Recovery Phrase Entropy from Word Count

Because 11.0 is the theoretical maximum and real-world phrases rarely achieve it. The BIP-39 wordlist has exactly 2,048 entries, and log₂(2048) = 11.0, so each word drawn uniformly from that list contributes exactly 11 bits. But three things eat into that. First, the checksum: BIP-39 appends 4 to 8 bits of checksum, and the total bit string must divide evenly into 11-bit indices, so the last word is partly determined by the preceding ones. For 12 words that gives 128 bits of entropy across 12 words — 10.67 effective bits per word, not 11.0. Second, wallet RNG is not perfectly uniform; implementations have shipped with entropy bugs more than once. Third, users sometimes intervene in the generation process, which further reduces entropy. The 10.3 figure is a deliberately conservative estimate that leaves margin for all three. If you want to see the nominal figure, switch the preset to 11.0; the tool will show you how much the answer changes.

This is the single most dangerous mistake in seed-phrase security. A phrase you invent carries far less entropy than its word count suggests, because you are not a uniform random source. Your choices are shaped by your vocabulary, your interests, the books you have read, and the phrases that happen to feel memorable — and attacker wordlists are built from exactly those biases. Research on password cracking shows that human-chosen sequences typically carry only 2–5 bits of effective entropy per word rather than 11. A twelve-word phrase you composed yourself might carry 30 bits instead of 128, which an attacker with a good dictionary and a trillion guesses per second can exhaust in minutes. Always let the wallet's hardware random number generator produce the phrase. Never edit it, never reorder it, never substitute a word you like better.

Longer than the universe has existed, by a very large margin. A 12-word BIP-39 phrase has 2¹²⁸ ≈ 3.4 × 10³⁸ possible combinations. A well-funded attacker with custom silicon might manage 10¹² guesses per second against a single target. Dividing gives 3.4 × 10²⁶ seconds, which is about 10¹⁹ years. The universe is roughly 1.4 × 10¹⁰ years old, so the search would take about a billion times the current age of the universe. Even at an absurd 10¹⁸ guesses per second — a rate no real system achieves — the answer is still 10¹³ years, roughly a thousand times the age of the universe. The numbers only become tractable below about 80 bits, and they become genuinely alarming below about 60 bits: 64 bits at 10¹² guesses per second is about six months, and 50 bits is about thirteen days. That is the cliff.

Neither, strictly speaking — it is an error-detection mechanism, not a security mechanism, and it slightly reduces the effective bits per word. BIP-39 appends 4 bits of checksum to a 128-bit entropy value for 12-word phrases, 5 bits for 15 words, and so on up to 8 bits for 24 words. The checksum lets a wallet detect a mistyped or misremembered word immediately, which is genuinely valuable for usability and prevents funds being sent to an address derived from a corrupted seed. But it does not add entropy: the checksum is fully determined by the entropy, so an attacker who guesses the entropy automatically gets the checksum right. The practical effect is that a 12-word phrase has 128 bits of entropy packed into 132 bits of encoded data, giving 10.67 effective bits per word rather than 11.0. That is the only sense in which the checksum "costs" anything.

Modern practice treats 128 bits as the floor for anything holding real value, and 256 bits as the ceiling worth bothering with. Below 128 bits you are still in territory where a sufficiently determined and well-resourced attacker — a nation-state, or a well-funded group with custom ASICs — could plausibly mount a search, especially if the target is known to be valuable. Between 80 and 100 bits is the legacy zone: it was the standard in the 1990s and early 2000s, and it is no longer considered adequate for long-lived secrets. Below 64 bits, a well-equipped attacker finishes in days to months, and below 40 bits it is a matter of hours or minutes. The reason 128 bits is the floor rather than, say, 100 is margin: you want the secret to remain safe for decades even if cryptanalysis advances, even if the generation had a flaw, and even if the attacker is far better resourced than anything we can currently imagine.

Because brute-forcing the entropy is not how anyone loses crypto. Every real-world seed-phrase theft comes from a leak, not a crack. The common failure modes: photographing the written phrase and having the photo sync to iCloud or Google Photos; typing the phrase into a phishing site that mimics a wallet restore screen; storing it in a notes app, a cloud document, or a password manager that is later breached; entering it on a compromised computer infected with a keylogger; saying it aloud near a smart speaker or on a phone call; writing it on paper that is then photographed, thrown away, or found by someone in the house; and generating it on a device with a compromised or poorly implemented random number generator. The entropy calculation tells you the phrase is uncrackable. It says nothing about whether you will hand it to someone. Treat the phrase as the single most sensitive secret you will ever hold, and assume that anything connected to the internet can and will be copied.

Only if the additional words are also drawn from the uniform random source. A 24-word phrase generated properly has 256 bits and is stronger than a 12-word phrase. A 24-word phrase where the last twelve words were chosen by a human carries no more effective entropy than a 12-word phrase plus twelve near-certain guesses — the attacker simply tries the human-chosen portion first, because dictionaries of common phrases are small. The same logic applies to any scheme where part of the phrase is derived from a passphrase, a PIN, or a pattern: the entropy of the whole is only as large as the weakest component, and a four-digit PIN adds at most 13.3 bits regardless of how long the rest of the phrase is. Length is a proxy for entropy, not a substitute for it.