r/Bitcoin: how much extra security a passphrase adds
reddit-passphrase-extra-security
https://www.reddit.com/r/Bitcoin/comments/1ve8xf0/how_much_extra_security_from_a_passphrase/
Latest reviewed change
source content difference between and
A comment linking to a diceware passphrase generator was removed from the thread.
If it's 26 full random characters (ex. 4#f5q$*2P@![/1iv0$3'7:Az?) then this shit is literally impregnable. Stronger than a standard BIP39 12 word seed-phrase.
-comment: p1fm0dp
-parent: t3_1ve8xf0
-author: Keefryan
-created_utc: 1785759450
-edited: false
First lines only. The complete diff is in the timeline below.
- Organisation
- Evidence role
- Community discussion
- Published
- not established
- Source changes
- 3
- Detected differences
- 3
- Unreviewed
- 0
- Copies held
- 4
Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked .
Also held inside a captured conversation
This post is held twice: here, with this project's own note on why it matters, and again as part of the conversation captured at , which is polled for changes. Both copies are the same post; neither is a separate event.
Public privacy boundary
Snapshot and diff bodies for this chain monitor are held in the local evidence archive but withheld from the public site because they can contain the addresses of people who published nothing themselves. Capture times and reviewed change summaries remain available below.
Held captures
-
A comment linking to a diceware passphrase generator was removed from the thread.
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 8 lines
If it's 26 full random characters (ex. 4#f5q$*2P@![/1iv0$3'7:Az?) then this shit is literally impregnable. Stronger than a standard BIP39 12 word seed-phrase. -comment: p1fm0dp -parent: t3_1ve8xf0 -author: Keefryan -created_utc: 1785759450 -edited: false -body: -OP. Try this. https://diceware.rempe.us/ - comment: p1fo5fz parent: t3_1ve8xf0 author: n8dahwggExtracted text as captured
post: 1ve8xf0 author: Crypto-Moony created_utc: 1785750577 title: How Much Extra Security from a Passphrase body: [removed] comment: p1f1ym3 parent: t3_1ve8xf0 author: SubstantialNinja created_utc: 1785751340 edited: 1785752773 body: it's going to be relying only on the password in this case. 40 bits for the keys (but it's already solved so effectively 1 or to be exact n=1 trillion total affected keys) \* however many bits of entropy in the password. they'll be checking all affected keys + potential passwords iteratively. comment: p1f30vc parent: t3_1ve8xf0 author: Oxymorix created_utc: 1785751829 edited: false body: Using your hypothetical numbers, the rough brute-force work factors do multiply: (2\^{40}) possible mnemonics × (2\^{20}) possible passphrases = (2\^{60}) mnemonic/passphrase combinations. So, expressed logarithmically, you could describe the combined search as roughly 60 bits—provided the mnemonic and passphrase were independently and uniformly generated and the attacker must search both. However, the passphrase does not literally add entropy to the original 12-word mnemonic. BIP39 uses the mnemonic and passphrase together through PBKDF2-HMAC-SHA512 to create a completely different wallet. Every possible passphrase produces a valid wallet. The existing comment saying that security would rely “only on the password” is therefore too absolute. That becomes true only if the attacker has already identified the exact underlying mnemonic. If the attacker merely knows that the mnemonic lies somewhere within a (2\^{40}) vulnerable space, they generally still need to test the Cartesian product of mnemonic and passphrase candidates. There are two important qualifications: 1. Two randomly selected words from a 1,024-word list provide only 20 bits. That is a very weak passphrase if the mnemonic is ever identified. A million possibilities can be searched very quickly. 2. The current Coinkite estimate is not 40 bits for the Mk5. Coinkite presently estimates approximately 40 bits for affected Mk2/Mk3 seeds and approximately 72 bits for Mk4, Q and Mk5 under its current assumptions. Those estimates are preliminary and may change. Therefore, using Coinkite’s current Mk5 estimate and your hypothetical 20-bit diceware passphrase, the naïve combined ceiling would be approximately (72 + 20 = 92) bits—not 60 bits. But I would not recommend relying on only two diceware words, because any future discovery that narrows or reveals the mnemonic would leave only 20 bits protecting the wallet. So the basic “bits add” intuition is broadly correct for the combined independent search space, but it should not be interpreted as the passphrase strengthening the mnemonic itself, and the result is only as reliable as the assumptions behind both entropy estimates.Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
The original post body was removed ([removed]); it had asked whether passphrase entropy adds to the entropy of a 12-word seed. The comments remain.
