4294967296 accounts, and 4294967296 addresses in each account.
    – Scott
    Commented May 4, 2023 at 15:23
  • Said another way... even if you got "lucky" matching with someone else's seed phrase, you still wouldn't know if that seed phrase could lead to a wallet address with coins on it.
    – Scott
    Commented May 4, 2023 at 15:24
  • You are generally right. But most of the software support only one single derivation path. And people rarely change it if it is possible.
    – Sergey
    Commented May 6, 2023 at 6:23
  • Afaik 4.29E9 different account inside of the schema does protect you from finding your actual wallets when someone got your seed phrase and derivation path, but they allow you to use multi-address wallet for very long period without reusing addresses to increase anonymity.
    – Sergey
    Commented May 6, 2023 at 6:29

The security in bits of a 12-word mnemonic that has a valid checksum as per BIP39 is not 132 bits, but rather 128 bits, as the last 4 bits are determined based on the first 128 bits - the initial "entropy".

  • Even though the range of 2^132 of all possible mnemonics is 16 times larger than 2^128 (where (2^128)*16 = 2^132), the checksum cannot be predicted unless an attacker can break SHA256, as the checksum is computed based on the hash digest of the leading 128 bits formatted as a byte array.

So the idea with the checksum was to slow an attacker from searching through all possible 12-word mnemonics of which there are 2^132 of them, even though the number of valid ones is 2^128 in terms of a valid checksum (as if reducing the strength from 12 words to 11.6363636364 words, since the checksum completes part of the last word), as an attacker would have to run the SHA256 algorithm each time which will slow their brute-force search.

  • Therefore, while 2048^12 = 2^132, the checksum means that the range of checksum-valid mnemonics is 2048^11.6363636364 == 2^128.

In summary, I think a mnemonic with a valid checksum would be more safe than one without a checksum, on the basis that it's probably less likely for SHA256 to be cracked anytime soon which would otherwise speed a potential brute-force search of all mnemonics.

  • This means an attacker still needs to search in the range of 2^132 in order to find one of the 2^128 valid ones (i.e. there is no way to only search the range of valid ones, unless SHA256 is broken).

Note: If you wanted to square your security (i.e. raise it to the power of 2), a 24-word mnemonic which represents 264 bits (minus an 8-bit checksum) would be the square of two 12-word mnemonics in terms of bit security as 2^128*2^128 == 2^256.

Such a huge leap in security could help protect a user later from Grover's algorithm running on a fast-enough quantum computer which could perform such an n-time brute-force search in the "square of n-time", compared classical computers requiring n-time.

From: https://en.wikipedia.org/wiki/Grover%27s_algorithm:

Grover's algorithm could brute-force a 128-bit symmetric cryptographic key in roughly 2^64 iterations or a 256-bit key in roughly 2^128 iterations.`

In other words, a 12-word mnemonic would have its security reduced to 64 bits (considered unsafe) in terms of classical computer security, while a 24-word mnemonic would only reduce to 128 bits in the same scenario.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.