I reading that 'humans are bad at randomness' and one should always let an algorithm choose your seed for you.

While I agree that maybe it's not advised to make my brain wallet 'zoo' x 23 + checksum as an easy to remember phrase, but besides the obvious, what real risks are there to choosing your own seed?

I've also read that if you use the date as your seed's seed (akward phrase, the seed of the random function that my nmemonic seed is created from) then if that is known by an attacker they can use that to crack my wallet really easily.

What else could go wrong? for instance if i decide to use all the food words out the list, but change 1 of those to an easy to remember alternative, then I've a bunch of food words and one randomly out of place non-food word (seams ok to me). Are there brute force algorithms that could take advantage of that?


The BIP39 word list consists of 2048 words.

For a regular, 24 word mnemonic, you have: 2048^23 ways to arrange the non checksummed words. At 1 trillion combinations per second, this would take you ≈ 3.3×10^46 times the age of the universe to compute, even before you bother checking the checksum options.

Now, let's say that out of these 2048 words, 500 are food items (this is an illustrative example, I haven't actually counted them). Now, your combinations are some combination of 22 items (possibly repeating) from those 500, plus a random word from the 2048.

This evaluates as 500^22 * 2048 * 21. At 1 trillion combinations per second, this would take you ≈ 2.4×10^46 times the age of the universe to compute. While this is still an extremely large number, it is still nearly 30% less than the initial case, which is a non-trivial loss of entropy.

Moreover, if an attacker is able to discover even a few words from your mnemonic (maybe a friend peaked at it while visiting, or you entered a fragment into a scammy wallet before catching on, or any number of other scenarios), your possible combinations go down extremely fast. Even a perceived small loss of entropy can mean the difference between being brute forceable after 6 known words and being brute forceable after 19 known words.

In 2019, with access to reliable entropy generation in nearly every device, it is simply not worth it to attempt to come up with convoluted schemes.

  • I get the reduction in entropy, but in the 'food items' example, obviously an already extreme example, but even in that case, the attacker would have to have the knowledge that I've chosen food items, which they presumably do not, but working on the presumption that that knowledge will never become available, what are the risks? Great answer but still kinda not the answer i was looking for. – Ninjanoel Oct 29 '19 at 13:40
  • 2
    @Ninjanoel The answer is that you simply cannot reason about how secure or insecure it is. You should assume an attacker has knowledge of the process you used to come up with the phrase; not because they certainly will, but because you need to protect against the worst case. You cannot eatimate how random something is you came up with yourself Nobody can; humans are just terrible at this. – Pieter Wuille Oct 29 '19 at 16:28
  • Ahhhh, I know what you saying but huge parts of me still wanna argue!! lol. Like, if I told you my process was the same as rolling a die three times and choosing the word that best "continues the story", so I'm left with a random but human readable "cards against humanity" style story that's easy to remember. Ignoring the risk of someone else seeing my phrase, have I got something that is easier to brute force than computer randomness? Again, I agree with most of your answer – Ninjanoel Oct 29 '19 at 19:57
  • You have something that is absolutely massively easier to guess than brute force. Whether it is so much easier as to make attacking easy I cannot tell you. – Pieter Wuille Oct 31 '19 at 0:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.