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 6 lines
created_utc: 1785750577 title: How Much Extra Security from a Passphrase body: -Are the entropy bits from a passphrase added to the entropy bits of the 12 words? - -For example: Suppose he Mk5 gives you 40 bits of entropy in the 12 words it selects for you. You add a passphrase of 2 words selected by dice rolls using a diceware list of 1024 (2\^10) words. Each word has an entropy of 10 bits. So your total entropy is 40+10+10=60 bits. - -Is this how it works, or have I misunderstood? +[removed] comment: p1f1ym3 parent: t3_1ve8xf0Extracted text as captured
post: 1ve8xf0 author: Crypto-Moony created_utc: 1785750577 title: How Much Extra Security from a Passphrase body: [removed] comment: p1f1ym3 parent: t3_1ve8xf0 author: SubstantialNinja created_utc: 1785751340 edited: 1785752773 body: it's going to be relying only on the password in this case. 40 bits for the keys (but it's already solved so effectively 1 or to be exact n=1 trillion total affected keys) \* however many bits of entropy in the password. they'll be checking all affected keys + potential passwords iteratively. comment: p1f30vc parent: t3_1ve8xf0 author: Oxymorix created_utc: 1785751829 edited: false body: Using your hypothetical numbers, the rough brute-force work factors do multiply: (2\^{40}) possible mnemonics × (2\^{20}) possible passphrases = (2\^{60}) mnemonic/passphrase combinations. So, expressed logarithmically, you could describe the combined search as roughly 60 bits—provided the mnemonic and passphrase were independently and uniformly generated and the attacker must search both. However, the passphrase does not literally add entropy to the original 12-word mnemonic. BIP39 uses the mnemonic and passphrase together through PBKDF2-HMAC-SHA512 to create a completely different wallet. Every possible passphrase produces a valid wallet. The existing comment saying that security would rely “only on the password” is therefore too absolute. That becomes true only if the attacker has already identified the exact underlying mnemonic. If the attacker merely knows that the mnemonic lies somewhere within a (2\^{40}) vulnerable space, they generally still need to test the Cartesian product of mnemonic and passphrase candidates. There are two important qualifications: 1. Two randomly selected words from a 1,024-word list provide only 20 bits. That is a very weak passphrase if the mnemonic is ever identified. A million possibilities can be searched very quickly. 2. The current Coinkite estimate is not 40 bits for the Mk5. Coinkite presently estimates approximately 40 bits for affected Mk2/Mk3 seeds and approximately 72 bits for Mk4, Q and Mk5 under its current assumptions. Those estimates are preliminary and may change. Therefore, using Coinkite’s current Mk5 estimate and your hypothetical 20-bit diceware passphrase, the naïve combined ceiling would be approximately (72 + 20 = 92) bits—not 60 bits. But I would not recommend relying on only two diceware words, because any future discovery that narrows or reveals the mnemonic would leave only 20 bits protecting the wallet. So the basic “bits add” intuition is broadly correct for the combined independent search space, but it should not be interpreted as the passphrase strengthening the mnemonic itself, and the result is only as reliable as the assumptions behind both entropy estimates.Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
Reddit no longer served a comment speculating about how an attacker might search for passphrases after identifying a seed.
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 8 lines
Therefore, using Coinkite’s current Mk5 estimate and your hypothetical 20-bit diceware passphrase, the naïve combined ceiling would be approximately (72 + 20 = 92) bits—not 60 bits. But I would not recommend relying on only two diceware words, because any future discovery that narrows or reveals the mnemonic would leave only 20 bits protecting the wallet. So the basic “bits add” intuition is broadly correct for the combined independent search space, but it should not be interpreted as the passphrase strengthening the mnemonic itself, and the result is only as reliable as the assumptions behind both entropy estimates. - -comment: p1f7fig -parent: t1_p1f30vc -author: OldHamburger7923 -created_utc: 1785753819 -edited: false -body: -All of this is assuming they know your seed and are focused on it. If you never made transactions on the base seed account, they can't tell it from the other billions of apparently unused combinations of seeds. It's really not possible for them to do a proper scan for a passphrase for every possible combinations of seed phrases. More likely they are using known passwords from previous hacks and applying it to each address they generate. comment: p1fbwwj parent: t3_1ve8xf0Extracted text as captured
