Seed Phrase Entropy Calculator
Solve the BIP-39 security metric Entropy = Words · log₂(Wordlist Size) for any of its three unknowns — the total entropy in bits, the number of words, or the wordlist size — with step-by-step math, a live strength gauge, BIP-39 checksum analysis, and brute-force resistance estimates.
For BIP-39, the checksum occupies words ÷ 3 bits, and those bits are stored in the final word. Effective entropy = (words × 11) − checksum bits. BIP-39 only defines checksums for 12, 15, 18, 21 and 24 words.
Time to exhaust = 2entropy ÷ guess rate. A well-funded attacker with specialised hardware might reach 10¹² guesses per second. 10¹⁵ and above is nation-state territory. The estimate assumes the attacker knows the wordlist and word count and searches the full space — real attacks exploit weak randomness, not strong entropy.
Entropy is the size of the search space
Seed phrase entropy measures how many possible phrases exist for a given word count and wordlist. Twelve words from a 2048-word list produce 2048¹² ≈ 2¹³² possible combinations. That is not a vague sense of "randomness" — it is a precise count of how many distinct secrets an attacker would have to try before finding yours. Every additional bit doubles the attacker's work, which is why going from 128 to 256 bits does not just double security — it multiplies it by 2¹²⁸, a number roughly equal to the number of atoms in a large mountain.
Word count is the only practical lever
The wordlist size is fixed by the standard — BIP-39 uses 2048 words, which gives exactly 11 bits per word. That leaves word count as the variable you actually choose. Going from 12 words to 24 words doubles the number of words but squares the entropy: 128 bits becomes 256 bits. Going from 12 to 15 words adds only 3 words but grows entropy by 32 bits, which is a factor of four billion in the attacker's search space. The marginal cost of extra words is tiny compared to the security gain, which is why high-value wallets default to 24.
The checksum is not security, it is error detection
BIP-39 reserves a few bits in the final word as a checksum. For 12 words, 4 bits of the 132 total are checksum; for 24 words, 8 bits of the 264 total. These bits exist so a wallet can reject a mistyped phrase — if you transpose two words or mistype one, the checksum almost certainly fails. They do not add security, because an attacker who knows the wordlist and word count can simply recompute them. Effective entropy is the total minus the checksum, which is why 12 words gives 128 bits of actual entropy, not 132.
Bad randomness breaks entropy, not word count
A 24-word phrase generated by a flawed random number generator is not 256 bits of security. It is exactly as strong as the randomness behind it. Real-world wallet losses almost never come from brute-forcing strong entropy; they come from predictable RNG, from phrases generated on compromised devices, from phrases typed into phishing sites, and from phrases photographed and stored in the cloud. Theoretical entropy sets an upper bound on security. Practical security is determined by how the phrase was generated and how it is stored, not by the length of the wordlist.
How to Use This Calculator
The entropy relation links three quantities: the total entropy in bits, the number of words, and the wordlist size. Pick which one you want the tool to solve, then fill in the other two.
1. Choose what to solve for
Pick H, W, or N from the toggle. The calculator rearranges H = W · log₂(N) automatically for whichever variable you choose and greys out that field.
2. Use the BIP-39 defaults
Almost every modern seed phrase uses a 2048-word list, which gives 11 bits per word. That makes the maths trivial: 12 words = 132 bits, 24 words = 264 bits. Use the presets to jump to the standard lengths.
3. Apply the BIP-39 checksum
The total entropy is not the same as the security. Use the checksum helper to subtract words ÷ 3 bits and see the raw entropy the seed actually encodes — 128 bits for 12 words, 256 bits for 24.
4. Read the result and gauge
The result card shows the entropy in bits with a colour-coded verdict, and a gauge positions the value on a scale from weak (< 64 bits) through maximum (256+ bits).
5. Check brute-force resistance
The brute-force helper divides 2^entropy by a guess rate you control and reports the time required to exhaust the search space. At 10¹² guesses per second, 128 bits takes longer than the age of the universe — many times over.
6. Switch to Advanced for depth
Advanced mode adds a chart of entropy vs. wordlist size, a sensitivity check, and companion metrics including bits per word, effective entropy after checksum, security band, and the word count needed to hit a given target.
What This Tool Offers
Built around the BIP-39 security identity H = W · log₂(N), the count of how many possible seed phrases exist for a given word count and list size.
Three-way solving
Solve for total entropy, number of words, or wordlist size. The calculator rearranges the formula for whichever variable you choose.
BIP-39 checksum helper
Computes the checksum bits (words ÷ 3) and the effective entropy after subtracting them — so 12 words shows 132 bits total and 128 bits actual security.
Brute-force estimate
Divides 2entropy by a guess rate you control and reports the time to exhaust the search space in human-readable units.
Strength gauge & verdict
A gradient gauge from weak (< 64 bits) through maximum (256+ bits), with a live marker and a colour-coded verdict badge on the result card.
Dual comparison charts
Entropy vs. word count for three wordlist sizes, plus an advanced entropy-vs-wordlist chart for three word counts.
Reference tables
A live entropy converter, an entropy lookup grid across word counts and wordlist sizes, typical BIP-39 lengths, and a full variable reference.
Reference Tables & Conversions
A live entropy converter, an entropy lookup grid across word counts and wordlist sizes, and the standard BIP-39 lengths.
Words · wordlist · entropy converter
Entropy Lookup — Words × Bits per Word
Computed from H = W · log₂(N). Each cell shows the total entropy in bits for a given word count and wordlist size.
| Words | N=1024 (10 bits) | N=1626 (10.67) | N=2048 (11 bits) | N=4096 (12 bits) | N=8192 (13 bits) |
|---|
Standard BIP-39 Lengths
BIP-39 defines five valid word counts. The checksum is words ÷ 3 bits, stored in the final word.
| Words | Total bits | Checksum bits | Effective entropy | Combinations | Strength |
|---|---|---|---|---|---|
| 12 | 132 | 4 | 128 | ≈ 3.40 × 10³⁸ | Strong — modern minimum |
| 15 | 165 | 5 | 160 | ≈ 1.46 × 10⁴⁸ | Very strong |
| 18 | 198 | 6 | 192 | ≈ 6.28 × 10⁵⁷ | Excellent |
| 21 | 231 | 7 | 224 | ≈ 2.70 × 10⁶⁷ | Extreme |
| 24 | 264 | 8 | 256 | ≈ 1.16 × 10⁷⁷ | Maximum — hardware standard |
Variable Reference
| Symbol | Meaning | Typical range | Units |
|---|---|---|---|
| H | Total entropy | 64 – 512 | bits |
| W | Number of words | 3 – 48 | words |
| N | Wordlist size | 256 – 8192 | words |
| log₂N | Bits per word | 8 – 13 | bits |
| CS | Checksum bits (BIP-39) | W ÷ 3 | bits |
| Heff | Effective entropy | H − CS | bits |
What Does Entropy = Words · log₂(Wordlist Size) Measure?
Seed phrase entropy is the number of bits required to describe how many possible phrases exist for a given word count and wordlist size. It is not a vague feeling of randomness — it is a precise count. If a phrase has 132 bits of entropy, there are 2¹³² possible phrases, and an attacker who knows the wordlist and word count would have to try up to that many before finding yours. Each additional bit doubles the search space, which is why small changes in word count produce enormous changes in security.
Seed Phrase Entropy Formula
The defining relationship is:
Rearranged to solve for the other two unknowns:
N = 2( H ÷ W )
For BIP-39, the wordlist size is 2048, so log₂(2048) = 11 bits per word and the formula simplifies to:
The effective entropy, after the BIP-39 checksum is subtracted, is:
For 12 words: H = 132, checksum = 4, Heff = 128. For 24 words: H = 264, checksum = 8, Heff = 256.