post: 1ve8xf0 author: Crypto-Moony created_utc: 1785750577 title: How Much Extra Security from a Passphrase body: Are the entropy bits from a passphrase added to the entropy bits of the 12 words? For example: Suppose he Mk5 gives you 40 bits of entropy in the 12 words it selects for you. You add a passphrase of 2 words selected by dice rolls using a diceware list of 1024 (2\^10) words. Each word has an entropy of 10 bits. So your total entropy is 40+10+10=60 bits. Is this how it works, or have I misunderstood? comment: p1f1ym3 parent: t3_1ve8xf0 author: SubstantialNinja created_utc: 1785751340 edited: 1785752773 body: it's going to be relying only on the password in this case. 40 bits for the keys (but it's already solved so effectively 1 or to be exact n=1 trillion total affected keys) \* however many bits of entropy in the password. they'll be checking all affected keys + potential passwords iteratively. comment: p1f30vc parent: t3_1ve8xf0 author: Oxymorix created_utc: 1785751829 edited: false body: Using your hypothetical numbers, the rough brute-force work factors do multiply: (2\^{40}) possible mnemonics × (2\^{20}) possible passphrases = (2\^{60}) mnemonic/passphrase combinations. So, expressed logarithmically, you could describe the combined search as roughly 60 bits—provided the mnemonic and passphrase were independently and uniformly generated and the attacker must search both. However, the passphrase does not literally add entropy to the original 12-word mnemonic. BIP39 uses the mnemonic and passphrase together through PBKDF2-HMAC-SHA512 to create a completely different wallet. Every possible passphrase produces a valid wallet. The existing comment saying that security would rely “only on the password” is therefore too absolute. That becomes true only if the attacker has already identified the exact underlying mnemonic. If the attacker merely knows that the mnemonic lies somewhere within a (2\^{40}) vulnerable space, they generally still need to test the Cartesian product of mnemonic and passphrase candidates. There are two important qualifications: 1. Two randomly selected words from a 1,024-word list provide only 20 bits. That is a very weak passphrase if the mnemonic is ever identified. A million possibilities can be searched very quickly. 2. The current Coinkite estimate is not 40 bits for the Mk5. Coinkite presently estimates approximately 40 bits for affected Mk2/Mk3 seeds and approximately 72 bits for Mk4, Q and Mk5 under its current assumptions. Those estimates are preliminary and may change.Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 0 lines
Extracted text as captured
post: 1ve8xf0 author: Crypto-Moony created_utc: 1785750577 title: How Much Extra Security from a Passphrase body: Are the entropy bits from a passphrase added to the entropy bits of the 12 words? For example: Suppose he Mk5 gives you 40 bits of entropy in the 12 words it selects for you. You add a passphrase of 2 words selected by dice rolls using a diceware list of 1024 (2\^10) words. Each word has an entropy of 10 bits. So your total entropy is 40+10+10=60 bits. Is this how it works, or have I misunderstood? comment: p1f1ym3 parent: t3_1ve8xf0 author: SubstantialNinja created_utc: 1785751340 edited: 1785752773 body: it's going to be relying only on the password in this case. 40 bits for the keys (but it's already solved so effectively 1 or to be exact n=1 trillion total affected keys) \* however many bits of entropy in the password. they'll be checking all affected keys + potential passwords iteratively. comment: p1f30vc parent: t3_1ve8xf0 author: Oxymorix created_utc: 1785751829 edited: false body: Using your hypothetical numbers, the rough brute-force work factors do multiply: (2\^{40}) possible mnemonics × (2\^{20}) possible passphrases = (2\^{60}) mnemonic/passphrase combinations. So, expressed logarithmically, you could describe the combined search as roughly 60 bits—provided the mnemonic and passphrase were independently and uniformly generated and the attacker must search both. However, the passphrase does not literally add entropy to the original 12-word mnemonic. BIP39 uses the mnemonic and passphrase together through PBKDF2-HMAC-SHA512 to create a completely different wallet. Every possible passphrase produces a valid wallet. The existing comment saying that security would rely “only on the password” is therefore too absolute. That becomes true only if the attacker has already identified the exact underlying mnemonic. If the attacker merely knows that the mnemonic lies somewhere within a (2\^{40}) vulnerable space, they generally still need to test the Cartesian product of mnemonic and passphrase candidates. There are two important qualifications: 1. Two randomly selected words from a 1,024-word list provide only 20 bits. That is a very weak passphrase if the mnemonic is ever identified. A million possibilities can be searched very quickly. 2. The current Coinkite estimate is not 40 bits for the Mk5. Coinkite presently estimates approximately 40 bits for affected Mk2/Mk3 seeds and approximately 72 bits for Mk4, Q and Mk5 under its current assumptions. Those estimates are preliminary and may change.Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
0 presentation-noise differences. Sidebar, ticker and other page chrome churn that our review classified as not being changes to what the source says.
How to check this yourself
The excerpts and plain unified diffs above show the text this project held and how it changed. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.
Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.
How to check this yourself
Compare the screenshot or a quotation against the original while it is available.