Seed Phrase Entropy Variables
| Symbol | Meaning | Notes |
|---|---|---|
| H | Total entropy in bits | The logarithm (base 2) of the number of possible phrases |
| W | Number of words | BIP-39 allows 12, 15, 18, 21, or 24 |
| N | Wordlist size | 2048 for BIP-39; 1626 for old Electrum and Monero |
| log₂N | Bits contributed per word | 11 for 2048 words, 12 for 4096, 10 for 1024 |
| CS | Checksum bits | W ÷ 3 in BIP-39; stored in the last word |
| Heff | Effective entropy | H − CS; the actual security of the seed |
How Each Variable Affects Security
Entropy grows linearly in the number of words and logarithmically in the wordlist size. That asymmetry has a practical consequence: the easiest way to increase security is to add words, not to look for a larger wordlist. Doubling the wordlist size adds only one bit per word. Adding one word adds log₂(N) bits — 11 bits for a BIP-39 list. To match the security gain of one extra word, you would need to increase the wordlist by a factor of 2048.
Because entropy is exponential in word count, the strength of a phrase does not scale the way intuition suggests. Twelve words gives 128 bits. Twenty-four words gives 256 bits. That is not double the security — it is 2¹²⁸ times the security, which is such a vast number that the difference between 128 and 256 bits is essentially unbridgeable for any attacker with finite resources. Both are strong. The reason to prefer 24 words is not that 128 bits is inadequate — it is that entropy is an upper bound, and real-world implementations often leak bits through bad randomness, so having headroom is cheap insurance.
The checksum bits are often overlooked. In BIP-39, one out of every 2CS random word sequences is a valid phrase, which means a phrase with a broken checksum can be detected and rejected by any compliant wallet. That is a usability feature, not a security feature — an attacker who knows the last word's checksum algorithm can simply recompute it. So the security of a seed phrase should always be quoted as effective entropy, not total bits. Twelve words is a 128-bit seed. Twenty-four words is a 256-bit seed. Those are the numbers that matter.
Seed Phrase Entropy Calculation Examples
log₂(2048) = 11 bits per word
H = 12 × 11 = 132 bits total
Effective: 132 − (12 ÷ 3) = 128 bits
H = 24 × 11 = 264 bits total
Effective: 264 − (24 ÷ 3) = 256 bits
W = 128 ÷ 11 = 11.64 → 12 words (rounded up to the nearest valid BIP-39 length)
12 words
N = 2^(132 ÷ 12) = 2^11 = 2048 words
This is exactly the BIP-39 list size
Combinations = 2¹³² ≈ 5.44 × 10³⁹
Time = 5.44 × 10³⁹ ÷ 10¹² = 5.44 × 10²⁷ seconds
≈ 1.72 × 10²⁰ years — over 10 billion times the age of the universe
Frequently Asked Questions
A 12-word BIP-39 seed phrase has 132 bits of total entropy, of which 4 bits are checksum and 128 bits are actual entropy. The 128-bit figure is the one that matters for security, because an attacker who knows the wordlist and word count can recompute the checksum. 128 bits is the modern minimum for a secure seed phrase and is considered computationally infeasible to brute force — the search space contains roughly 3.4 × 10³⁸ combinations, and even at a trillion guesses per second an attacker would need longer than the age of the universe to exhaust it.
Yes, but the difference is far larger than most people assume and also far less practically relevant. Twelve words gives 128 bits of entropy; twenty-four gives 256 bits. That is not double the security — it is 2¹²⁸ times the security, a number larger than the count of atoms in the observable universe divided by a comfortable margin. Both are utterly infeasible to brute force with any foreseeable technology. The reason to prefer 24 words is not that 128 bits is weak, but that entropy is an upper bound on security and real-world implementations often leak bits through imperfect randomness. Extra headroom costs nothing and protects against implementation flaws.
The BIP-39 checksum is a small number of bits appended to the entropy and encoded into the final word of the phrase. Its purpose is error detection, not security. If you mistype one word of a seed phrase, the checksum will almost certainly fail and a compliant wallet will reject the phrase instead of deriving a different wallet. The checksum size is words ÷ 3 bits: 4 bits for 12 words, 5 for 15, 6 for 18, 7 for 21, and 8 for 24. Because the algorithm is public, an attacker who knows the wordlist and word count can recompute the checksum trivially, so the bits add no cryptographic strength. Effective entropy is always total entropy minus checksum bits.
2048 is a power of two, so each word contributes exactly 11 bits of entropy with no remainder. That makes encoding and decoding clean — the entropy bits are divided into 11-bit chunks, each of which indexes a word in the list. A larger list would give more bits per word, but the gain is logarithmic: doubling the list from 2048 to 4096 adds only one bit per word. At the same time, a larger list makes phrases harder to write down, harder to verify, and more prone to transcription errors. BIP-39 also standardises the first four letters of each word as unique, so the phrase can be entered unambiguously with only four letters per word. 2048 is a deliberate trade-off between security per word and human usability.
Generally yes, but the difference is in generation quality, not in word count. A hardware wallet generates entropy from a dedicated hardware random number generator, which is designed to be resistant to tampering and to produce unpredictable output. Software wallets rely on the host operating system's RNG, which is usually strong but can be compromised by malware. The word count and wordlist are the same — a 24-word BIP-39 phrase is 256 bits whether it came from a hardware wallet or a browser extension. The difference is that if the RNG was flawed, the nominal 256 bits may in reality be far fewer. Hardware wallets reduce that risk.
No amount of entropy is "too high" from a security standpoint, but there are diminishing returns. Past about 128 bits, brute force is no longer the threat model — the practical risks become phishing, malware, physical theft, coercion, and loss. Twenty-four words is not overkill; it is cheap insurance against flaws in the entropy source. The real argument for 12 words is convenience: 12 words fit on a single stamped metal plate, are faster to write down and verify, and are easier to memorise. Twelve words is plenty for most users. Twenty-four is appropriate for high-value wallets, institutional custody, and anyone who would rather have margin against the unknown.
No. Entropy is an upper bound on security, not a guarantee. A 256-bit phrase is only 256 bits strong if the randomness used to generate it was truly random, if it was generated on a trustworthy device, if it was never photographed or transmitted digitally, and if it is stored somewhere an attacker cannot access it. In practice, seed phrase losses are overwhelmingly caused by compromised RNGs, phishing, screenshots, cloud backups, and social engineering — not by brute force. The maths is the easy part. Protecting the phrase after it exists is where most failures happen.
Variables
| Symbol | Quantity | Unit |
|---|---|---|
| Entropy | Seed phrase entropy | bits |
| Number of Words | Number of words in the seed phrase | |
| Wordlist Size | Size of the standard wordlist (BIP-39 = 2048) |
What it means
Seed phrases (mnemonic) are used to generate private keys. The entropy is the number of possible combinations. For BIP‑39, a 12‑word phrase from a 2048‑word list gives 128 bits of entropy. This is used to evaluate the security of a wallet. Understanding entropy helps users choose secure seed lengths and to avoid insecure wallets.
Worked example
Seed Phrase Entropy – Two Detailed Examples
Real‑World| Parameter | Value |
|---|---|
| Word Count | 12 |
| Wordlist Size | 2048 |
| Parameter | Value |
|---|---|
| Words | 24 |
| Wordlist | 2048 |
Common mistakes
- Seed phrase entropy: Number of words × log₂(wordlist size).
- BIP‑39: Standard wordlist size is 2048 (2^11).
- Entropy: 12 words ≈ 128 bits; 24 words ≈ 256 bits.
- Security: Higher entropy means stronger protection.
Applications
Seed phrase entropy measures the security strength of a recovery seed phrase by multiplying the number of words by the log₂ of the wordlist size. This indicates the number of possible combinations and the difficulty of brute‑forcing. Higher entropy means stronger security. Users and wallet providers use this to assess the safety of their seed phrases. Understanding entropy is crucial for wallet security.
- Assessing the security of a seed phrase
- Choosing the appropriate number of words (12, 24)
- Understanding the risk of brute‑force attacks
- Security education for crypto users
- Educational understanding of cryptographic entropy
Related calculators · Wallet, Security & Tax
Recently updated formulas
Suggest an improvement
Found a mistake? Have a better example? Let us know.
You may send up to 3 suggestions per 24 hours.